{"action":"opened","number":14855,"pull_request":{"url":"https://api.github.com/repos/docker/docker/pulls/14855","id":40577759,"html_url":"https://github.com/docker/docker/pull/14855","diff_url":"https://github.com/docker/docker/pull/14855.diff","patch_url":"https://github.com/docker/docker/pull/14855.patch","issue_url":"https://api.github.com/repos/docker/docker/issues/14855","number":14855,"state":"open","locked":false,"title":"Introduce a dedicated unconfined AA policy","user":{"login":"ewindisch","id":73207,"avatar_url":"https://avatars.githubusercontent.com/u/73207?v=3","gravatar_id":"","url":"https://api.github.com/users/ewindisch","html_url":"https://github.com/ewindisch","followers_url":"https://api.github.com/users/ewindisch/followers","following_url":"https://api.github.com/users/ewindisch/following{/other_user}","gists_url":"https://api.github.com/users/ewindisch/gists{/gist_id}","starred_url":"https://api.github.com/users/ewindisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewindisch/subscriptions","organizations_url":"https://api.github.com/users/ewindisch/orgs","repos_url":"https://api.github.com/users/ewindisch/repos","events_url":"https://api.github.com/users/ewindisch/events{/privacy}","received_events_url":"https://api.github.com/users/ewindisch/received_events","type":"User","site_admin":false},"body":"By using the 'unconfined' policy for privileged\r\ncontainers, we have inherited the host's apparmor\r\npolicies, which really make no sense in the\r\ncontext of the container's filesystem.\r\n\r\nFor instance, policies written against\r\nthe paths of binaries such as '/usr/sbin/tcpdump'\r\ncan be easily circumvented by moving the binary\r\nwithin the container filesystem.\r\n\r\nFixes GH#5490\r\n\r\nSigned-off-by: Eric Windisch <eric@windisch.us>","created_at":"2015-07-22T15:29:02Z","updated_at":"2015-07-22T15:29:02Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/docker/docker/pulls/14855/commits","review_comments_url":"https://api.github.com/repos/docker/docker/pulls/14855/comments","review_comment_url":"https://api.github.com/repos/docker/docker/pulls/comments{/number}","comments_url":"https://api.github.com/repos/docker/docker/issues/14855/comments","statuses_url":"https://api.github.com/repos/docker/docker/statuses/87376c3add7dcd48830060652554e7ae43d11881","head":{"label":"ewindisch:apparmor-unconfined","ref":"apparmor-unconfined","sha":"87376c3add7dcd48830060652554e7ae43d11881","user":{"login":"ewindisch","id":73207,"avatar_url":"https://avatars.githubusercontent.com/u/73207?v=3","gravatar_id":"","url":"https://api.github.com/users/ewindisch","html_url":"https://github.com/ewindisch","followers_url":"https://api.github.com/users/ewindisch/followers","following_url":"https://api.github.com/users/ewindisch/following{/other_user}","gists_url":"https://api.github.com/users/ewindisch/gists{/gist_id}","starred_url":"https://api.github.com/users/ewindisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewindisch/subscriptions","organizations_url":"https://api.github.com/users/ewindisch/orgs","repos_url":"https://api.github.com/users/ewindisch/repos","events_url":"https://api.github.com/users/ewindisch/events{/privacy}","received_events_url":"https://api.github.com/users/ewindisch/received_events","type":"User","site_admin":false},"repo":{"id":13314484,"name":"docker","full_name":"ewindisch/docker","owner":{"login":"ewindisch","id":73207,"avatar_url":"https://avatars.githubusercontent.com/u/73207?v=3","gravatar_id":"","url":"https://api.github.com/users/ewindisch","html_url":"https://github.com/ewindisch","followers_url":"https://api.github.com/users/ewindisch/followers","following_url":"https://api.github.com/users/ewindisch/following{/other_user}","gists_url":"https://api.github.com/users/ewindisch/gists{/gist_id}","starred_url":"https://api.github.com/users/ewindisch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ewindisch/subscriptions","organizations_url":"https://api.github.com/users/ewindisch/orgs","repos_url":"https://api.github.com/users/ewindisch/repos","events_url":"https://api.github.com/users/ewindisch/events{/privacy}","received_events_url":"https://api.github.com/users/ewindisch/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/ewindisch/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/ewindisch/docker","forks_url":"https://api.github.com/repos/ewindisch/docker/forks","keys_url":"https://api.github.com/repos/ewindisch/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ewindisch/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ewindisch/docker/teams","hooks_url":"https://api.github.com/repos/ewindisch/docker/hooks","issue_events_url":"https://api.github.com/repos/ewindisch/docker/issues/events{/number}","events_url":"https://api.github.com/repos/ewindisch/docker/events","assignees_url":"https://api.github.com/repos/ewindisch/docker/assignees{/user}","branches_url":"https://api.github.com/repos/ewindisch/docker/branches{/branch}","tags_url":"https://api.github.com/repos/ewindisch/docker/tags","blobs_url":"https://api.github.com/repos/ewindisch/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ewindisch/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ewindisch/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/ewindisch/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ewindisch/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/ewindisch/docker/languages","stargazers_url":"https://api.github.com/repos/ewindisch/docker/stargazers","contributors_url":"https://api.github.com/repos/ewindisch/docker/contributors","subscribers_url":"https://api.github.com/repos/ewindisch/docker/subscribers","subscription_url":"https://api.github.com/repos/ewindisch/docker/subscription","commits_url":"https://api.github.com/repos/ewindisch/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/ewindisch/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/ewindisch/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/ewindisch/