On Fri, Dec 02, 2016 at 12:59:52PM +0100, Christian Recktenwald wrote:
> Can one use AppArmor with VServer?
> Any resources, experiances, tips on that one?
I tried:
debian 8.6
Linux 3.10.104-vs2.3.6.9+lihas1 x86_64
aa-status failes with:
"apparmor module is loaded.
You do not have enough privilege to read the profile set."
according to strace this is beacuse /sys/kernel/security/apparmor/profiles
is missing:
access("/sys/kernel/security/apparmor/profiles", R_OK) = -1 ENOENT (No such file or directory)
write(2, "You do not have enough privilege"..., 58You do not have enough privilege to read the profile set.
) = 58
# ls -al /sys/kernel/security/apparmor
total 0
drwxr-xr-x 3 root root 0 Dec 3 19:21 .
drwxr-xr-x 3 root root 0 Dec 3 19:21 ..
-rw-r----- 1 root root 0 Dec 3 19:21 .load
-rw-r----- 1 root root 0 Dec 3 19:21 .remove
-rw-r----- 1 root root 0 Dec 3 19:21 .replace
drwxr-xr-x 5 root root 0 Dec 3 19:21 features
grep -i AppArmor /boot/config-3.10.104-vs2.3.6.9+lihas1
CONFIG_SECURITY_APPARMOR=y
CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
# CONFIG_DEFAULT_SECURITY_APPARMOR is not set
cat /proc/cmdline
root=/dev/mapper/servvg-lv01root ro apparmor=1 security=apparmor
_but_ I can load rulesets and they seem to work:
if I load a ruleset let's say for /usr/bin/mutt on the host it
works inside all vservers in the same way - so no namespacing whatsoever.
as for now there is exactly one vserver where I have to do this, so it works for me.
-- LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart Fon: +49 (7 11) 78 28 50 90 - Fax: +49 (7 11) 78 28 50 91 Mail: lihas_at_lihas.de - Web: http://lihas.de Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 StuttgartReceived on Sat Dec 3 19:20:59 2016