dilim/containerd
1
0 Fork 0
mirror of https://github.com/containerd/containerd.git synced 2026-11-07 05:47:40 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #8087 from neersighted/apparmor_parser_regression_1.6

Browse Source 
[release/1.6 backport] Revert `apparmor_parser` regression
This commit is contained in:
Fu Wei authored and GitHub committed 2023-02-11 09:28:30 +08:00
2 parents c553746a4a 624ff636b8
commit 29cfda4aee
2 files changed
+12 -10
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

pkg/apparmor/apparmor.go
+6 -6
View File
@@ -16,13 +16,13 @@
package apparmor
// HostSupports returns true if apparmor is enabled for the host, // On non-Linux returns false
// On Linux returns true if apparmor_parser is enabled, and if we
// HostSupports returns true if apparmor is enabled for the host:
// - On Linux returns true if apparmor is enabled, apparmor_parser is
// present, and if we are not running docker-in-docker.
// - On non-Linux returns false.
//
// are not running docker-in-docker.
//
// It is a modified version of libcontainer/apparmor.IsEnabled(), which does not
// check for apparmor_parser to be present, or if we're running docker-in-docker.
// This is derived from libcontainer/apparmor.IsEnabled(), with the addition
// of checks for apparmor_parser to be present and docker-in-docker.
func HostSupports() bool {
return hostSupports()
}
pkg/apparmor/apparmor_linux.go
+6 -4
View File
@@ -29,14 +29,16 @@ var (
// hostSupports returns true if apparmor is enabled for the host, if
// apparmor_parser is enabled, and if we are not running docker-in-docker.
//
// It is a modified version of libcontainer/apparmor.IsEnabled(), which does not
// check for apparmor_parser to be present, or if we're running docker-in-docker.
// This is derived from libcontainer/apparmor.IsEnabled(), with the addition
// of checks for apparmor_parser to be present and docker-in-docker.
func hostSupports() bool {
checkAppArmor.Do(func() {
// see https://github.com/opencontainers/runc/blob/0d49470392206f40eaab3b2190a57fe7bb3df458/libcontainer/apparmor/apparmor_linux.go
if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" {
buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
appArmorSupported = err == nil && len(buf) > 1 && buf[0] == 'Y'
if _, err = os.Stat("/sbin/apparmor_parser"); err == nil {
buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
appArmorSupported = err == nil && len(buf) > 1 && buf[0] == 'Y'
}
}
})
return appArmorSupported