Kir Kolyshkin 5f76d4d939 apparmor: say so when the profile is not loaded ...

AppArmor returns ENOENT from the write to attr/apparmor/exec when it
does not know the profile we asked for. runc passed that through as-is,
producing

  unable to apply apparmor profile: apparmor failed to apply profile: write /proc/thread-self/attr/apparmor/exec: no such file or directory

which reads like a problem with the procfs file we have just written to.

Name the profile and say what the kernel means:

  unable to apply apparmor profile "crio-default": profile not loaded

While at it, move the error wrapping from linuxStandardInit.Init
to applyProfile for more uniform and clear errors.
Add an integration test, along with a way to skip it where AppArmor is
not available.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2026-09-02 23:09:54 -07:00

..

apparmor_linux.go

apparmor: say so when the profile is not loaded

2026-09-02 23:09:54 -07:00

apparmor_unsupported.go

remove pre-go1.17 build-tags

2024-06-29 15:45:25 +02:00

apparmor.go

lint/revive: add package doc comments

2025-10-03 15:17:43 +10:00