openstack/ansible-hardening
Code Issues Proposed changes
ansible-hardening/doc/source/developer-notes/V-51379.rst
Major Hayden 0d894f572a V-51739: LSM device labeling exception 
Implements: blueprint security-hardening

Change-Id: Iad9f2e4e98815794e3ec84cb5f4b7194512d666f
2015-10-14 13:42:23 +00:00

321 B
Raw Blame History

Exception

Although SELinux works through a labeling system where every file (including devices) receive a label, AppArmor works purely through policies without labels. However, openstack-ansible does configure several AppArmor policies to reduce the chances and impact of LXC container breakouts on OpenStack hosts.