How to update default AppArmor profile for containers

[Martin Jonáš]

How is apparmor profile "generated" created? How can we add additional rules to this profile? Or is there another way how to create profile with everything default generated profeile has but with added rules? We need to deny some operations inside LXC containers.

 

[Martin Jonáš]

Found out how to do it.

Either to /etc/pve/VMID.conf or /etc/lxc/defult.conf add:

lxc.apparmor.raw: #include <pathto/customrules> (# is intentional!)

Then create custom AppArmor rules in /etc/apparmor.d/pathto/customrules