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/ewindisch/docker/contents/{+path}","compare_url":"https://api.github.com/repos/ewindisch/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ewindisch/docker/merges","archive_url":"https://api.github.com/repos/ewindisch/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ewindisch/docker/downloads","issues_url":"https://api.github.com/repos/ewindisch/docker/issues{/number}","pulls_url":"https://api.github.com/repos/ewindisch/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/ewindisch/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/ewindisch/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ewindisch/docker/labels{/name}","releases_url":"https://api.github.com/repos/ewindisch/docker/releases{/id}","created_at":"2013-10-04T02:03:26Z","updated_at":"2014-07-10T15:22:17Z","pushed_at":"2015-07-22T15:28:47Z","git_url":"git://github.com/ewindisch/docker.git","ssh_url":"git@github.com:ewindisch/docker.git","clone_url":"https://github.com/ewindisch/docker.git","svn_url":"https://github.com/ewindisch/docker","homepage":"http://www.docker.io","size":64791,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"docker:master","ref":"master","sha":"875fffdff886205d096ab348d94b5079885f17fb","user":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"docker","full_name":"docker/docker","owner":{"login":"docker","id":5429470,"avatar_url":"https://avatars.githubusercontent.com/u/5429470?v=3","gravatar_id":"","url":"https://api.github.com/users/docker","html_url":"https://github.com/docker","followers_url":"https://api.github.com/users/docker/followers","following_url":"https://api.github.com/users/docker/following{/other_user}","gists_url":"https://api.github.com/users/docker/gists{/gist_id}","starred_url":"https://api.github.com/users/docker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/docker/subscriptions","organizations_url":"https://api.github.com/users/docker/orgs","repos_url":"https://api.github.com/users/docker/repos","events_url":"https://api.github.com/users/docker/events{/privacy}","received_events_url":"https://api.github.com/users/docker/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/docker/docker","description":"Docker - the open-source application container engine","fork":false,"url":"https://api.github.com/repos/docker/docker","forks_url":"https://api.github.com/repos/docker/docker/forks","keys_url":"https://api.github.com/repos/docker/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/docker/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/docker/docker/teams","hooks_url":"https://api.github.com/repos/docker/docker/hooks","issue_events_url":"https://api.github.com/repos/docker/docker/issues/events{/number}","events_url":"https://api.github.com/repos/docker/docker/events","assignees_url":"https://api.github.com/repos/docker/docker/assignees{/user}","branches_url":"https://api.github.com/repos/docker/docker/branches{/branch}","tags_url":"https://api.github.com/repos/docker/docker/tags","blobs_url":"https://api.github.com/repos/docker/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/docker/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/docker/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/docker/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/docker/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/docker/docker/languages","stargazers_url":"https://api.github.com/repos/docker/docker/stargazers","contributors_url":"https://api.github.com/repos/docker/docker/contributors","subscribers_url":"https://api.github.com/repos/docker/docker/subscribers","subscription_url":"https://api.github.com/repos/docker/docker/subscription","commits_url":"https://api.github.com/repos/docker/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/docker/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/docker/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/docker/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/docker/docker/contents/{+path}","compare_url":"https://api.github.com/repos/docker/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/docker/docker/merges","archive_url":"https://api.github.com/repos/docker/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/docker/docker/downloads","issues_url":"https://api.github.com/repos/docker/docker/issues{/number}","pulls_url":"https://api.github.com/repos/docker/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/docker/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/docker/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/docker/docker/labels{/name}","releases_url":"https://api.github.com/repos/docker/docker/releases{/id}","created_at":"2013-01-18T18:10:57Z","updated_at":"2015-07-22T15:00:11Z","pushed_at":"2015-07-22T15:28:20Z","git_url":"git://github.com/docker/docker.git","ssh_url":"git@github.com:docker/docker.git","clone_url":"https://github.com/docker/docker.git","svn_url":"https://github.com/docker/docker","homepage":"http://www.docker.com","size":230420,"stargazers_count":23455,"watchers_count":23455,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":5849,"mirror_url":null,"open_issues_count":1047,"forks":5849,"open_issues":1047,"watchers":23455,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/docker/docker/pulls/14855"},"html":{"href":"https://github.com/docker/docker/pull/14855"},"issue":{"href":"https://api.github.com/repos/docker/docker/issues/14855"},"comments":{"href":"https://api.github.com/repos/docker/docker/issues/14855/comments"},"review_comments":{"href":"https://api.github.com/repos/docker/docker/pulls/14855/comments"},"review_comment":{"href":"https://api.github.com/repos/docker/docker/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/docker/docker/pulls/14855/commits"},"statuses":{"href":"https://api.github.com/repos/docker/docker/statuses/87376c3add7dcd48830060652554e7ae43d11881"}},"merged":false,"mergeable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"commits":1,"additions":13,"deletions":1,"changed_files":2}}