github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

ctr: add AppArmor flags

Browse Source 
e.g.
```
$ sudo ./bin/ctr run --apparmor-default-profile "cri-containerd.apparmor.d" docker.io/library/alpine:latest foo cat /proc/self/attr/current
cri-containerd.apparmor.d (enforce)
```

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
This commit is contained in:
Akihiro Suda 2020-11-10 14:19:35 +09:00
parent 31a6d11133
commit 9d54648be3
No known key found for this signature in database
GPG Key ID: 49524C6F9F638F1A
2 changed files with 20 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/ctr/commands/commands.go
View File

@ -159,6 +159,14 @@ var (
Name: "seccomp-profile",
Usage: "file path to custom seccomp profile. seccomp must be set to true, before using seccomp-profile",
},
cli.StringFlag{
Name: "apparmor-default-profile",
Usage: "enable AppArmor with the default profile with the specified name, e.g. \"cri-containerd.apparmor.d\"",
},
cli.StringFlag{
Name: "apparmor-profile",
Usage: "enable AppArmor with an existing custom profile",
},
}
)

12
cmd/ctr/commands/run/run_unix.go
View File

@ -27,6 +27,7 @@ import (
"github.com/containerd/containerd"
"github.com/containerd/containerd/cmd/ctr/commands"
"github.com/containerd/containerd/contrib/apparmor"
"github.com/containerd/containerd/contrib/nvidia"
"github.com/containerd/containerd/contrib/seccomp"
"github.com/containerd/containerd/oci"
@ -205,6 +206,17 @@ func NewContainer(ctx gocontext.Context, client *containerd.Client, context *cli
}
}
if s := context.String("apparmor-default-profile"); len(s) > 0 {
opts = append(opts, apparmor.WithDefaultProfile(s))
}
if s := context.String("apparmor-profile"); len(s) > 0 {
if len(context.String("apparmor-default-profile")) > 0 {
return nil, fmt.Errorf("apparmor-profile conflicts with apparmor-default-profile")
}
opts = append(opts, apparmor.WithProfile(s))
}
if cpus := context.Float64("cpus"); cpus > 0.0 {
var (
period = uint64(100000)