kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #40083 from thaJeztah/daemon_consts

Browse source 
daemon: use constants for AppArmor and Seccomp
This commit is contained in:
Justin Cormack 2019-10-17 11:12:37 -07:00 committed by GitHub
commit dde030a6b1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 13 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
daemon/apparmor_default.go
View file

@ -11,7 +11,8 @@ import (
// Define constants for native driver
const (
defaultApparmorProfile = "docker-default"
unconfinedAppArmorProfile = "unconfined"
defaultApparmorProfile = "docker-default"
)
func ensureDefaultAppArmorProfile() error {

2
daemon/container_linux.go
View file

@ -24,7 +24,7 @@ func (daemon *Daemon) saveApparmorConfig(container *container.Container) error {
}
} else {
container.AppArmorProfile = "unconfined"
container.AppArmorProfile = unconfinedAppArmorProfile
}
return nil
}

6
daemon/exec_linux.go
View file

@ -38,12 +38,12 @@ func (daemon *Daemon) execSetPlatformOpt(c *container.Container, ec *exec.Config
} else if c.HostConfig.Privileged {
// `docker exec --privileged` does not currently disable AppArmor
// profiles. Privileged configuration of the container is inherited
appArmorProfile = "unconfined"
appArmorProfile = unconfinedAppArmorProfile
} else {
appArmorProfile = "docker-default"
appArmorProfile = defaultApparmorProfile
}
if appArmorProfile == "docker-default" {
if appArmorProfile == defaultApparmorProfile {
// Unattended upgrades and other fun services can unload AppArmor
// profiles inadvertently. Since we cannot store our profile in
// /etc/apparmor.d, nor can we practically add other ways of

2
daemon/exec_linux_test.go
View file

@ -49,5 +49,5 @@ func TestExecSetPlatformOptPrivileged(t *testing.T) {
c.HostConfig = &containertypes.HostConfig{Privileged: true}
err = d.execSetPlatformOpt(c, ec, p)
assert.NilError(t, err)
assert.Equal(t, "unconfined", p.ApparmorProfile)
assert.Equal(t, unconfinedAppArmorProfile, p.ApparmorProfile)
}

6
daemon/oci_linux.go
View file

@ -113,12 +113,12 @@ func WithApparmor(c *container.Container) coci.SpecOpts {
if c.AppArmorProfile != "" {
appArmorProfile = c.AppArmorProfile
} else if c.HostConfig.Privileged {
appArmorProfile = "unconfined"
appArmorProfile = unconfinedAppArmorProfile
} else {
appArmorProfile = "docker-default"
appArmorProfile = defaultApparmorProfile
}
if appArmorProfile == "docker-default" {
if appArmorProfile == defaultApparmorProfile {
// Unattended upgrades and other fun services can unload AppArmor
// profiles inadvertently. Since we cannot store our profile in
// /etc/apparmor.d, nor can we practically add other ways of

2
daemon/seccomp_disabled.go
View file

@ -11,7 +11,7 @@ import (
"github.com/docker/docker/container"
)
var supportsSeccomp = false
const supportsSeccomp = false
// WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {

2
daemon/seccomp_linux.go
View file

@ -14,7 +14,7 @@ import (
"github.com/sirupsen/logrus"
)
var supportsSeccomp = true
const supportsSeccomp = true
// WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {

2
daemon/seccomp_unsupported.go
View file

@ -10,7 +10,7 @@ import (
"github.com/docker/docker/container"
)
var supportsSeccomp = false
const supportsSeccomp = false
// WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {