kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Merge pull request #40083 from thaJeztah/daemon_consts

Browse source 
daemon: use constants for AppArmor and Seccomp
This commit is contained in:
Justin Cormack 2019-10-17 11:12:37 -07:00 • committed by GitHub
commit dde030a6b1
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
8 changed files with 13 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
daemon/apparmor_default.go
View file

@ -11,7 +11,8 @@ import (
// Define constants for native driver // Define constants for native driver
const ( const (
defaultApparmorProfile = "docker-default" unconfinedAppArmorProfile = "unconfined"
defaultApparmorProfile = "docker-default"
) )
func ensureDefaultAppArmorProfile() error { func ensureDefaultAppArmorProfile() error {

2
daemon/container_linux.go
View file

@ -24,7 +24,7 @@ func (daemon *Daemon) saveApparmorConfig(container *container.Container) error {
} }
} else { } else {
container.AppArmorProfile = "unconfined" container.AppArmorProfile = unconfinedAppArmorProfile
} }
return nil return nil
} }

6
daemon/exec_linux.go
View file

@ -38,12 +38,12 @@ func (daemon *Daemon) execSetPlatformOpt(c *container.Container, ec *exec.Config
} else if c.HostConfig.Privileged { } else if c.HostConfig.Privileged {
// `docker exec --privileged` does not currently disable AppArmor // `docker exec --privileged` does not currently disable AppArmor
// profiles. Privileged configuration of the container is inherited // profiles. Privileged configuration of the container is inherited
appArmorProfile = "unconfined" appArmorProfile = unconfinedAppArmorProfile
} else { } else {
appArmorProfile = "docker-default" appArmorProfile = defaultApparmorProfile
} }
if appArmorProfile == "docker-default" { if appArmorProfile == defaultApparmorProfile {
// Unattended upgrades and other fun services can unload AppArmor // Unattended upgrades and other fun services can unload AppArmor
// profiles inadvertently. Since we cannot store our profile in // profiles inadvertently. Since we cannot store our profile in
// /etc/apparmor.d, nor can we practically add other ways of // /etc/apparmor.d, nor can we practically add other ways of

2
daemon/exec_linux_test.go
View file

@ -49,5 +49,5 @@ func TestExecSetPlatformOptPrivileged(t *testing.T) {
c.HostConfig = &containertypes.HostConfig{Privileged: true} c.HostConfig = &containertypes.HostConfig{Privileged: true}
err = d.execSetPlatformOpt(c, ec, p) err = d.execSetPlatformOpt(c, ec, p)
assert.NilError(t, err) assert.NilError(t, err)
assert.Equal(t, "unconfined", p.ApparmorProfile) assert.Equal(t, unconfinedAppArmorProfile, p.ApparmorProfile)
} }

6
daemon/oci_linux.go
View file

@ -113,12 +113,12 @@ func WithApparmor(c *container.Container) coci.SpecOpts {
if c.AppArmorProfile != "" { if c.AppArmorProfile != "" {
appArmorProfile = c.AppArmorProfile appArmorProfile = c.AppArmorProfile
} else if c.HostConfig.Privileged { } else if c.HostConfig.Privileged {
appArmorProfile = "unconfined" appArmorProfile = unconfinedAppArmorProfile
} else { } else {
appArmorProfile = "docker-default" appArmorProfile = defaultApparmorProfile
} }
if appArmorProfile == "docker-default" { if appArmorProfile == defaultApparmorProfile {
// Unattended upgrades and other fun services can unload AppArmor // Unattended upgrades and other fun services can unload AppArmor
// profiles inadvertently. Since we cannot store our profile in // profiles inadvertently. Since we cannot store our profile in
// /etc/apparmor.d, nor can we practically add other ways of // /etc/apparmor.d, nor can we practically add other ways of

2
daemon/seccomp_disabled.go
View file

@ -11,7 +11,7 @@ import (
"github.com/docker/docker/container" "github.com/docker/docker/container"
) )
var supportsSeccomp = false const supportsSeccomp = false
// WithSeccomp sets the seccomp profile // WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts { func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {

2
daemon/seccomp_linux.go
View file

@ -14,7 +14,7 @@ import (
"github.com/sirupsen/logrus" "github.com/sirupsen/logrus"
) )
var supportsSeccomp = true const supportsSeccomp = true
// WithSeccomp sets the seccomp profile // WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts { func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {

2
daemon/seccomp_unsupported.go
View file

@ -10,7 +10,7 @@ import (
"github.com/docker/docker/container" "github.com/docker/docker/container"
) )
var supportsSeccomp = false const supportsSeccomp = false
// WithSeccomp sets the seccomp profile // WithSeccomp sets the seccomp profile
func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts { func WithSeccomp(daemon *Daemon, c *container.Container) coci.SpecOpts {