github/containerd
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases 2 Wiki Activity

Support unconfined apparmor

Browse Source 
Signed-off-by: Yanqiang Miao <miao.yanqiang@zte.com.cn>
This commit is contained in:
Yanqiang Miao 2017-10-03 23:19:32 +08:00
parent a7471d79ab
commit 9f656cdda4
2 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/server/container_create.go
View File

@ -784,7 +784,7 @@ func generateApparmorSpecOpts(apparmorProf string, privileged, apparmorEnabled b
if !apparmorEnabled { if !apparmorEnabled {
// Should fail loudly if user try to specify apparmor profile // Should fail loudly if user try to specify apparmor profile
// but we don't support it. // but we don't support it.
if apparmorProf != "" { if apparmorProf != "" && apparmorProf != unconfinedProfile {
return nil, fmt.Errorf("apparmor is not supported") return nil, fmt.Errorf("apparmor is not supported")
} }
return nil, nil return nil, nil
@ -793,7 +793,8 @@ func generateApparmorSpecOpts(apparmorProf string, privileged, apparmorEnabled b
case runtimeDefault: case runtimeDefault:
// TODO (mikebrow): delete created apparmor default profile // TODO (mikebrow): delete created apparmor default profile
return apparmor.WithDefaultProfile(appArmorDefaultProfileName), nil return apparmor.WithDefaultProfile(appArmorDefaultProfileName), nil
// TODO(random-liu): Should support "unconfined" after kubernetes#52395 lands. case unconfinedProfile:
return nil, nil
case "": case "":
// Based on kubernetes#51746, default apparmor profile should be applied // Based on kubernetes#51746, default apparmor profile should be applied
// for non-privileged container when apparmor is not specified. // for non-privileged container when apparmor is not specified.

11
pkg/server/container_create_test.go
View File

@ -805,6 +805,17 @@ func TestGenerateApparmorSpecOpts(t *testing.T) {
profile: "", profile: "",
privileged: true, privileged: true,
}, },
"should not return error if apparmor is unconfined when apparmor is not supported": {
profile: unconfinedProfile,
disable: true,
},
"should not apparmor when apparmor is unconfined": {
profile: unconfinedProfile,
},
"should not apparmor when apparmor is unconfined and privileged is true": {
profile: unconfinedProfile,
privileged: true,
},
"should set default apparmor when apparmor is runtime/default": { "should set default apparmor when apparmor is runtime/default": {
profile: runtimeDefault, profile: runtimeDefault,
specOpts: apparmor.WithDefaultProfile(appArmorDefaultProfileName), specOpts: apparmor.WithDefaultProfile(appArmorDefaultProfileName),