config: apparmor: add AppArmor profile for lxc-copy

lxc-copy can start container as lxc-start does in some cases,
so we need to have the same profile for it.

Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>

diff --git a/config/apparmor/meson.build b/config/apparmor/meson.build
index 24a07ebab81b4cdd77faa0561132afa12a906371..d378b4c0a1a8ef993fea24896b61d7852be6287b 100644 (file)
--- a/config/apparmor/meson.build
+++ b/config/apparmor/meson.build
@@ -14,4 +14,11 @@ if libapparmor.found()
         output: 'usr.bin.lxc-start',
         install: true,
         install_dir: join_paths(sysconfdir, 'apparmor.d'))
+
+    configure_file(
+        configuration: dummy_config_data,
+        input: 'usr.bin.lxc-copy',
+        output: 'usr.bin.lxc-copy',
+        install: true,
+        install_dir: join_paths(sysconfdir, 'apparmor.d'))
 endif

diff --git a/config/apparmor/usr.bin.lxc-copy b/config/apparmor/usr.bin.lxc-copy
new file mode 100644 (file)
index 0000000..36b8d5c
--- /dev/null
+++ b/config/apparmor/usr.bin.lxc-copy
@@ -0,0 +1,5 @@
+#include <tunables/global>
+
+/usr/bin/lxc-copy flags=(attach_disconnected) {
+  #include <abstractions/lxc/start-container>
+}

diff --git a/config/init/systemd/lxc-apparmor-load b/config/init/systemd/lxc-apparmor-load
index abca581e870baf69e36e3cfa31c42f4c83417817..a612b7ab82df64c27135fe980f6517310ea07d2f 100755 (executable)
--- a/config/init/systemd/lxc-apparmor-load
+++ b/config/init/systemd/lxc-apparmor-load
@@ -7,9 +7,11 @@ set -eu
 SYSF=/sys/kernel/security/apparmor/features/mount/mask
 if [ -f $SYSF ]; then
        if [ -x /lib/apparmor/profile-load ]; then
+               /lib/apparmor/profile-load usr.bin.lxc-copy
                /lib/apparmor/profile-load usr.bin.lxc-start
                /lib/apparmor/profile-load lxc-containers
        elif [ -x /lib/init/apparmor-profile-load ]; then
+               /lib/init/apparmor-profile-load usr.bin.lxc-copy
                /lib/init/apparmor-profile-load usr.bin.lxc-start
                /lib/init/apparmor-profile-load lxc-containers
        fi