2014-03-05 22:57:20 +00:00
|
|
|
package apparmor
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"os"
|
|
|
|
"os/exec"
|
2014-03-12 18:13:24 +00:00
|
|
|
"path"
|
2014-03-05 22:57:20 +00:00
|
|
|
)
|
|
|
|
|
2014-04-08 17:10:51 +00:00
|
|
|
const (
|
|
|
|
DefaultProfilePath = "/etc/apparmor.d/docker"
|
|
|
|
)
|
|
|
|
|
2014-06-03 18:49:34 +00:00
|
|
|
func InstallDefaultProfile() error {
|
2014-03-05 22:57:20 +00:00
|
|
|
if !IsEnabled() {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2014-03-12 18:13:24 +00:00
|
|
|
// Make sure /etc/apparmor.d exists
|
|
|
|
if err := os.MkdirAll(path.Dir(DefaultProfilePath), 0755); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2014-04-14 05:22:45 +00:00
|
|
|
f, err := os.OpenFile(DefaultProfilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0644)
|
|
|
|
if err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := generateProfile(f); err != nil {
|
|
|
|
f.Close()
|
2014-03-05 22:57:20 +00:00
|
|
|
return err
|
|
|
|
}
|
2014-04-14 05:22:45 +00:00
|
|
|
f.Close()
|
|
|
|
|
|
|
|
cmd := exec.Command("/sbin/apparmor_parser", "-r", "-W", "docker")
|
|
|
|
// to use the parser directly we have to make sure we are in the correct
|
|
|
|
// dir with the profile
|
|
|
|
cmd.Dir = "/etc/apparmor.d"
|
2014-03-05 22:57:20 +00:00
|
|
|
|
2014-04-14 05:22:45 +00:00
|
|
|
output, err := cmd.CombinedOutput()
|
2014-04-30 05:19:21 +00:00
|
|
|
if err != nil {
|
|
|
|
return fmt.Errorf("Error loading docker apparmor profile: %s (%s)", err, output)
|
2014-03-05 22:57:20 +00:00
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|