beenull/moby
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

buildkit: Apply apparmor profile

Browse source 
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
This commit is contained in:
Brian Goff 2020-10-09 17:20:48 +00:00 committed by Tibor Vass
parent 4afe620fac
commit 611eb6ffb3
7 changed files with 19 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
builder/builder-next/builder.go
View file

@ -75,6 +75,7 @@ type Opt struct {
Rootless bool
IdentityMapping *idtools.IdentityMapping
DNSConfig config.DNSConfig
ApparmorProfile string
}
// Builder can build using BuildKit backend

2
builder/builder-next/controller.go
View file

@ -132,7 +132,7 @@ func newController(rt http.RoundTripper, opt Opt) (*control.Controller, error) {
dns := getDNSConfig(opt.DNSConfig)
exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, dns, opt.Rootless, opt.IdentityMapping)
exec, err := newExecutor(root, opt.DefaultCgroupParent, opt.NetworkController, dns, opt.Rootless, opt.IdentityMapping, opt.ApparmorProfile)
if err != nil {
return nil, err
}

3
builder/builder-next/executor_unix.go
View file

@ -24,7 +24,7 @@ import (
const networkName = "bridge"
func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping) (executor.Executor, error) {
func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dnsConfig *oci.DNSConfig, rootless bool, idmap *idtools.IdentityMapping, apparmorProfile string) (executor.Executor, error) {
networkProviders := map[pb.NetMode]network.Provider{
pb.NetMode_UNSET: &bridgeProvider{NetworkController: net, Root: filepath.Join(root, "net")},
pb.NetMode_HOST: network.NewHostProvider(),
@ -38,6 +38,7 @@ func newExecutor(root, cgroupParent string, net libnetwork.NetworkController, dn
NoPivot: os.Getenv("DOCKER_RAMDISK") != "",
IdentityMapping: idmap,
DNS: dnsConfig,
ApparmorProfile: apparmorProfile,
}, networkProviders)
}

2
builder/builder-next/executor_windows.go
View file

@ -11,7 +11,7 @@ import (
"github.com/moby/buildkit/executor/oci"
)
func newExecutor(_, _ string, _ libnetwork.NetworkController, _ *oci.DNSConfig, _ bool, _ *idtools.IdentityMapping) (executor.Executor, error) {
func newExecutor(_, _ string, _ libnetwork.NetworkController, _ *oci.DNSConfig, _ bool, _ *idtools.IdentityMapping, _ string) (executor.Executor, error) {
return &winExecutor{}, nil
}

1
cmd/dockerd/daemon.go
View file

@ -297,6 +297,7 @@ func newRouterOptions(config *config.Config, d *daemon.Daemon) (routerOptions, e
Rootless: d.Rootless(),
IdentityMapping: d.IdentityMapping(),
DNSConfig: config.DNSConfig,
ApparmorProfile: daemon.DefaultApparmorProfile(),
})
if err != nil {
return opts, err

8
daemon/apparmor_default.go
View file

@ -15,6 +15,14 @@ const (
defaultAppArmorProfile = "docker-default"
)
// DefaultApparmorProfile returns the name of the default apparmor profile
func DefaultApparmorProfile() string {
if apparmor.IsEnabled() {
return defaultAppArmorProfile
}
return ""
}
func ensureDefaultAppArmorProfile() error {
if apparmor.IsEnabled() {
loaded, err := aaprofile.IsLoaded(defaultAppArmorProfile)

5
daemon/apparmor_default_unsupported.go
View file

@ -5,3 +5,8 @@ package daemon // import "github.com/docker/docker/daemon"
func ensureDefaultAppArmorProfile() error {
return nil
}
// DefaultApparmorProfile returns an empty string.
func DefaultApparmorProfile() string {
return ""
}