Merge pull request #239 from xlgao-zju/reload-apparmor-profile
reload default apparmor profile if it is unloaded
This commit is contained in:
commit
4bb0830c37
9 changed files with 142 additions and 96 deletions
14
server/apparmor/apparmor_common.go
Normal file
14
server/apparmor/apparmor_common.go
Normal file
|
@ -0,0 +1,14 @@
|
|||
package apparmor
|
||||
|
||||
const (
|
||||
// DefaultApparmorProfile is the name of default apparmor profile name.
|
||||
DefaultApparmorProfile = "ocid-default"
|
||||
|
||||
// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
|
||||
ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
|
||||
|
||||
// ProfileRuntimeDefault is he profile specifying the runtime default.
|
||||
ProfileRuntimeDefault = "runtime/default"
|
||||
// ProfileNamePrefix is the prefix for specifying profiles loaded on the node.
|
||||
ProfileNamePrefix = "localhost/"
|
||||
)
|
|
@ -4,35 +4,20 @@ package apparmor
|
|||
|
||||
import (
|
||||
"bufio"
|
||||
"fmt"
|
||||
"io"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"github.com/Sirupsen/logrus"
|
||||
"github.com/docker/docker/utils/templates"
|
||||
"github.com/opencontainers/runc/libcontainer/apparmor"
|
||||
)
|
||||
|
||||
const (
|
||||
// defaultApparmorProfile is the name of default apparmor profile name.
|
||||
defaultApparmorProfile = "ocid-default"
|
||||
|
||||
// profileDirectory is the file store for apparmor profiles and macros.
|
||||
profileDirectory = "/etc/apparmor.d"
|
||||
|
||||
// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
|
||||
ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
|
||||
|
||||
// ProfileRuntimeDefault is he profile specifying the runtime default.
|
||||
ProfileRuntimeDefault = "runtime/default"
|
||||
// ProfileNamePrefix is the prefix for specifying profiles loaded on the node.
|
||||
ProfileNamePrefix = "localhost/"
|
||||
|
||||
// readConfigTimeout is the timeout of reading apparmor profiles.
|
||||
readConfigTimeout = 10
|
||||
)
|
||||
|
||||
// profileData holds information about the given profile for generation.
|
||||
|
@ -47,15 +32,26 @@ type profileData struct {
|
|||
Version int
|
||||
}
|
||||
|
||||
// InstallDefaultAppArmorProfile installs default apparmor profile.
|
||||
func InstallDefaultAppArmorProfile() {
|
||||
if err := InstallDefault(defaultApparmorProfile); err != nil {
|
||||
// Allow daemon to run if loading failed, but are active
|
||||
// (possibly through another run, manually, or via system startup)
|
||||
if !IsLoaded(defaultApparmorProfile) {
|
||||
logrus.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", defaultApparmorProfile)
|
||||
// EnsureDefaultApparmorProfile loads default apparmor profile, if it is not loaded.
|
||||
func EnsureDefaultApparmorProfile() error {
|
||||
if apparmor.IsEnabled() {
|
||||
loaded, err := IsLoaded(DefaultApparmorProfile)
|
||||
if err != nil {
|
||||
return fmt.Errorf("Could not check if %s AppArmor profile was loaded: %s", DefaultApparmorProfile, err)
|
||||
}
|
||||
|
||||
// Nothing to do.
|
||||
if loaded {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Load the profile.
|
||||
if err := InstallDefault(DefaultApparmorProfile); err != nil {
|
||||
return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", DefaultApparmorProfile)
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// IsEnabled returns true if apparmor is enabled for the host.
|
||||
|
@ -90,35 +86,30 @@ func InstallDefault(name string) error {
|
|||
return LoadProfile(f.Name())
|
||||
}
|
||||
|
||||
// IsLoaded checks if a passed profile has been loaded into the kernel.
|
||||
func IsLoaded(name string) bool {
|
||||
// IsLoaded checks if a profile with the given name has been loaded into the
|
||||
// kernel.
