mirror of
https://github.com/containers/podman.git
synced 2025-06-23 02:18:13 +08:00
06ab343bd7
Make users of libpod more secure by adding the libpod/apparmor package to load a pre-defined AppArmor profile. Large chunks of libpod/apparmor come from github.com/moby/moby. Also check if a specified AppArmor profile is actually loaded and throw an error if necessary. The default profile is loaded only on Linux builds with the `apparmor` buildtag enabled. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1063 Approved by: rhatdan
34 lines
1014 B
Bash
Executable File
34 lines
1014 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
# DinD: a wrapper script which allows docker to be run inside a docker container.
|
|
# Original version by Jerome Petazzoni <jerome@docker.com>
|
|
# See the blog post: https://blog.docker.com/2013/09/docker-can-now-run-within-docker/
|
|
#
|
|
# This script should be executed inside a docker container in privileged mode
|
|
# ('docker run --privileged', introduced in docker 0.6).
|
|
|
|
# Usage: dind CMD [ARG...]
|
|
|
|
# apparmor sucks and Docker needs to know that it's in a container (c) @tianon
|
|
export container=docker
|
|
|
|
if [ -d /sys/kernel/security ] && ! mountpoint -q /sys/kernel/security; then
|
|
mount -t securityfs none /sys/kernel/security || {
|
|
echo >&2 'Could not mount /sys/kernel/security.'
|
|
echo >&2 'AppArmor detection and --privileged mode might break.'
|
|
}
|
|
fi
|
|
|
|
# Mount /tmp (conditionally)
|
|
if ! mountpoint -q /tmp; then
|
|
mount -t tmpfs none /tmp
|
|
fi
|
|
|
|
if [ $# -gt 0 ]; then
|
|
exec "$@"
|
|
fi
|
|
|
|
echo >&2 'ERROR: No command specified.'
|
|
echo >&2 'You probably want to run hack/make.sh, or maybe a shell?'
|