vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Make the profile configurable

Browse source 
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
This commit is contained in:
Xianglin Gao 2016-11-30 16:19:36 +08:00
parent 1f863846f5
commit 26645c90ac
6 changed files with 43 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

19
server/container_create.go
View file

@ -186,7 +186,7 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
// set this container's apparmor profile if it is set by sandbox
if s.appArmorEnabled {
appArmorProfileName := apparmor.GetAppArmorProfileName(sb.annotations, metadata.GetName())
appArmorProfileName := s.getAppArmorProfileName(sb.annotations, metadata.GetName())
if appArmorProfileName != "" {
specgen.SetProcessApparmorProfile(appArmorProfileName)
}
@ -383,3 +383,20 @@ func (s *Server) generateContainerIDandName(podName string, name string, attempt
}
return id, name, err
}
// getAppArmorProfileName gets the profile name for the given container.
func (s *Server) getAppArmorProfileName(annotations map[string]string, ctrName string) string {
profile := apparmor.GetProfileNameFromPodAnnotations(annotations, ctrName)
if profile == "" {
return ""
}
if profile == apparmor.ProfileRuntimeDefault {
// If the value is runtime/default, then return default profile.
return s.appArmorProfile
}
profileName := strings.TrimPrefix(profile, apparmor.ProfileNamePrefix)
return profileName
}