summaryrefslogtreecommitdiff
path: root/coccinelle
diff options
context:
space:
mode:
authorTomáš Janoušek <tomi@nomi.cz>2016-09-16 01:26:31 +0200
committerEvgeny Vereshchagin <evvers@ya.ru>2016-09-16 02:26:31 +0300
commit7dabbb55a8744a43ec869839ef371b184c8d2ffe (patch)
tree98604277ead34bb6f15cfeef1e94e481246c514e /coccinelle
parent390e02073514cc6972aa8bc5f10d974c226ecbcb (diff)
logind: fix /run/user/$UID creation in apparmor-confined containers (#4154)
When a docker container is confined with AppArmor [1] and happens to run on top of a kernel that supports mount mediation [2], e.g. any Ubuntu kernel, mount(2) returns EACCES instead of EPERM. This then leads to: systemd-logind[33]: Failed to mount per-user tmpfs directory /run/user/1000: Permission denied login[42]: pam_systemd(login:session): Failed to create session: Access denied and user sessions don't start. This also applies to selinux that too returns EACCES on mount denial. [1] https://github.com/docker/docker/blob/master/docs/security/apparmor.md#understand-the-policies [2] http://bazaar.launchpad.net/~apparmor-dev/apparmor/master/view/head:/kernel-patches/4.7/0025-UBUNTU-SAUCE-apparmor-Add-the-ability-to-mediate-mou.patch
Diffstat (limited to 'coccinelle')
0 files changed, 0 insertions, 0 deletions