From: Serge Hallyn <serge.hallyn@ubuntu.com>
Date: Wed, 25 Nov 2015 20:45:08 +0000 (+0000)
Subject: apparmor: support lxc.aa_profile = unchanged
X-Git-Tag: lxc-2.0.0.beta1~37
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=480c876b201e1296f94b53735eba786ba5879a6e;p=thirdparty%2Flxc.git

apparmor: support lxc.aa_profile = unchanged

In which case lxc will not update the apparmor profile at all.

Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
---

diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c
index 88ea5a315..d78bd7a02 100644
--- a/src/lxc/lsm/apparmor.c
+++ b/src/lxc/lsm/apparmor.c
@@ -42,6 +42,7 @@ static int mount_features_enabled = 0;
 #define AA_DEF_PROFILE "lxc-container-default"
 #define AA_MOUNT_RESTR "/sys/kernel/security/apparmor/features/mount/mask"
 #define AA_ENABLED_FILE "/sys/module/apparmor/parameters/enabled"
+#define AA_UNCHANGED "unchanged"
 
 static bool check_mount_feature_enabled(void)
 {
@@ -156,6 +157,12 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf
 	if (!aa_enabled)
 		return 0;
 
+	/* user may request that we just ignore apparmor */
+	if (label && strcmp(label, AA_UNCHANGED) == 0) {
+		INFO("apparmor profile unchanged per user request");
+		return 0;
+	}
+
 	if (!label) {
 		if (use_default)
 			label = AA_DEF_PROFILE;