forked from containerd/containerd
-
Notifications
You must be signed in to change notification settings - Fork 0
/
apparmor.go
57 lines (51 loc) · 1.37 KB
/
apparmor.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
// +build linux
package apparmor
import (
"context"
"io/ioutil"
"os"
"github.com/containerd/containerd"
"github.com/containerd/containerd/containers"
specs "github.com/opencontainers/runtime-spec/specs-go"
"github.com/pkg/errors"
)
// WithProfile sets the provided apparmor profile to the spec
func WithProfile(profile string) containerd.SpecOpts {
return func(_ context.Context, _ *containerd.Client, _ *containers.Container, s *specs.Spec) error {
s.Process.ApparmorProfile = profile
return nil
}
}
// WithDefaultProfile will generate a default apparmor profile under the provided name
// for the container. It is only generated if a profile under that name does not exist.
func WithDefaultProfile(name string) containerd.SpecOpts {
return func(_ context.Context, _ *containerd.Client, _ *containers.Container, s *specs.Spec) error {
yes, err := isLoaded(name)
if err != nil {
return err
}
if yes {
s.Process.ApparmorProfile = name
return nil
}
p, err := loadData(name)
if err != nil {
return err
}
f, err := ioutil.TempFile("", p.Name)
if err != nil {
return err
}
defer f.Close()
path := f.Name()
defer os.Remove(path)
if err := generate(p, f); err != nil {
return err
}
if err := load(path); err != nil {
return errors.Wrapf(err, "load apparmor profile %s", path)
}
s.Process.ApparmorProfile = name
return nil
}
}