kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Use CGO for apparmor profile switch

Browse source 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
This commit is contained in:
Guillaume J. Charmes 2014-03-06 11:10:58 -08:00
parent 6af82bf4ca
commit f0f833c6d7
No known key found for this signature in database
GPG key ID: B33E4642CB6E3FF3
2 changed files with 11 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
pkg/libcontainer/apparmor/apparmor.go
View file

@ -1,9 +1,12 @@
package apparmor
// #cgo LDFLAGS: -lapparmor
// #include <sys/apparmor.h>
// #include <stdlib.h>
import "C"
import (
"fmt"
"io/ioutil"
"os"
"unsafe"
)
func IsEnabled() bool {
@ -16,13 +19,10 @@ func ApplyProfile(pid int, name string) error {
return nil
}
f, err := os.OpenFile(fmt.Sprintf("/proc/%d/attr/current", pid), os.O_WRONLY, 0)
if err != nil {
return err
}
defer f.Close()
cName := C.CString(name)
defer C.free(unsafe.Pointer(cName))
if _, err := fmt.Fprintf(f, "changeprofile %s", name); err != nil {
if _, err := C.aa_change_onexec(cName); err != nil {
return err
}
return nil

7
pkg/libcontainer/nsinit/init.go
View file

@ -59,10 +59,6 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("setup mount namespace %s", err)
}
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
if err := setupNetwork(container, context); err != nil {
return fmt.Errorf("setup networking %s", err)
}
@ -73,6 +69,9 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("finalize namespace %s", err)
}
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
return err
}
return system.Execv(args[0], args[0:], container.Env)
}