From: Serge Hallyn <serge.hallyn@ubuntu.com>
Date: Tue, 29 Apr 2014 19:57:49 +0000 (-0500)
Subject: apparmor: allow writes to sem* and msg* sysctls
X-Git-Tag: lxc-1.1.0.alpha1~134
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=773bd28258371ad0058ff946c5cf94419920ffdd;p=thirdparty%2Flxc.git

apparmor: allow writes to sem* and msg* sysctls

/proc/sys/kernel/sem* and /proc/sys/kernel/msg* are ipc sysctls
which are properly namespaced.  Allow writes to them from
containers.

Reported-by: Dan Kegel <dank@kegel.com>
Signed-off-by: Serge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: Stéphane Graber <stgraber@ubuntu.com>
---

diff --git a/config/apparmor/abstractions/container-base b/config/apparmor/abstractions/container-base
index c109baad1..71e93487e 100644
--- a/config/apparmor/abstractions/container-base
+++ b/config/apparmor/abstractions/container-base
@@ -55,7 +55,7 @@
   deny /proc/sys/ker[^n]*{,/**} wklx,
   deny /proc/sys/kern[^e]*{,/**} wklx,
   deny /proc/sys/kerne[^l]*{,/**} wklx,
-  deny /proc/sys/kernel/[^shd]*{,/**} wklx,
+  deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
   deny /proc/sys/kernel/d[^o]*{,/**} wklx,
   deny /proc/sys/kernel/do[^m]*{,/**} wklx,
   deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
@@ -74,7 +74,12 @@
   deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
   deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
   deny /proc/sys/kernel/hostname?*{,/**} wklx,
-  deny /proc/sys/kernel/s[^h]*{,/**} wklx,
+  deny /proc/sys/kernel/m[^s]*{,/**} wklx,
+  deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
+  deny /proc/sys/kernel/msg*/** wklx,
+  deny /proc/sys/kernel/s[^he]*{,/**} wklx,
+  deny /proc/sys/kernel/se[^m]*{,/**} wklx,
+  deny /proc/sys/kernel/sem*/** wklx,
   deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
   deny /proc/sys/kernel/shm*/** wklx,
   deny /proc/sys/kernel?*{,/**} wklx,
diff --git a/config/apparmor/container-rules b/config/apparmor/container-rules
index 2c8c0b494..ea5c4086f 100644
--- a/config/apparmor/container-rules
+++ b/config/apparmor/container-rules
@@ -5,7 +5,7 @@
   deny /proc/sys/ker[^n]*{,/**} wklx,
   deny /proc/sys/kern[^e]*{,/**} wklx,
   deny /proc/sys/kerne[^l]*{,/**} wklx,
-  deny /proc/sys/kernel/[^shd]*{,/**} wklx,
+  deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
   deny /proc/sys/kernel/d[^o]*{,/**} wklx,
   deny /proc/sys/kernel/do[^m]*{,/**} wklx,
   deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
@@ -24,7 +24,12 @@
   deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
   deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
   deny /proc/sys/kernel/hostname?*{,/**} wklx,
-  deny /proc/sys/kernel/s[^h]*{,/**} wklx,
+  deny /proc/sys/kernel/m[^s]*{,/**} wklx,
+  deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
+  deny /proc/sys/kernel/msg*/** wklx,
+  deny /proc/sys/kernel/s[^he]*{,/**} wklx,
+  deny /proc/sys/kernel/se[^m]*{,/**} wklx,
+  deny /proc/sys/kernel/sem*/** wklx,
   deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
   deny /proc/sys/kernel/shm*/** wklx,
   deny /proc/sys/kernel?*{,/**} wklx,
diff --git a/config/apparmor/container-rules.base b/config/apparmor/container-rules.base
index 615f01519..a657481c6 100644
--- a/config/apparmor/container-rules.base
+++ b/config/apparmor/container-rules.base
@@ -8,6 +8,8 @@ allow /sys/devices/virtual/net/**
 allow /sys/class/net/**
 block /proc/sys
 allow /proc/sys/kernel/shm*
+allow /proc/sys/kernel/sem*
+allow /proc/sys/kernel/msg*
 allow /proc/sys/kernel/hostname
 allow /proc/sys/kernel/domainname
 allow /proc/sys/net/**