Merge pull request #239 from xlgao-zju/reload-apparmor-profile

reload default apparmor profile if it is unloaded
This commit is contained in:
Antonio Murdaca 2016-12-13 11:10:26 +01:00 committed by GitHub
commit 4bb0830c37
9 changed files with 142 additions and 96 deletions

View file

@ -0,0 +1,14 @@
package apparmor
const (
// DefaultApparmorProfile is the name of default apparmor profile name.
DefaultApparmorProfile = "ocid-default"
// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
// ProfileRuntimeDefault is he profile specifying the runtime default.
ProfileRuntimeDefault = "runtime/default"
// ProfileNamePrefix is the prefix for specifying profiles loaded on the node.
ProfileNamePrefix = "localhost/"
)

View file

@ -4,35 +4,20 @@ package apparmor
import (
"bufio"
"fmt"
"io"
"io/ioutil"
"os"
"path"
"strings"
"time"
"github.com/Sirupsen/logrus"
"github.com/docker/docker/utils/templates"
"github.com/opencontainers/runc/libcontainer/apparmor"
)
const (
// defaultApparmorProfile is the name of default apparmor profile name.
defaultApparmorProfile = "ocid-default"
// profileDirectory is the file store for apparmor profiles and macros.
profileDirectory = "/etc/apparmor.d"
// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
// ProfileRuntimeDefault is he profile specifying the runtime default.
ProfileRuntimeDefault = "runtime/default"
// ProfileNamePrefix is the prefix for specifying profiles loaded on the node.
ProfileNamePrefix = "localhost/"
// readConfigTimeout is the timeout of reading apparmor profiles.
readConfigTimeout = 10
)
// profileData holds information about the given profile for generation.
@ -47,15 +32,26 @@ type profileData struct {
Version int
}
// InstallDefaultAppArmorProfile installs default apparmor profile.
func InstallDefaultAppArmorProfile() {
if err := InstallDefault(defaultApparmorProfile); err != nil {
// Allow daemon to run if loading failed, but are active
// (possibly through another run, manually, or via system startup)
if !IsLoaded(defaultApparmorProfile) {
logrus.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", defaultApparmorProfile)
// EnsureDefaultApparmorProfile loads default apparmor profile, if it is not loaded.
func EnsureDefaultApparmorProfile() error {
if apparmor.IsEnabled() {
loaded, err := IsLoaded(DefaultApparmorProfile)
if err != nil {
return fmt.Errorf("Could not check if %s AppArmor profile was loaded: %s", DefaultApparmorProfile, err)
}
// Nothing to do.
if loaded {
return nil
}
// Load the profile.
if err := InstallDefault(DefaultApparmorProfile); err != nil {
return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", DefaultApparmorProfile)
}
}
return nil
}
// IsEnabled returns true if apparmor is enabled for the host.
@ -90,35 +86,30 @@ func InstallDefault(name string) error {
return LoadProfile(f.Name())
}
// IsLoaded checks if a passed profile has been loaded into the kernel.
func IsLoaded(name string) bool {
// IsLoaded checks if a profile with the given name has been loaded into the
// kernel.
func IsLoaded(name string) (bool, error) {
file, err := os.Open("/sys/kernel/security/apparmor/profiles")
if err != nil {
return false
return false, err
}
defer file.Close()
ch := make(chan bool, 1)
go func() {
r := bufio.NewReader(file)
for {
p, err := r.ReadString('\n')
if err != nil {
ch <- false
}
if strings.HasPrefix(p, name+" ") {
ch <- true
}
r := bufio.NewReader(file)
for {
p, err := r.ReadString('\n')
if err == io.EOF {
break
}
if err != nil {
return false, err
}
if strings.HasPrefix(p, name+" ") {
return true, nil
}
}()
select {
case <-time.After(time.Duration(readConfigTimeout) * time.Second):
return false
case enabled := <-ch:
return enabled
}
return false, nil
}
// generateDefault creates an apparmor profile from ProfileData.

View file

@ -2,23 +2,14 @@
package apparmor
const (
// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
// ProfileRuntimeDefault is he profile specifying the runtime default.
ProfileRuntimeDefault = "runtime/default"
// ProfileNamePrefix is the prefix for specifying profiles loaded on the node.
ProfileNamePrefix = "localhost/"
)
// IsEnabled returns false, when build without apparmor build tag.
func IsEnabled() bool {
return false
}
// InstallDefaultAppArmorProfile dose nothing, when build without apparmor build tag.
func InstallDefaultAppArmorProfile() {
// EnsureDefaultApparmorProfile dose nothing, when build without apparmor build tag.
func EnsureDefaultApparmorProfile() error {
return nil
}
// GetProfileNameFromPodAnnotations dose nothing, when build without apparmor build tag.

View file

@ -188,6 +188,13 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
if s.appArmorEnabled {
appArmorProfileName := s.getAppArmorProfileName(sb.annotations, metadata.GetName())
if appArmorProfileName != "" {
// reload default apparmor profile if it is unloaded.
if s.appArmorProfile == apparmor.DefaultApparmorProfile {
if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
return nil, err
}
}
specgen.SetProcessApparmorProfile(appArmorProfileName)
}
}

View file

@ -333,6 +333,7 @@ func New(config *Config) (*Server, error) {
},
seccompEnabled: seccompEnabled(),
appArmorEnabled: apparmor.IsEnabled(),
appArmorProfile: config.ApparmorProfile,
}
seccompProfile, err := ioutil.ReadFile(config.SeccompProfile)
if err != nil {
@ -344,10 +345,11 @@ func New(config *Config) (*Server, error) {
}
s.seccompProfile = seccompConfig
if s.appArmorEnabled {
apparmor.InstallDefaultAppArmorProfile()
if s.appArmorEnabled && s.appArmorProfile == apparmor.DefaultApparmorProfile {
if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
return nil, fmt.Errorf("ensuring the default apparmor profile is installed failed: %v", err)
}
}
s.appArmorProfile = config.ApparmorProfile
s.podIDIndex = truncindex.NewTruncIndex([]string{})
s.podNameIndex = registrar.NewRegistrar()