Skip to content

Commit eba94a1

Browse files
thaJeztahthaJeztah
committed
pkg/cri/server: remove dependency on libcontainer/apparmor, libcontainer/utils
recent versions of libcontainer/apparmor simplified the AppArmor check to only check if the host supports AppArmor, but no longer checks if apparmor_parser is installed, or if we're running docker-in-docker; opencontainers/runc@bfb4ea1 > The `apparmor_parser` binary is not really required for a system to run > AppArmor from a runc perspective. How to apply the profile is more in > the responsibility of higher level runtimes like Podman and Docker, > which may do the binary check on their own. This patch copies the logic from libcontainer/apparmor, and restores the additional checks. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent fca7887 commit eba94a1

8 files changed

Lines changed: 78 additions & 355 deletions

File tree

‎pkg/cri/server/apparmor.go‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
// +build apparmor,linux
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package server
20+
21+
import (
22+
"io/ioutil"
23+
"os"
24+
"sync"
25+
)
26+
27+
var (
28+
appArmorSupported bool
29+
checkAppArmor sync.Once
30+
)
31+
32+
// hostSupportsAppArmor returns true if apparmor is enabled for the host, if
33+
// apparmor_parser is enabled, and if we are not running docker-in-docker.
34+
//
35+
// It is a modified version of libcontainer/apparmor.IsEnabled(), which does not
36+
// check for apparmor_parser to be present, or if we're running docker-in-docker.
37+
func hostSupportsAppArmor() bool {
38+
checkAppArmor.Do(func() {
39+
// see https://github.com/docker/docker/commit/de191e86321f7d3136ff42ff75826b8107399497
40+
if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" {
41+
if _, err = os.Stat("/sbin/apparmor_parser"); err == nil {
42+
buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
43+
appArmorSupported = err == nil && len(buf) > 1 && buf[0] == 'Y'
44+
}
45+
}
46+
})
47+
return appArmorSupported
48+
}

‎pkg/cri/server/apparmor_unsupported.go‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
// +build !apparmor !linux
2+
3+
/*
4+
Copyright The containerd Authors.
5+
6+
Licensed under the Apache License, Version 2.0 (the "License");
7+
you may not use this file except in compliance with the License.
8+
You may obtain a copy of the License at
9+
10+
http://www.apache.org/licenses/LICENSE-2.0
11+
12+
Unless required by applicable law or agreed to in writing, software
13+
distributed under the License is distributed on an "AS IS" BASIS,
14+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
See the License for the specific language governing permissions and
16+
limitations under the License.
17+
*/
18+
19+
package server
20+
21+
//nolint: deadcode, unused
22+
func hostSupportsAppArmor() bool {
23+
return false
24+
}

‎pkg/cri/server/helpers_linux.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,6 @@ import (
3232
"github.com/containerd/containerd/mount"
3333
"github.com/containerd/containerd/pkg/seccomp"
3434
"github.com/containerd/containerd/pkg/seutil"
35-
runcapparmor "github.com/opencontainers/runc/libcontainer/apparmor"
3635
"github.com/opencontainers/runtime-spec/specs-go"
3736
"github.com/opencontainers/selinux/go-selinux/label"
3837
"github.com/pkg/errors"
@@ -141,8 +140,13 @@ func checkSelinuxLevel(level string) error {
141140
return nil
142141
}
143142

143+
// apparmorEnabled returns true if apparmor is enabled, supported by the host,
144+
// if apparmor_parser is installed, and if we are not running docker-in-docker.
144145
func (c *criService) apparmorEnabled() bool {
145-
return runcapparmor.IsEnabled() && !c.config.DisableApparmor
146+
if c.config.DisableApparmor {
147+
return false
148+
}
149+
return hostSupportsAppArmor()
146150
}
147151

148152
func (c *criService) seccompEnabled() bool {

‎vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor.go‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎vendor/github.com/opencontainers/runc/libcontainer/apparmor/apparmor_disabled.go‎

Lines changed: 0 additions & 20 deletions
This file was deleted.

‎vendor/github.com/opencontainers/runc/libcontainer/utils/cmsg.go‎

Lines changed: 0 additions & 93 deletions
This file was deleted.

‎vendor/github.com/opencontainers/runc/libcontainer/utils/utils.go‎

Lines changed: 0 additions & 112 deletions
This file was deleted.

0 commit comments

Comments
 (0)