On Fri, Dec 02, 2016 at 12:59:52PM +0100, Christian Recktenwald wrote: > Can one use AppArmor with VServer? > Any resources, experiances, tips on that one? I tried: debian 8.6 Linux 3.10.104-vs2.3.6.9+lihas1 x86_64 aa-status failes with: "apparmor module is loaded. You do not have enough privilege to read the profile set." according to strace this is beacuse /sys/kernel/security/apparmor/profiles is missing: access("/sys/kernel/security/apparmor/profiles", R_OK) = -1 ENOENT (No such file or directory) write(2, "You do not have enough privilege"..., 58You do not have enough privilege to read the profile set. ) = 58 # ls -al /sys/kernel/security/apparmor total 0 drwxr-xr-x 3 root root 0 Dec 3 19:21 . drwxr-xr-x 3 root root 0 Dec 3 19:21 .. -rw-r----- 1 root root 0 Dec 3 19:21 .load -rw-r----- 1 root root 0 Dec 3 19:21 .remove -rw-r----- 1 root root 0 Dec 3 19:21 .replace drwxr-xr-x 5 root root 0 Dec 3 19:21 features grep -i AppArmor /boot/config-3.10.104-vs2.3.6.9+lihas1 CONFIG_SECURITY_APPARMOR=y CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1 # CONFIG_DEFAULT_SECURITY_APPARMOR is not set cat /proc/cmdline root=/dev/mapper/servvg-lv01root ro apparmor=1 security=apparmor _but_ I can load rulesets and they seem to work: if I load a ruleset let's say for /usr/bin/mutt on the host it works inside all vservers in the same way - so no namespacing whatsoever. as for now there is exactly one vserver where I have to do this, so it works for me. -- LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart Fon: +49 (7 11) 78 28 50 90 - Fax: +49 (7 11) 78 28 50 91 Mail: lihas@lihas.de - Web: http://lihas.de Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 Stuttgart