summaryrefslogtreecommitdiff
path: root/pkg/apparmor/apparmor_linux.go
diff options
context:
space:
mode:
authorValentin Rothberg <vrothberg@suse.com>2018-08-13 14:41:10 +0200
committerAtomic Bot <atomic-devel@projectatomic.io>2018-08-14 14:25:14 +0000
commit31e0dea5a020af9f1bf4d5d3a8e40fc1b2882474 (patch)
tree79359553e5b1043362e1633702be1cbaa9a60410 /pkg/apparmor/apparmor_linux.go
parent70b44848119def655b836efa47dbfebde32e1bcb (diff)
downloadpodman-31e0dea5a020af9f1bf4d5d3a8e40fc1b2882474.tar.gz
podman-31e0dea5a020af9f1bf4d5d3a8e40fc1b2882474.tar.bz2
podman-31e0dea5a020af9f1bf4d5d3a8e40fc1b2882474.zip
pkg/apparmor: move all linux-code into apparmor_linux*
For easier maintenance and clearer structure of the code. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1262 Approved by: mheon
Diffstat (limited to 'pkg/apparmor/apparmor_linux.go')
-rw-r--r--pkg/apparmor/apparmor_linux.go79
1 files changed, 78 insertions, 1 deletions
diff --git a/pkg/apparmor/apparmor_linux.go b/pkg/apparmor/apparmor_linux.go
index a09c5fc44..4cc95a107 100644
--- a/pkg/apparmor/apparmor_linux.go
+++ b/pkg/apparmor/apparmor_linux.go
@@ -4,10 +4,13 @@ package apparmor
import (
"bufio"
+ "fmt"
"io"
"io/ioutil"
"os"
+ "os/exec"
"path"
+ "strconv"
"strings"
"text/template"
@@ -48,7 +51,7 @@ func (p *profileData) generateDefault(out io.Writer) error {
p.InnerImports = append(p.InnerImports, "#include <abstractions/base>")
}
- ver, err := getVersion()
+ ver, err := getAAParserVersion()
if err != nil {
return err
}
@@ -115,3 +118,77 @@ func IsLoaded(name string) (bool, error) {
return false, nil
}
+
+// execAAParser runs `apparmor_parser` with the passed arguments.
+func execAAParser(dir string, args ...string) (string, error) {
+ c := exec.Command("apparmor_parser", args...)
+ c.Dir = dir
+
+ output, err := c.CombinedOutput()
+ if err != nil {
+ return "", fmt.Errorf("running `%s %s` failed with output: %s\nerror: %v", c.Path, strings.Join(c.Args, " "), output, err)
+ }
+
+ return string(output), nil
+}
+
+// loadProfile runs `apparmor_parser -Kr` on a specified apparmor profile to
+// replace the profile. The `-K` is necessary to make sure that apparmor_parser
+// doesn't try to write to a read-only filesystem.
+func loadProfile(profilePath string) error {
+ _, err := execAAParser("", "-Kr", profilePath)
+ return err
+}
+
+// getAAParserVersion returns the major and minor version of apparmor_parser.
+func getAAParserVersion() (int, error) {
+ output, err := execAAParser("", "--version")
+ if err != nil {
+ return -1, err
+ }
+ return parseAAParserVersion(output)
+}
+
+// parseAAParserVersion parses the given `apparmor_parser --version` output and
+// returns the major and minor version number as an integer.
+func parseAAParserVersion(output string) (int, error) {
+ // output is in the form of the following:
+ // AppArmor parser version 2.9.1
+ // Copyright (C) 1999-2008 Novell Inc.
+ // Copyright 2009-2012 Canonical Ltd.
+ lines := strings.SplitN(output, "\n", 2)
+ words := strings.Split(lines[0], " ")
+ version := words[len(words)-1]
+
+ // split by major minor version
+ v := strings.Split(version, ".")
+ if len(v) == 0 || len(v) > 3 {
+ return -1, fmt.Errorf("parsing version failed for output: `%s`", output)
+ }
+
+ // Default the versions to 0.
+ var majorVersion, minorVersion, patchLevel int
+
+ majorVersion, err := strconv.Atoi(v[0])
+ if err != nil {
+ return -1, err
+ }
+
+ if len(v) > 1 {
+ minorVersion, err = strconv.Atoi(v[1])
+ if err != nil {
+ return -1, err
+ }
+ }
+ if len(v) > 2 {
+ patchLevel, err = strconv.Atoi(v[2])
+ if err != nil {
+ return -1, err
+ }
+ }
+
+ // major*10^5 + minor*10^3 + patch*10^0
+ numericVersion := majorVersion*1e5 + minorVersion*1e3 + patchLevel
+ return numericVersion, nil
+
+}