diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-09-07 06:32:19 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-09-07 06:32:19 -0400 |
| commit | 21c6aaeb857404309abe6a82e0541fd08fc615c7 (patch) | |
| tree | a85659e1606a60aa7dc4314bb1d62447f6c53c9e | |
| parent | ba8d0bb5e336e84aaf68148563e61558b5dc94f5 (diff) | |
| parent | 1509adc0a7610f368cd9220352d4895da865bffb (diff) | |
| download | podman-21c6aaeb857404309abe6a82e0541fd08fc615c7.tar.gz podman-21c6aaeb857404309abe6a82e0541fd08fc615c7.tar.bz2 podman-21c6aaeb857404309abe6a82e0541fd08fc615c7.zip | |
Merge pull request #7553 from saschagrunert/apparmor-fix
Fix unconfined AppArmor profile usage for unsupported systems
| -rw-r--r-- | pkg/specgen/generate/security.go | 2 | ||||
| -rw-r--r-- | test/e2e/run_apparmor_test.go | 13 |
2 files changed, 14 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index d3e3d9278..87e8029a7 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -60,7 +60,7 @@ func setLabelOpts(s *specgen.SpecGenerator, runtime *libpod.Runtime, pidConfig s func setupApparmor(s *specgen.SpecGenerator, rtc *config.Config, g *generate.Generator) error { hasProfile := len(s.ApparmorProfile) > 0 if !apparmor.IsEnabled() { - if hasProfile { + if hasProfile && s.ApparmorProfile != "unconfined" { return errors.Errorf("Apparmor profile %q specified, but Apparmor is not enabled on this system", s.ApparmorProfile) } return nil diff --git a/test/e2e/run_apparmor_test.go b/test/e2e/run_apparmor_test.go index 53cac9529..7d522a752 100644 --- a/test/e2e/run_apparmor_test.go +++ b/test/e2e/run_apparmor_test.go @@ -155,4 +155,17 @@ profile aa-test-profile flags=(attach_disconnected,mediate_deleted) { inspect := podmanTest.InspectContainer(cid) Expect(inspect[0].AppArmorProfile).To(Equal("")) }) + + It("podman run apparmor disabled unconfined", func() { + skipIfAppArmorEnabled() + + session := podmanTest.Podman([]string{"create", "--security-opt", "apparmor=unconfined", ALPINE, "ls"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + + cid := session.OutputToString() + // Verify that apparmor.Profile is being set + inspect := podmanTest.InspectContainer(cid) + Expect(inspect[0].AppArmorProfile).To(Equal("")) + }) }) |