Skip to content

Commit 8cf669c

Browse files
dmcgowandmcgowan
committed
Fix unsupported files exporting functions for apparmor and seccomp
Signed-off-by: Derek McGowan <[email protected]>
1 parent 35eeb24 commit 8cf669c

6 files changed

Lines changed: 83 additions & 32 deletions

File tree

‎pkg/apparmor/apparmor.go‎

Lines changed: 6 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
1-
// +build linux
2-
31
/*
42
Copyright The containerd Authors.
53
@@ -18,31 +16,12 @@
1816

1917
package apparmor
2018

21-
import (
22-
"io/ioutil"
23-
"os"
24-
"sync"
25-
)
26-
27-
var (
28-
appArmorSupported bool
29-
checkAppArmor sync.Once
30-
)
31-
32-
// HostSupports returns true if apparmor is enabled for the host, if
33-
// apparmor_parser is enabled, and if we are not running docker-in-docker.
19+
// HostSupports returns true if apparmor is enabled for the host, // On non-Linux returns false
20+
// On Linux returns true if apparmor_parser is enabled, and if we
21+
// are not running docker-in-docker.
3422
//
35-
// It is a modified version of libcontainer/apparmor.IsEnabled(), which does not
36-
// check for apparmor_parser to be present, or if we're running docker-in-docker.
23+
// It is a modified version of libcontainer/apparmor.IsEnabled(), which does not
24+
// check for apparmor_parser to be present, or if we're running docker-in-docker.
3725
func HostSupports() bool {
38-
checkAppArmor.Do(func() {
39-
// see https://github.com/docker/docker/commit/de191e86321f7d3136ff42ff75826b8107399497
40-
if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" {
41-
if _, err = os.Stat("/sbin/apparmor_parser"); err == nil {
42-
buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
43-
appArmorSupported = err == nil && len(buf) > 1 && buf[0] == 'Y'
44-
}
45-
}
46-
})
47-
return appArmorSupported
26+
return hostSupports()
4827
}

‎pkg/apparmor/apparmor_linux.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// +build linux
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package apparmor
20+
21+
import (
22+
"io/ioutil"
23+
"os"
24+
"sync"
25+
)
26+
27+
var (
28+
appArmorSupported bool
29+
checkAppArmor sync.Once
30+
)
31+
32+
// hostSupports returns true if apparmor is enabled for the host, if
33+
// apparmor_parser is enabled, and if we are not running docker-in-docker.
34+
//
35+
// It is a modified version of libcontainer/apparmor.IsEnabled(), which does not
36+
// check for apparmor_parser to be present, or if we're running docker-in-docker.
37+
func hostSupports() bool {
38+
checkAppArmor.Do(func() {
39+
// see https://github.com/docker/docker/commit/de191e86321f7d3136ff42ff75826b8107399497
40+
if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" {
41+
if _, err = os.Stat("/sbin/apparmor_parser"); err == nil {
42+
buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
43+
appArmorSupported = err == nil && len(buf) > 1 && buf[0] == 'Y'
44+
}
45+
}
46+
})
47+
return appArmorSupported
48+
}

‎pkg/apparmor/apparmor_unsupported.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@
1818

1919
package apparmor
2020

21-
//nolint: deadcode, unused
22-
func HostSupports() bool {
21+
func hostSupports() bool {
2322
return false
2423
}

‎pkg/seccomp/seccomp.go‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package seccomp
18+
19+
// IsEnabled returns whether seccomp support is enabled
20+
// On Linux returns if the kernel has been configured to support seccomp.
21+
// From https://github.com/opencontainers/runc/blob/v1.0.0-rc91/libcontainer/seccomp/seccomp_linux.go#L86-L102
22+
// On non-Linux returns false
23+
func IsEnabled() bool {
24+
return isEnabled()
25+
}

‎pkg/seccomp/seccomp_linux.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,9 @@ import (
4040
"golang.org/x/sys/unix"
4141
)
4242

43-
// IsEnabled returns if the kernel has been configured to support seccomp.
43+
// isEnabled returns if the kernel has been configured to support seccomp.
4444
// From https://github.com/opencontainers/runc/blob/v1.0.0-rc91/libcontainer/seccomp/seccomp_linux.go#L86-L102
45-
func IsEnabled() bool {
45+
func isEnabled() bool {
4646
// Try to read from /proc/self/status for kernels > 3.8
4747
s, err := parseStatusFile("/proc/self/status")
4848
if err != nil {

‎pkg/seccomp/seccomp_unsupported.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,6 @@
1818

1919
package seccomp
2020

21-
func IsEnabled() bool {
21+
func isEnabled() bool {
2222
return false
2323
}

0 commit comments

Comments
 (0)