From d5957adbc43f5729588ef857ac557c056f009a9b Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 6 Mar 2014 11:10:58 -0800
Subject: [PATCH 1/3] Use CGO for apparmor profile switch

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
---
 apparmor/apparmor.go | 16 ++++++++--------
 nsinit/init.go       |  7 +++----
 2 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/apparmor/apparmor.go b/apparmor/apparmor.go
index 4b1bf579..c2954fda 100644
--- a/apparmor/apparmor.go
+++ b/apparmor/apparmor.go
@@ -1,9 +1,12 @@
 package apparmor
 
+// #cgo LDFLAGS: -lapparmor
+// #include <sys/apparmor.h>
+// #include <stdlib.h>
+import "C"
 import (
-	"fmt"
 	"io/ioutil"
-	"os"
+	"unsafe"
 )
 
 func IsEnabled() bool {
@@ -16,13 +19,10 @@ func ApplyProfile(pid int, name string) error {
 		return nil
 	}
 
-	f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0)
-	if err != nil {
-		return err
-	}
-	defer f.Close()
+	cName := C.CString(name)
+	defer C.free(unsafe.Pointer(cName))
 
-	if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil {
+	if _, err := C.aa_change_onexec(cName); err != nil {
 		return err
 	}
 	return nil
diff --git a/nsinit/init.go b/nsinit/init.go
index a854f130..45ab8815 100644
--- a/nsinit/init.go
+++ b/nsinit/init.go
@@ -59,10 +59,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 		return fmt.Errorf("setup mount namespace %s", err)
 	}
 
-	if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
-		return err
-	}
-
 	if err := setupNetwork(container, context); err != nil {
 		return fmt.Errorf("setup networking %s", err)
 	}
@@ -73,6 +69,9 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
 		return fmt.Errorf("finalize namespace %s", err)
 	}
 
+	if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
+		return err
+	}
 	return system.Execv(args[0], args[0:], container.Env)
 }
 

From a01ed80babebf1db6f303a64c871c04914456b18 Mon Sep 17 00:00:00 2001
From: "Guillaume J. Charmes" <guillaume.charmes@docker.com>
Date: Thu, 6 Mar 2014 12:04:51 -0800
Subject: [PATCH 2/3] Add buildflags to allow crosscompilation for apparmor

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
---
 apparmor/apparmor.go          |  2 ++
 apparmor/apparmor_disabled.go | 13 +++++++++++++
 2 files changed, 15 insertions(+)
 create mode 100644 apparmor/apparmor_disabled.go

diff --git a/apparmor/apparmor.go b/apparmor/apparmor.go
index c2954fda..d07c710d 100644
--- a/apparmor/apparmor.go
+++ b/apparmor/apparmor.go
@@ -1,3 +1,5 @@
+// +build apparmor
+
 package apparmor
 
 // #cgo LDFLAGS: -lapparmor
diff --git a/apparmor/apparmor_disabled.go b/apparmor/apparmor_disabled.go
new file mode 100644
index 00000000..489484fc
--- /dev/null
+++ b/apparmor/apparmor_disabled.go
@@ -0,0 +1,13 @@
+// +build !apparmor
+
+package apparmor
+
+import ()
+
+func IsEnabled() bool {
+	return false
+}
+
+func ApplyProfile(pid int, name string) error {
+	return nil
+}

From f883469f02207fb4c8f2c711926191be96c28909 Mon Sep 17 00:00:00 2001
From: Tianon Gravi <admwiggin@gmail.com>
Date: Thu, 6 Mar 2014 13:39:17 -0700
Subject: [PATCH 3/3] Update build tags such that we can properly compile on
 all platforms (especially for packagers), and updated hack/PACKAGERS.md to
 mention the DOCKER_BUILDTAGS variable that will need to be set for binaries
 that might be used on AppArmor (such as Debian and especially Ubuntu)

Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
---
 apparmor/apparmor.go          | 2 +-
 apparmor/apparmor_disabled.go | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/apparmor/apparmor.go b/apparmor/apparmor.go
index d07c710d..a6d57d4f 100644
--- a/apparmor/apparmor.go
+++ b/apparmor/apparmor.go
@@ -1,4 +1,4 @@
-// +build apparmor
+// +build apparmor,linux,amd64
 
 package apparmor
 
diff --git a/apparmor/apparmor_disabled.go b/apparmor/apparmor_disabled.go
index 489484fc..77543e4a 100644
--- a/apparmor/apparmor_disabled.go
+++ b/apparmor/apparmor_disabled.go
@@ -1,4 +1,4 @@
-// +build !apparmor
+// +build !apparmor !linux !amd64
 
 package apparmor