Merge pull request #2114 from vrothberg/issue-2107

apparmor: apply default profile at container initialization

1 files changed, 26 insertions, 0 deletions

diff --git a/libpod/container.go b/libpod/container.go
index d0eb6a992..026eb1c4f 100644
--- a/libpod/container.go
+++ b/libpod/container.go
@@ -1,7 +1,9 @@
 package libpod
 
 import (
+	"encoding/json"
 	"fmt"
+	"io/ioutil"
 	"net"
 	"os"
 	"path/filepath"
@@ -407,6 +409,30 @@ func (c *Container) Spec() *spec.Spec {
 	return returnSpec
 }
 
+// specFromState returns the unmarshalled json config of the container.  If the
+// config does not exist (e.g., because the container was never started) return
+// the spec from the config.
+func (c *Container) specFromState() (*spec.Spec, error) {
+	spec := c.config.Spec
+
+	if f, err := os.Open(c.state.ConfigPath); err == nil {
+		content, err := ioutil.ReadAll(f)
+		if err != nil {
+			return nil, errors.Wrapf(err, "error reading container config")
+		}
+		if err := json.Unmarshal([]byte(content), &spec); err != nil {
+			return nil, errors.Wrapf(err, "error unmarshalling container config")
+		}
+	} else {
+		// ignore when the file does not exist
+		if !os.IsNotExist(err) {
+			return nil, errors.Wrapf(err, "error opening container config")
+		}
+	}
+
+	return spec, nil
+}
+
 // ID returns the container's ID
 func (c *Container) ID() string {
 	return c.config.ID