mirror of
https://github.com/containers/podman.git
synced 2025-08-01 16:24:58 +08:00
edb285d176
Apply the default AppArmor profile at container initialization to cover
all possible code paths (i.e., podman-{start,run}) before executing the
runtime. This allows moving most of the logic into pkg/apparmor.
Also make the loading and application of the default AppArmor profile
versio-indepenent by checking for the `libpod-default-` prefix and
over-writing the profile in the run-time spec if needed.
The intitial run-time spec of the container differs a bit from the
applied one when having started the container, which results in
displaying a potentially outdated AppArmor profile when inspecting
a container. To fix that, load the container config from the file
system if present and use it to display the data.
Fixes: #2107
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
27 lines
484 B
Go
27 lines
484 B
Go
// +build !linux !apparmor
|
|
|
|
package apparmor
|
|
|
|
// IsEnabled dummy.
|
|
func IsEnabled() bool {
|
|
return false
|
|
}
|
|
|
|
// InstallDefault dummy.
|
|
func InstallDefault(name string) error {
|
|
return ErrApparmorUnsupported
|
|
}
|
|
|
|
// IsLoaded dummy.
|
|
func IsLoaded(name string) (bool, error) {
|
|
return false, ErrApparmorUnsupported
|
|
}
|
|
|
|
// CheckProfileAndLoadDefault dummy.
|
|
func CheckProfileAndLoadDefault(name string) (string, error) {
|
|
if name == "" {
|
|
return "", nil
|
|
}
|
|
return "", ErrApparmorUnsupported
|
|
}
|