libvirt-bin 1.3.1-1ubuntu10 / etc / apparmor.d / libvirt / TEMPLATE.lxc

#
# This profile is for the domain whose UUID matches this file.
#

#include <tunables/global>

profile LIBVIRT_TEMPLATE (attach_disconnected,mediate_deleted) {
  #include <abstractions/libvirt-lxc>

  # Globally allows everything to run under this profile. This is fine-tuned via
  # via abstractions/libvirt-lxc and can be narrowed depending on the
  # container's use.
  file,
  capability,
  network,

  # the container may never be allowed to mount devpts.  If it does, it
  # will remount the host's devpts.  We could allow it to do it with
  # the newinstance option (but, right now, we don't).
  deny mount fstype=devpts,
}