opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-06-22 09:58:10 +08:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #2225 from cevich/enable_apparmor

Browse Source 
Cirrus: Enable AppArmor build and test
This commit is contained in:
OpenShift Merge Robot
2019-01-30 11:23:05 +01:00
committed by GitHub
parent 76019c31f5 18b7009754
commit b01ec95bda
6 changed files with 18 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
contrib/cirrus/integration_test.sh
View File

@ -17,9 +17,9 @@ set -x
cd "$GOSRC" cd "$GOSRC"
case "${OS_RELEASE_ID}-${OS_RELEASE_VER}" in case "${OS_RELEASE_ID}-${OS_RELEASE_VER}" in
ubuntu-18) ubuntu-18)
make install PREFIX=/usr ETCDIR=/etc "BUILDTAGS=$BUILDTAGS" make install PREFIX=/usr ETCDIR=/etc
make test-binaries "BUILDTAGS=$BUILDTAGS" make test-binaries
SKIP_USERNS=1 make localintegration "BUILDTAGS=$BUILDTAGS" SKIP_USERNS=1 make localintegration
;; ;;
fedora-29) ;& # Continue to the next item fedora-29) ;& # Continue to the next item
fedora-28) ;& fedora-28) ;&

2
contrib/cirrus/lib.sh
View File

@ -199,7 +199,7 @@ install_runc_from_git(){
cd "$DEST" cd "$DEST"
ooe.sh git fetch origin --tags ooe.sh git fetch origin --tags
ooe.sh git checkout -q "$RUNC_COMMIT" ooe.sh git checkout -q "$RUNC_COMMIT"
ooe.sh make static BUILDTAGS="seccomp selinux" ooe.sh make static BUILDTAGS="seccomp apparmor selinux"
sudo install -m 755 runc /usr/bin/runc sudo install -m 755 runc /usr/bin/runc
cd $wd cd $wd
} }

3
contrib/cirrus/setup_environment.sh
View File

@ -57,7 +57,6 @@ then
ubuntu-18) ubuntu-18)
# Always install runc on Ubuntu # Always install runc on Ubuntu
install_runc_from_git install_runc_from_git
envstr='export BUILDTAGS="seccomp $($GOSRC/hack/btrfs_tag.sh) $($GOSRC/hack/btrfs_installed_tag.sh) $($GOSRC/hack/ostree_tag.sh) varlink exclude_graphdriver_devicemapper"'
;; ;;
fedora-29) ;& # Continue to the next item fedora-29) ;& # Continue to the next item
fedora-28) fedora-28)
@ -67,11 +66,9 @@ then
;& # Continue to the next item ;& # Continue to the next item
centos-7) ;& centos-7) ;&
rhel-7) rhel-7)
envstr='unset BUILDTAGS' # Use default from Makefile
;; ;;
*) bad_os_id_ver ;; *) bad_os_id_ver ;;
esac esac
X=$(echo "$envstr" | tee -a "$HOME/$ENVLIB") && eval "$X" && echo "$X"
# Do the same for golang env. vars # Do the same for golang env. vars
go env | while read envline go env | while read envline

7
contrib/cirrus/system_test.sh
View File

@ -15,12 +15,9 @@ set -x
cd "$GOSRC" cd "$GOSRC"
case "${OS_RELEASE_ID}-${OS_RELEASE_VER}" in case "${OS_RELEASE_ID}-${OS_RELEASE_VER}" in
ubuntu-18) ubuntu-18) ;& # Continue to the next item
make install.tools "BUILDTAGS=$BUILDTAGS"
make "BUILDTAGS=$BUILDTAGS"
make test-binaries "BUILDTAGS=$BUILDTAGS"
;;
fedora-28) ;& fedora-28) ;&
fedora-29) ;&
centos-7) ;& centos-7) ;&
rhel-7) rhel-7)
make install.tools make install.tools

8
contrib/cirrus/unit_test.sh
View File

@ -16,12 +16,8 @@ clean_env
set -x set -x
cd "$GOSRC" cd "$GOSRC"
case "${OS_RELEASE_ID}-${OS_RELEASE_VER}" in case "${OS_RELEASE_ID}-${OS_RELEASE_VER}" in
ubuntu-18) ubuntu-18) ;& # Continue to the next item
make install.tools "BUILDTAGS=$BUILDTAGS" fedora-29) ;&
make localunit "BUILDTAGS=$BUILDTAGS"
make "BUILDTAGS=$BUILDTAGS"
;;
fedora-29) ;& # Continue to the next item
fedora-28) ;& fedora-28) ;&
centos-7) ;& centos-7) ;&
rhel-7) rhel-7)

13
pkg/apparmor/apparmor_linux.go
View File

@ -214,8 +214,15 @@ func CheckProfileAndLoadDefault(name string) (string, error) {
return name, nil return name, nil
} }
if name != "" && rootless.IsRootless() { // AppArmor is not supported in rootless mode as it requires root
return "", errors.Wrapf(ErrApparmorRootless, "cannot load AppArmor profile %q", name) // privileges. Return an error in case a specific profile is specified.
if rootless.IsRootless() {
if name != "" {
return "", errors.Wrapf(ErrApparmorRootless, "cannot load AppArmor profile %q", name)
} else {
logrus.Debug("skipping loading default AppArmor profile (rootless mode)")
return "", nil
}
} }
if name != "" && !runcaa.IsEnabled() { if name != "" && !runcaa.IsEnabled() {
@ -230,7 +237,7 @@ func CheckProfileAndLoadDefault(name string) (string, error) {
return "", err return "", err
} }
if !isLoaded { if !isLoaded {
return "", fmt.Errorf("AppArmor profile %q specified but not loaded") return "", fmt.Errorf("AppArmor profile %q specified but not loaded", name)
} }
return name, nil return name, nil
} }