From: Serge Hallyn Date: Wed, 6 Mar 2013 19:41:04 +0000 (-0600) Subject: attach: handle apparmor transitions in !NEWNS cases X-Git-Tag: lxc-0.9.0.rc1~2^2~18 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=990d9d7c371d26021f14d25a62484776b1f14d32;p=thirdparty%2Flxc.git attach: handle apparmor transitions in !NEWNS cases If we're not attaching to the mount ns , then don't enter the container's apparmor policy. Since we're running binaries from the host and not the container, that actually seems the sane thing to do (besides also the lazier thing). If we dont' do this patch, then we will need to move the apparmor attach past the procfs remount, will need to also mount securityfs if available, and for the !remount_proc_sys case we'll want to mount those just long enough to do the apparmor transition. Signed-off-by: Serge Hallyn Acked-by: Stéphane Graber --- diff --git a/src/lxc/lxc_attach.c b/src/lxc/lxc_attach.c index 1622cb12f..6f60ecb0a 100644 --- a/src/lxc/lxc_attach.c +++ b/src/lxc/lxc_attach.c @@ -376,9 +376,11 @@ int main(int argc, char *argv[]) lxc_sync_fini_parent(handler); close(cgroup_ipc_sockets[1]); - if (attach_apparmor(init_ctx->aa_profile) < 0) { - ERROR("failed switching apparmor profiles"); - return -1; + if ((namespace_flags & CLONE_NEWNS)) { + if (attach_apparmor(init_ctx->aa_profile) < 0) { + ERROR("failed switching apparmor profiles"); + return -1; + } } /* A description of the purpose of this functionality is