diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2019-05-28 16:23:48 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2019-05-28 16:23:48 +0200 |
| commit | 335a1ef1606734e4735a810e839032297cc89060 (patch) | |
| tree | 12cfd0200888ced920a4144e57bfb8abf65aee68 /libpod | |
| parent | 25f8c21ea8ac1994cd1e8468c72e3d3481be8102 (diff) | |
| parent | 1910118de988c8698a2d6a6eaf666dc958e454fe (diff) | |
| download | podman-335a1ef1606734e4735a810e839032297cc89060.tar.gz podman-335a1ef1606734e4735a810e839032297cc89060.tar.bz2 podman-335a1ef1606734e4735a810e839032297cc89060.zip | |
Merge pull request #3189 from vrothberg/apparmor-fixes
Apparmor fixes
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/container_internal_linux.go | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go index c5e404155..f25f76092 100644 --- a/libpod/container_internal_linux.go +++ b/libpod/container_internal_linux.go @@ -25,7 +25,7 @@ import ( "github.com/containers/libpod/pkg/lookup" "github.com/containers/libpod/pkg/resolvconf" "github.com/containers/libpod/pkg/rootless" - "github.com/cyphar/filepath-securejoin" + securejoin "github.com/cyphar/filepath-securejoin" "github.com/opencontainers/runc/libcontainer/user" spec "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/runtime-tools/generate" @@ -188,11 +188,13 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) { } // Apply AppArmor checks and load the default profile if needed. - updatedProfile, err := apparmor.CheckProfileAndLoadDefault(c.config.Spec.Process.ApparmorProfile) - if err != nil { - return nil, err + if !c.config.Privileged { + updatedProfile, err := apparmor.CheckProfileAndLoadDefault(c.config.Spec.Process.ApparmorProfile) + if err != nil { + return nil, err + } + g.SetProcessApparmorProfile(updatedProfile) } - g.SetProcessApparmorProfile(updatedProfile) if err := c.makeBindMounts(); err != nil { return nil, err |