start-container revision 1b0c17462ad4f9a05ea6e5ced5e444152ec7a193
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # The following 3 entries are only supported by recent apparmor versions.
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # Comment them if the apparmor parser doesn't recognize them.
d23ecf32e56cce69bc42eb5c96dddf7909c623abjelmd # currently blocked by apparmor bug
d23ecf32e56cce69bc42eb5c96dddf7909c623abjelmd mount -> /usr/lib/*/lxc/{**,},
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder mount -> /usr/lib/lxc/{**,},
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner mount fstype=devpts -> /dev/pts/,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder mount options=bind /dev/pts/ptmx/ -> /dev/ptmx/,
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner mount options=bind /dev/pts/** -> /dev/**,
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner mount options=(rw, make-slave) -> **,
7d0ee72ee91ec305408688b969c43f07b9667c80Christian Maeder mount fstype=debugfs,
456238178f89e5a3de2988ee6c8af924297d52d9Christian Maeder # allow pre-mount hooks to stage mounts under /var/lib/lxc/<container>/
0e5b095a19790411e5352fa7cf57cb0388e70472Christian Maeder mount -> /var/lib/lxc/{**,},
d23ecf32e56cce69bc42eb5c96dddf7909c623abjelmd # required for some pre-mount hooks (like the new lxc-start-ephemeral)
c9a7e6af169a2adfb92f42331cd578065ed83a2bChristian Maeder mount fstype=overlayfs,
456238178f89e5a3de2988ee6c8af924297d52d9Christian Maeder mount fstype=aufs,
5191fa24c532d1f67e7a642e9aece65efb8a0975Christian Maeder mount fstype=ecryptfs,
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # all umounts are under the original root's /mnt, but right now we
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # can't allow those umounts after pivot_root. So allow all umounts
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # right now. They'll be restricted for the container at least.
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner #umount /mnt/{**,},
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # This may look a bit redundant, however it appears we need all of
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # them if we want things to work properly on all combinations of kernel
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner # and userspace parser...
a84a8d508a0778b13a4d097a6dd34b95feae78acJens Elkner pivot_root /usr/lib/*/lxc/,
f8597aabc9db75dcf504e3151faf220a165c90d1Eugen Kuksa pivot_root /usr/lib/lxc/**,
f8597aabc9db75dcf504e3151faf220a165c90d1Eugen Kuksa pivot_root /usr/lib/*/lxc/**,
f8597aabc9db75dcf504e3151faf220a165c90d1Eugen Kuksa change_profile -> lxc-*,
ab4256496e72886018b78571057331f373da6883Eugen Kuksa change_profile -> unconfined,