summaryrefslogtreecommitdiff
path: root/pkg
diff options
context:
space:
mode:
authorValentin Rothberg <rothberg@redhat.com>2019-01-28 20:28:28 +0100
committerChris Evich <cevich@redhat.com>2019-01-29 10:38:52 -0500
commit18b7009754df560d6debcba6123888af62b6e3e0 (patch)
treeefc2a6e067456fc4c4c997cb92288e613872a58b /pkg
parent88f222b41daa256ebeee961346dbc74b99156189 (diff)
downloadpodman-18b7009754df560d6debcba6123888af62b6e3e0.tar.gz
podman-18b7009754df560d6debcba6123888af62b6e3e0.tar.bz2
podman-18b7009754df560d6debcba6123888af62b6e3e0.zip
apparmor: don't load default profile in rootless mode
AppArmor requires root privileges, so skip loading the default profile in rootless mode. Also add a log to ease debugging. Fixes: #2223 Reported-by: @dmacvicar Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
Diffstat (limited to 'pkg')
-rw-r--r--pkg/apparmor/apparmor_linux.go13
1 files changed, 10 insertions, 3 deletions
diff --git a/pkg/apparmor/apparmor_linux.go b/pkg/apparmor/apparmor_linux.go
index 0787b3fa5..2c5022c1f 100644
--- a/pkg/apparmor/apparmor_linux.go
+++ b/pkg/apparmor/apparmor_linux.go
@@ -214,8 +214,15 @@ func CheckProfileAndLoadDefault(name string) (string, error) {
return name, nil
}
- if name != "" && rootless.IsRootless() {
- return "", errors.Wrapf(ErrApparmorRootless, "cannot load AppArmor profile %q", name)
+ // AppArmor is not supported in rootless mode as it requires root
+ // privileges. Return an error in case a specific profile is specified.
+ if rootless.IsRootless() {
+ if name != "" {
+ return "", errors.Wrapf(ErrApparmorRootless, "cannot load AppArmor profile %q", name)
+ } else {
+ logrus.Debug("skipping loading default AppArmor profile (rootless mode)")
+ return "", nil
+ }
}
if name != "" && !runcaa.IsEnabled() {
@@ -230,7 +237,7 @@ func CheckProfileAndLoadDefault(name string) (string, error) {
return "", err
}
if !isLoaded {
- return "", fmt.Errorf("AppArmor profile %q specified but not loaded")
+ return "", fmt.Errorf("AppArmor profile %q specified but not loaded", name)
}
return name, nil
}