lxc-container-default-with-nesting is too lax

[Serge Hallyn]

Before cgmanager, lxc-container-default-with-nesting needed to allow the container to mount fstype=cgroup. This is no longer needed and is not safe, therefore should no longer be allowed.

[Serge Hallyn (serge-hallyn)]

Verified that simply removing the line:

# mount fstype=cgroup -> /sys/fs/cgroup/**,

stops cgroup-lite from mounting the cgroupfs, while cgmanager continues to work.

I'm going to assign this to stgraber just to get his opinion on whether he still needs cgroups mountable in some cases for cgroup-lite to work, or not. (For instance, libvirt won't currently work without that)

[Stéphane Graber (stgraber)]

I absolutely agree we should be getting rid of this from the profile ASAP.

[Serge Hallyn (serge-hallyn)]

Quoting Stéphane Graber (<email address hidden>):
> I absolutely agree we should be getting rid of this from the profile
> ASAP.

Would you call this a bug or a feature? (Shall I seek FFE?)

[Stéphane Graber (stgraber)]

Security improvement, I don't think we need a FFe, just send a patch upstream and I'll get it in 1.0.3 along with the other apparmor updates.