allow cgroupfs mounts under /sys/fs/cgroup

Systemd needs to be able to do these, and it does not bypass
any of our apparmor rules.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

diff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in
index 235913b52763844e075da16645af5ad1ce871afb..1121256d7fff2b7e52080308068a1aef9df1014f 100644 (file)
--- a/config/apparmor/abstractions/container-base.in
+++ b/config/apparmor/abstractions/container-base.in
@@ -86,4 +86,5 @@
   deny /sys/firmware/efi/efivars/** rwklx,
   deny /sys/kernel/security/** rwklx,
   mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
+  mount fstype=cgroup -> /sys/fs/cgroup/**,