Subject: Re: [vserver] VServer and AppArmor ? - [runs half way]
From: Christian Recktenwald <kernel@lihas.de>
Date: Sat, 3 Dec 2016 20:21:06 +0100

On Fri, Dec 02, 2016 at 12:59:52PM +0100, Christian Recktenwald wrote:
> Can one use AppArmor with VServer?
> Any resources, experiances, tips on that one?

I tried:
	debian 8.6
	Linux 3.10.104-vs2.3.6.9+lihas1 x86_64

    aa-status failes with: 
		"apparmor module is loaded.
		 You do not have enough privilege to read the profile set."
  
  	according to strace this is beacuse /sys/kernel/security/apparmor/profiles
	is missing:
		access("/sys/kernel/security/apparmor/profiles", R_OK) = -1 ENOENT (No such file or
directory)
		write(2, "You do not have enough privilege"..., 58You do not have enough privilege
to read the profile set.
		) = 58

    # ls -al /sys/kernel/security/apparmor
	total 0
	drwxr-xr-x 3 root root 0 Dec  3 19:21 .
	drwxr-xr-x 3 root root 0 Dec  3 19:21 ..
	-rw-r----- 1 root root 0 Dec  3 19:21 .load
	-rw-r----- 1 root root 0 Dec  3 19:21 .remove
	-rw-r----- 1 root root 0 Dec  3 19:21 .replace
	drwxr-xr-x 5 root root 0 Dec  3 19:21 features

	grep -i AppArmor /boot/config-3.10.104-vs2.3.6.9+lihas1 
		CONFIG_SECURITY_APPARMOR=y
		CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
		# CONFIG_DEFAULT_SECURITY_APPARMOR is not set

	cat /proc/cmdline
		root=/dev/mapper/servvg-lv01root ro apparmor=1 security=apparmor

	_but_ I can load rulesets and they seem to work:
	if I load a ruleset let's say for /usr/bin/mutt on the host it 
	works inside all vservers in the same way - so no namespacing whatsoever.

as for now there is exactly one vserver where I have to do this, so it works for me.

-- 
LiHAS - Adrian Reyer - Hessenwiesenstraße 10 - D-70565 Stuttgart
Fon: +49 (7 11) 78 28 50 90 - Fax:  +49 (7 11) 78 28 50 91
Mail: lihas@lihas.de - Web: http://lihas.de
Linux, Netzwerke, Consulting & Support - USt-ID: DE 227 816 626 Stuttgart