jasder
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use CGO for apparmor profile switch 

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
This commit is contained in:
Guillaume J. Charmes 2014-03-06 11:10:58 -08:00
parent bbf833d96e
commit d5957adbc4
2 changed files with 11 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
apparmor/apparmor.go
View File

@ -1,9 +1,12 @@
package apparmor package apparmor
// #cgo LDFLAGS: -lapparmor
// #include <sys/apparmor.h>
// #include <stdlib.h>
import "C"
import ( import (
"fmt"
"io/ioutil" "io/ioutil"
"os" "unsafe"
) )
func IsEnabled() bool { func IsEnabled() bool {
@ -16,13 +19,10 @@ func ApplyProfile(pid int, name string) error {
return nil return nil
} }
f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0) cName := C.CString(name)
if err != nil { defer C.free(unsafe.Pointer(cName))
return err
}
defer f.Close()
if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil { if _, err := C.aa_change_onexec(cName); err != nil {
return err return err
} }
return nil return nil

7
nsinit/init.go
View File

@ -59,10 +59,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("setup mount namespace %s", err) return fmt.Errorf("setup mount namespace %s", err)
} }
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
if err := setupNetwork(container, context); err != nil { if err := setupNetwork(container, context); err != nil {
return fmt.Errorf("setup networking %s", err) return fmt.Errorf("setup networking %s", err)
} }
@ -73,6 +69,9 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("finalize namespace %s", err) return fmt.Errorf("finalize namespace %s", err)
} }
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
return system.Execv(args[0], args[0:], container.Env) return system.Execv(args[0], args[0:], container.Env)
} }