reload default apparmor profile if it is unloaded

Signed-off-by: Xianglin Gao <xlgao@zju.edu.cn>

server/apparmor/apparmor.go

@@ -17,8 +17,8 @@ import (
 )
 
 const (
-	// defaultApparmorProfile is the name of default apparmor profile name.
-	defaultApparmorProfile = "ocid-default"
+	// DefaultApparmorProfile is the name of default apparmor profile name.
+	DefaultApparmorProfile = "ocid-default"
 
 	// profileDirectory is the file store for apparmor profiles and macros.
 	profileDirectory = "/etc/apparmor.d"
@@ -47,13 +47,11 @@ type profileData struct {
 	Version int
 }
 
-// InstallDefaultAppArmorProfile installs default apparmor profile.
-func InstallDefaultAppArmorProfile() {
-	if err := InstallDefault(defaultApparmorProfile); err != nil {
-		// Allow daemon to run if loading failed, but are active
-		// (possibly through another run, manually, or via system startup)
-		if !IsLoaded(defaultApparmorProfile) {
-			logrus.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", defaultApparmorProfile)
+// LoadDefaultAppArmorProfile loads default apparmor profile, if it is not loaded.
+func LoadDefaultAppArmorProfile() {
+	if !IsLoaded(DefaultApparmorProfile) {
+		if err := InstallDefault(DefaultApparmorProfile); err != nil {
+			logrus.Errorf("AppArmor enabled on system but the %s profile could not be loaded:%v", DefaultApparmorProfile, err)
 		}
 	}
 }

server/apparmor/apparmor_unsupported.go

@@ -3,6 +3,9 @@
 package apparmor
 
 const (
+	// DefaultApparmorProfile is the name of default apparmor profile name.
+	DefaultApparmorProfile = "ocid-default"
+
 	// ContainerAnnotationKeyPrefix is the prefix to an annotation key specifying a container profile.
 	ContainerAnnotationKeyPrefix = "container.apparmor.security.beta.kubernetes.io/"
 
@@ -17,8 +20,8 @@ func IsEnabled() bool {
 	return false
 }
 
-// InstallDefaultAppArmorProfile dose nothing, when build without apparmor build tag.
-func InstallDefaultAppArmorProfile() {
+// LoadDefaultAppArmorProfile dose nothing, when build without apparmor build tag.
+func LoadDefaultAppArmorProfile() {
 }
 
 // GetProfileNameFromPodAnnotations dose nothing, when build without apparmor build tag.

server/container_create.go

@@ -393,6 +393,11 @@ func (s *Server) getAppArmorProfileName(annotations map[string]string, ctrName s
 	}
 
 	if profile == apparmor.ProfileRuntimeDefault {
+		// reload default apparmor profile if it is unloaded.
+		if s.appArmorProfile == apparmor.DefaultApparmorProfile {
+			apparmor.LoadDefaultAppArmorProfile()
+		}
+
 		// If the value is runtime/default, then return default profile.
 		return s.appArmorProfile
 	}

server/server.go

@@ -299,7 +299,7 @@ func New(config *Config) (*Server, error) {
 	s.seccompProfile = seccompConfig
 
 	if s.appArmorEnabled {
-		apparmor.InstallDefaultAppArmorProfile()
+		apparmor.LoadDefaultAppArmorProfile()
 	}
 	s.appArmorProfile = config.ApparmorProfile