vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Add AppArmor support to native driver + change pipe/dup logic

Browse source 
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)
This commit is contained in:
Guillaume J. Charmes 2014-03-05 11:59:31 -08:00
parent 7339ca8699
commit 73233223de
3 changed files with 57 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

22
libcontainer/nsinit/init.go
View file

@ -5,6 +5,7 @@ package nsinit
import (
"fmt"
"github.com/dotcloud/docker/pkg/libcontainer"
"github.com/dotcloud/docker/pkg/libcontainer/apparmor"
"github.com/dotcloud/docker/pkg/libcontainer/capabilities"
"github.com/dotcloud/docker/pkg/libcontainer/network"
"github.com/dotcloud/docker/pkg/libcontainer/utils"
@ -32,7 +33,7 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
if console != "" {
// close pipes so that we can replace it with the pty
closeStdPipes()
// closeStdPipes()
slave, err := system.OpenTerminal(console, syscall.O_RDWR)
if err != nil {
return fmt.Errorf("open terminal %s", err)
@ -55,9 +56,17 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
return fmt.Errorf("parent death signal %s", err)
}
*/
if err := setupNewMountNamespace(rootfs, console, container.ReadonlyFs); err != nil {
return fmt.Errorf("setup mount namespace %s", err)
}
if err := apparmor.ApplyProfile(os.Getpid(), container.Context["apparmor_profile"]); err != nil {
if err != apparmor.ErrAppArmorDisabled {
return err
}
}
if err := setupNetwork(container, context); err != nil {
return fmt.Errorf("setup networking %s", err)
}
@ -67,13 +76,8 @@ func (ns *linuxNs) Init(container *libcontainer.Container, uncleanRootfs, consol
if err := finalizeNamespace(container); err != nil {
return fmt.Errorf("finalize namespace %s", err)
}
return system.Execv(args[0], args[0:], container.Env)
}
func closeStdPipes() {
os.Stdin.Close()
os.Stdout.Close()
os.Stderr.Close()
return system.Execv(args[0], args[0:], container.Env)
}
func setupUser(container *libcontainer.Container) error {
@ -109,8 +113,8 @@ func setupUser(container *libcontainer.Container) error {
// dupSlave dup2 the pty slave's fd into stdout and stdin and ensures that
// the slave's fd is 0, or stdin
func dupSlave(slave *os.File) error {
if slave.Fd() != 0 {
return fmt.Errorf("slave fd not 0 %d", slave.Fd())
if err := system.Dup2(slave.Fd(), 0); err != nil {
return err
}
if err := system.Dup2(slave.Fd(), 1); err != nil {
return err