diff --git a/profiles/apparmor/apparmor.go b/profiles/apparmor/apparmor.go index bbcf06e505..51dfa5cf9c 100644 --- a/profiles/apparmor/apparmor.go +++ b/profiles/apparmor/apparmor.go @@ -24,8 +24,6 @@ var ( type profileData struct { // Name is profile name. Name string - // ExecPath is the path to the docker binary. - ExecPath string // Imports defines the apparmor functions to import, before defining the profile. Imports []string // InnerImports defines the apparmor functions to import in the profile. @@ -40,14 +38,23 @@ func (p *profileData) generateDefault(out io.Writer) error { if err != nil { return err } + if macroExists("tunables/global") { p.Imports = append(p.Imports, "#include ") } else { p.Imports = append(p.Imports, "@{PROC}=/proc/") } + if macroExists("abstractions/base") { p.InnerImports = append(p.InnerImports, "#include ") } + + ver, err := aaparser.GetVersion() + if err != nil { + return err + } + p.Version = ver + if err := compiled.Execute(out, p); err != nil { return err } diff --git a/profiles/apparmor/template.go b/profiles/apparmor/template.go index db867b9def..ada33bf0f1 100644 --- a/profiles/apparmor/template.go +++ b/profiles/apparmor/template.go @@ -42,9 +42,5 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container ptrace (trace,read) peer=docker-default, {{end}} -{{if ge .Version 209000}} - # docker daemon confinement requires explict allow rule for signal - signal (receive) set=(kill,term) peer={{.ExecPath}}, -{{end}} } `