vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Do not load ocid-default if configured apparmor profile is set up.

Browse source 
Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>
This commit is contained in:
Xianglin Gao 2016-12-12 15:55:17 +08:00
parent 6977b3e88d
commit ca7d5c77c2
4 changed files with 50 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

12
server/container_create.go
View file

@ -188,6 +188,13 @@ func (s *Server) createSandboxContainer(containerID string, containerName string
if s.appArmorEnabled {
appArmorProfileName := s.getAppArmorProfileName(sb.annotations, metadata.GetName())
if appArmorProfileName != "" {
// reload default apparmor profile if it is unloaded.
if s.appArmorProfile == apparmor.DefaultApparmorProfile {
if err := apparmor.EnsureDefaultApparmorProfile(); err != nil {
return nil, err
}
}
specgen.SetProcessApparmorProfile(appArmorProfileName)
}
}
@ -393,11 +400,6 @@ func (s *Server) getAppArmorProfileName(annotations map[string]string, ctrName s
}
if profile == apparmor.ProfileRuntimeDefault {
// reload default apparmor profile if it is unloaded.
if s.appArmorProfile == apparmor.DefaultApparmorProfile {
apparmor.LoadDefaultAppArmorProfile()
}
// If the value is runtime/default, then return default profile.
return s.appArmorProfile
}