|
||||
func IsLoaded(name string) (bool, error) {
|
||||
file, err := os.Open("/sys/kernel/security/apparmor/profiles")
|
||||
if err != nil {
|
||||
return false
|
||||
return false, err
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
ch := make(chan bool, 1)
|
||||
|
||||
go func() {
|
||||
r := bufio.NewReader(file)
|
||||
for {
|
||||
p, err := r.ReadString('\n')
|
||||
if err != nil {
|
||||
ch <- false
|
||||
}
|
||||
if strings.HasPrefix(p, name+" ") {
|
||||
ch <- true
|
||||
}
|
||||
r := bufio.NewReader(file)
|
||||
for {
|
||||
p, err := r.ReadString('\n')
|
||||
if err == io.EOF {
|
||||
break
|
||||
}
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
if strings.HasPrefix(p, name+" ") {
|
||||
return true, nil
|
||||
}
|
||||
}()
|
||||
|
||||
select {
|
||||
case <-time.After(time.Duration(readConfigTimeout) * time.Second):
|
||||
return false
|
||||
case enabled := <-ch:
|
||||
return enabled
|
||||
}
|
||||
|
||||
return false, nil
|
||||
}
|
||||
|
||||
// generateDefault creates an apparmor profile from ProfileData.
|
|
@ -2,23 +2,14 @@
|
|||
|
||||
package apparmor
|
||||
|
||||
const (
|
||||
// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
|
||||
ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
|
||||
|
||||
// ProfileRuntimeDefault is he profile specifying the runtime default.
|
||||
ProfileRuntimeDefault = "runtime/default"
|
||||
// ProfileNamePrefix is the prefix for specifying profiles loaded on the node.
|
||||
ProfileNamePrefix = "localhost/"
|
||||
)
|
||||
|
||||
// IsEnabled returns false, when build without apparmor build tag.
|
||||
func IsEnabled() bool {
|
||||
return false
|
||||
}
|
||||
|
||||
// InstallDefaultAppArmorProfile dose nothing, when build without apparmor build tag.
|
||||
func InstallDefaultAppArmorProfile() {
|
||||
// EnsureDefaultApparmorProfile dose nothing, when build without apparmor build tag.
|
||||
func EnsureDefaultApparmorProfile() error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// GetProfileNameFromPodAnnotations dose nothing, when build without apparmor build tag.
|
||||
|
|
|
@ -188,6 +188,13 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
|
|||
if s.appArmorEnabled {
|
||||
appArmorProfileName := s.getAppArmorProfileName(sb.annotations, metadata.GetName())
|
||||
if appArmorProfileName != "" {
|
||||
// reload default apparmor profile if it is unloaded.
|
||||
if s.appArmorProfile == apparmor.DefaultApparmorProfile {
|
||||
if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
specgen.SetProcessApparmorProfile(appArmorProfileName)
|
||||
}
|
||||
}
|
||||
|
|
|
@ -333,6 +333,7 @@ func New(config *Config) (*Server, error) {
|
|||
},
|
||||
seccompEnabled: seccompEnabled(),
|
||||
appArmorEnabled: apparmor.IsEnabled(),
|
||||
appArmorProfile: config.ApparmorProfile,
|
||||
}
|
||||
seccompProfile, err := ioutil.ReadFile(config.SeccompProfile)
|
||||
if err != nil {
|
||||
|
@ -344,10 +345,11 @@ func New(config *Config) (*Server, error) {
|
|||
}
|
||||
s.seccompProfile = seccompConfig
|
||||
|
||||
if s.appArmorEnabled {
|
||||
apparmor.InstallDefaultAppArmorProfile()
|
||||
if s.appArmorEnabled && s.appArmorProfile == apparmor.DefaultApparmorProfile {
|
||||
if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
|
||||
return nil, fmt.Errorf("ensuring the default apparmor profile is installed failed: %v", err)
|
||||
}
|
||||
}
|
||||
s.appArmorProfile = config.ApparmorProfile
|
||||
|
||||
s.podIDIndex = truncindex.NewTruncIndex([]string{})
|
||||
s.podNameIndex = registrar.NewRegistrar()
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue