1. docker
  2. Commit 59fe77bfa638001cbe9af386f350d6e0dbb23398
Browse code

Don't restrict lxc because of apparmor

We don't have the flexibility to do extra things with lxc because it is
a black box and most fo the magic happens before we get a chance to
interact with it in dockerinit.
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)

Michael Crosby authored on 2014/05/03 03:14:24
Showing 3 changed files
daemon/execdriver/lxc/driver.go
History View file @ 59fe77b
... ... 
@@ -16,7 +16,6 @@ import (
16 16 
 	"github.com/dotcloud/docker/daemon/execdriver"
17 17 
 	"github.com/dotcloud/docker/pkg/cgroups"
18 18 
 	"github.com/dotcloud/docker/pkg/label"
19 
-	"github.com/dotcloud/docker/pkg/libcontainer/security/restrict"
20 19 
 	"github.com/dotcloud/docker/pkg/system"
21 20 
 	"github.com/dotcloud/docker/utils"
22 21 
 )
... ... 
@@ -34,11 +33,6 @@ func init() {
34 34 
 		if err := setupNetworking(args); err != nil {
35 35 
 			return err
36 36 
 		}
37 
-		if !args.Privileged {
38 
-			if err := restrict.Restrict(); err != nil {
39 
-				return err
40 
-			}
41 
-		}
42 37 
 		if err := setupCapabilities(args); err != nil {
43 38 
 			return err
44 39 
 		}
pkg/libcontainer/nsinit/init.go
History View file @ 59fe77b
... ... 
@@ -79,7 +79,7 @@ func Init(container *libcontainer.Container, uncleanRootfs, consolePath string,
79 79 
 		return fmt.Errorf("set process label %s", err)
80 80 
 	}
81 81 
 	if container.Context["restrictions"] != "" {
82 
-		if err := restrict.Restrict(); err != nil {
82 
+		if err := restrict.Restrict("proc", "sys"); err != nil {
83 83 
 			return err
84 84 
 		}
85 85 
 	}
pkg/libcontainer/security/restrict/restrict.go
History View file @ 59fe77b
... ... 
@@ -11,9 +11,9 @@ import (
11 11
12 12 
 // This has to be called while the container still has CAP_SYS_ADMIN (to be able to perform mounts).
13 13 
 // However, afterwards, CAP_SYS_ADMIN should be dropped (otherwise the user will be able to revert those changes).
14 
-func Restrict() error {
14 
+func Restrict(mounts ...string) error {
15 15 
 	// remount proc and sys as readonly
16 
-	for _, dest := range []string{"proc", "sys"} {
16 
+	for _, dest := range mounts {
17 17 
 		if err := system.Mount("", dest, "", syscall.MS_REMOUNT|syscall.MS_RDONLY, ""); err != nil {
18 18 
 			return fmt.Errorf("unable to remount %s readonly: %s", dest, err)
19 19 
 		}