cgmanager: container-base apparmor abstraction: allow mount move

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>

diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base
index 9db94e782454c976a70de26f318c003812b09577..d1cd84a4eca9920f1bac26e54f68830f924676e1 100644 (file)
--- a/config/apparmor/abstractions/container-base
+++ b/config/apparmor/abstractions/container-base
@@ -48,3 +48,4 @@
   deny /sys/fs/cg[^r]*/** wklx,
   deny /sys/firmware/efi/efivars/** rwklx,
   deny /sys/kernel/security/** rwklx,
+  mount options=(move) /sys/fs/cgroup/cgmanager/ -> /sys/fs/cgroup/cgmanager.lower/,