mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-19 17:38:10 +01:00
14 lines
543 B
Text
14 lines
543 B
Text
# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which
|
|
# will source all profiles under /etc/apparmor.d/lxc
|
|
|
|
profile lxc-container-default-with-mounting flags=(attach_disconnected,mediate_deleted) {
|
|
include <abstractions/lxc/container-base>
|
|
|
|
# allow standard blockdevtypes.
|
|
# The concern here is in-kernel superblock parsers bringing down the
|
|
# host with bad data. However, we continue to disallow proc, sys, securityfs,
|
|
# etc to nonstandard locations.
|
|
mount fstype=ext*,
|
|
mount fstype=xfs,
|
|
mount fstype=btrfs,
|
|
}
|