OSSInnovation
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #4506 from creack/fix_apparmor 

Use CGO for apparmor profile switch
This commit is contained in:
Guillaume J. Charmes 2014-03-06 13:37:34 -08:00
parent b7469c01af f883469f02
commit 520773503a
3 changed files with 26 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
apparmor/apparmor.go
View File

@ -1,9 +1,14 @@
// +build apparmor,linux,amd64
package apparmor
// #cgo LDFLAGS: -lapparmor
// #include <sys/apparmor.h>
// #include <stdlib.h>
import "C"
import (
"fmt"
"io/ioutil"
"os"
"unsafe"
)
func IsEnabled() bool {
@ -16,13 +21,10 @@ func ApplyProfile(pid int, name string) error {
return nil
}
f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0)
if err != nil {
return err
}
defer f.Close()
cName := C.CString(name)
defer C.free(unsafe.Pointer(cName))
if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil {
if _, err := C.aa_change_onexec(cName); err != nil {
return err
}
return nil

13
apparmor/apparmor_disabled.go Normal file
View File

@ -0,0 +1,13 @@
// +build !apparmor !linux !amd64
package apparmor
import ()
func IsEnabled() bool {
return false
}
func ApplyProfile(pid int, name string) error {
return nil
}

7
nsinit/init.go
View File

@ -59,10 +59,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("setup mount namespace %s", err)
}
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
if err := setupNetwork(container, context); err != nil {
return fmt.Errorf("setup networking %s", err)
}
@ -73,6 +69,9 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("finalize namespace %s", err)
}
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
return system.Execv(args[0], args[0:], container.Env)
}