Eric Windisch 9f8e7b5fed Introduce a dedicated unconfined AA policy ...

By using the 'unconfined' policy for privileged
containers, we have inherited the host's apparmor
policies, which really make no sense in the
context of the container's filesystem.

For instance, policies written against
the paths of binaries such as '/usr/sbin/tcpdump'
can be easily circumvented by moving the binary
within the container filesystem.

Fixes GH#5490

Signed-off-by: Eric Windisch <eric@windisch.us>
Upstream-commit: 87376c3add7dcd48830060652554e7ae43d11881
Component: engine

2015-07-22 11:28:32 -04:00

components/engine

Introduce a dedicated unconfined AA policy

2015-07-22 11:28:32 -04:00

Description

No description provided

310 MiB

Languages

Go 92%

Shell 5.5%

Dockerfile 1.1%

Go-Checksums 0.9%

Makefile 0.3%

Other 0.2%