提交 ef7dc7d4 编写于 作者: C Cédric Bosdonnat 提交者: Daniel P. Berrange

add support for apparmor in lxc-enter-namespace

上级 500b2e96
...@@ -2,6 +2,13 @@ ...@@ -2,6 +2,13 @@
#include <abstractions/base> #include <abstractions/base>
# Needed for lxc-enter-namespace
capability sys_admin,
capability sys_chroot,
# Added for lxc-enter-namespace --cmd /bin/bash
/bin/bash PUx,
/usr/sbin/cron PUx, /usr/sbin/cron PUx,
/usr/lib/systemd/systemd PUx, /usr/lib/systemd/systemd PUx,
......
...@@ -33,6 +33,9 @@ ...@@ -33,6 +33,9 @@
#ifdef WITH_SELINUX #ifdef WITH_SELINUX
# include <selinux/selinux.h> # include <selinux/selinux.h>
#endif #endif
#ifdef WITH_APPARMOR
# include <sys/apparmor.h>
#endif
#define VIR_FROM_THIS VIR_FROM_NONE #define VIR_FROM_THIS VIR_FROM_NONE
...@@ -239,6 +242,18 @@ virDomainLxcEnterSecurityLabel(virSecurityModelPtr model, ...@@ -239,6 +242,18 @@ virDomainLxcEnterSecurityLabel(virSecurityModelPtr model,
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s", virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
_("Support for SELinux is not enabled")); _("Support for SELinux is not enabled"));
goto error; goto error;
#endif
} else if (STREQ(model->model, "apparmor")) {
#ifdef WITH_APPARMOR
if (aa_change_profile(label->label) < 0) {
virReportSystemError(errno, _("error changing profile to %s"),
label->label);
goto error;
}
#else
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, "%s",
_("Support for AppArmor is not enabled"));
goto error;
#endif #endif
} else { } else {
virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED, virReportError(VIR_ERR_ARGUMENT_UNSUPPORTED,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册