Allow cgroupfs remount by systemd

Signed-off-by: Stéphane Graber <stgraber@ubuntu.com>

diff --git a/config/apparmor/abstractions/container-base.in b/config/apparmor/abstractions/container-base.in
index e8a39ce3b5ec11f36ded094a9555e6b422f53911..2a3969b9f27298062a4d0edcea5ccff610d4be0f 100644 (file)
--- a/config/apparmor/abstractions/container-base.in
+++ b/config/apparmor/abstractions/container-base.in
@@ -92,4 +92,5 @@
   deny /sys/kernel/security/** rwklx,
   mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,
   mount fstype=cgroup -> /sys/fs/cgroup/**,
+  mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,