[libvirt] How to deal with LXC cgroup access control with apparmor ?

止语 zhongjj at foxmail.com
Mon Aug 26 07:37:12 UTC 2013


I don't know if it “legal” to send the email here :)
================

I am playing with libvirt 1.1.1 (lxc)
when I was starting a LXC container,  the process location of cgroup is pretty ,  just the root directory
from the process. But I could tune the cgroup in a container as an user that logged, This is not accepted... 

I wonder how to restrict it with apparmor ,so one can not modify files in  the cgroup fs, e.g  the cpus or mem,
if i restrict it with "deny /sys/fs/cgroup/** wrklx,"  in apparmor ,the container woulld not start up . 
"Permission denied", because that a process would mount the cgroup, it seems done by libvirt_lxc, 
Any way to restrict the cgroup in the container or just not mount cgroup in the container ??  

Any help would be appreciated, thanks .

------------------
止语
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130826/0a572764/attachment-0001.htm>


More information about the libvir-list mailing list