Risks of using unconfined

[sahostking]

Hi guys

What are the risks of making the following a global setting. We host VPS servers ranging from Ubuntu, Debian but mainly cPanel and CentOS servers.

CPanel requires the following :

lxc.aa_profile = unconfined

in each conf file. We dont want to do this manually each time so considering doing it:

/usr/share/lxc/config/common.conf

or

/usr/share/lxc/config/centos.common.conf

Any risks in doing this?

 

[oguz]

lxc.aa_profile = unconfined

I think it should be "lxc.apparmor.profile = unconfined".

When you use AppArmor in "unconfined", then it means you forgo any protection provided by it. That means, your containers won't be protected against internal/external threats. In the end, it's a risk-reward decision you have to make. You can disable it if you can't use AppArmor in your setup because of unsupported software, but it's good to be aware of the risks when doing that.