On 06/02/2014 12:06 AM, John Goerzen wrote: > Everything I have read says one must use either AppArmor or user > namespaces to make it secure.
or, like i said, you can r/o mount certain pseudo-fs and drop a bunch of capabilities, like lxc-debconfig in lxc-stuff does by default (and lxc-debian in debians lxc did until i've been told to not touch the upstream debian template). > That is not sufficient. i didn't say that it would make the container secure, i only said that "*e.g.* mounting sysfs r/o would fix that [specific] whole" - nothing more, nothing less, and nothing different than that. but anyway, rather than repeating what we said and what we've not said, i'm looking forward to the two outstanding things from you: a) a patch to fix apparmor integration to not break other apparmor usage(s) on the ystem, and b) if you'd like me to disable apparmor until it's fully supported by upstream, or if we should leave it as is. -- Address: Daniel Baumann, Donnerbuehlweg 3, CH-3012 Bern Email: daniel.baum...@progress-technologies.net Internet: http://people.progress-technologies.net/~daniel.baumann/ -- To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org with a subject of "unsubscribe". Trouble? Contact listmas...@lists.debian.org
