Skip to content

[master] Ensure AppArmor and SELinux profiles are applied when building with BuildKit#41965

Merged
tiborvass merged 2 commits into
moby:masterfrom
thaJeztah:buildkit_apparmor_master
Feb 2, 2021
Merged

[master] Ensure AppArmor and SELinux profiles are applied when building with BuildKit#41965
tiborvass merged 2 commits into
moby:masterfrom
thaJeztah:buildkit_apparmor_master

Conversation

@thaJeztah

Copy link
Copy Markdown
Member

These changes are already included in the v20.10.3 and v19.03.15 security releases, and this PR forwards those changes to the master branch

git cherry-pick -s -S -x 4afe620 611eb6f

Second commit did not apply cleanly, because 7c7e168 (#41863) was merged on master, and is not yet in the 20.10 branch

diff --cc builder/builder-next/executor_unix.go
index 29c9787798,cefbb8a56f..0000000000
--- a/builder/builder-next/executor_unix.go
+++ b/builder/builder-next/executor_unix.go
@@@ -25,10 -24,9 +25,14 @@@ import

  const networkName = "bridge"

++<<<<<<< HEAD
 +func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) {
 +      netRoot := filepath.Join(root, "net")
++=======
+ func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping, apparmorProfile string) (executor.Executor, error) {
++>>>>>>> 611eb6ffb3 (buildkit: Apply apparmor profile)
        networkProviders := map[pb.NetMode]network.Provider{
 -              pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: filepath.Join(root, "net")},
 +              pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: netRoot},
                pb.NetMode_HOST:  network.NewHostProvider(),
                pb.NetMode_NONE:  network.NewNoneProvider(),
        }

Tibor Vass and others added 2 commits February 2, 2021 13:27
Signed-off-by: Tibor Vass <[email protected]>
(cherry picked from commit 4afe620)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
Signed-off-by: Brian Goff <[email protected]>
(cherry picked from commit 611eb6f)
Signed-off-by: Sebastiaan van Stijn <[email protected]>
@tiborvass

Copy link
Copy Markdown
Contributor

Unrelated failure in https://ci-next.docker.com/public/blue/organizations/jenkins/moby/detail/PR-41965/1/tests

=== RUN   TestDockerSuite/TestStartReturnCorrectExitCode
    --- FAIL: TestDockerSuite/TestStartReturnCorrectExitCode (0.98s)
        docker_cli_start_test.go:209: assertion failed: expected an error, got nil

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants