dotcloud/docker — pull request #1955 by jpetazzo (2013-09-21 02:36:45+00:00)
Title: Escape apparmor confinement

This pull request does two things:
- it automatically uses the "unconfined" profile when `-privileged` flag is specified;
- it copies `lxc-start` to `lxc-start-unconfined` (in the graph root directory), to run lxc-start itself unconfined.
This works because AppArmor does security context transitions using path names (as opposed to SELinux which uses extended attributes, for instance).

Tested with @mzdaniel.