Enable stacking for privileged containers

[stgraber]

Signed-off-by: Stéphane Graber stgraber@ubuntu.com

[tyhicks]

This looks correct to me. I'll update this PR once I've discussed the safety of doing policy loads inside of a privileged container inside of an AppArmor policy namespace with John. Thanks!

[brauner]

I'll hold off on merging this until you ping me, @stgraber.

[stgraber]

Based on IRC discussion, this is fine to merge as far as the apparmor team is concerned.

[tyhicks]

After speaking with John Johansen about this, we think it is safe to stick a confined privileged container inside of an apparmor namespace, allow the container to inherit CAP_MAC_ADMIN, and grant the container access to the securityfs mounted inside of the container.

Thanks for putting this PR together. I look forward to using this feature.

[brauner]

Cool guys. This sounds super-exciting!