1 files changed, 17 insertions, 16 deletions

diff --git a/libpod/container_internal_linux.go b/libpod/container_internal_linux.go
index 0745b7732..bcdfdaee3 100644
--- a/libpod/container_internal_linux.go
+++ b/libpod/container_internal_linux.go
@@ -4,7 +4,6 @@ package libpod
 
 import (
 	"context"
-	"encoding/json"
 	"fmt"
 	"io/ioutil"
 	"net"
@@ -20,6 +19,7 @@ import (
 	cnitypes "github.com/containernetworking/cni/pkg/types/current"
 	"github.com/containernetworking/plugins/pkg/ns"
 	crioAnnotations "github.com/containers/libpod/pkg/annotations"
+	"github.com/containers/libpod/pkg/apparmor"
 	"github.com/containers/libpod/pkg/criu"
 	"github.com/containers/libpod/pkg/lookup"
 	"github.com/containers/libpod/pkg/resolvconf"
@@ -185,6 +185,13 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 		}
 	}
 
+	// Apply AppArmor checks and load the default profile if needed.
+	updatedProfile, err := apparmor.CheckProfileAndLoadDefault(c.config.Spec.Process.ApparmorProfile)
+	if err != nil {
+		return nil, err
+	}
+	g.SetProcessApparmorProfile(updatedProfile)
+
 	if err := c.makeBindMounts(); err != nil {
 		return nil, err
 	}
@@ -219,7 +226,7 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 			Options:     []string{"bind", "private"},
 		}
 		if c.IsReadOnly() && dstPath != "/dev/shm" {
-			newMount.Options = append(newMount.Options, "ro")
+			newMount.Options = append(newMount.Options, "ro", "nosuid", "noexec", "nodev")
 		}
 		if !MountExists(g.Mounts(), dstPath) {
 			g.AddMount(newMount)
@@ -228,10 +235,6 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 		}
 	}
 
-	if c.state.ExtensionStageHooks, err = c.setupOCIHooks(ctx, g.Config); err != nil {
-		return nil, errors.Wrapf(err, "error setting up OCI Hooks")
-	}
-
 	// Bind builtin image volumes
 	if c.config.Rootfs == "" && c.config.ImageVolumes {
 		if err := c.addLocalVolumes(ctx, &g, execUser); err != nil {
@@ -384,6 +387,12 @@ func (c *Container) generateSpec(ctx context.Context) (*spec.Spec, error) {
 		logrus.Debugf("set root propagation to %q", rootPropagation)
 		g.SetLinuxRootPropagation(rootPropagation)
 	}
+
+	// Warning: precreate hooks may alter g.Config in place.
+	if c.state.ExtensionStageHooks, err = c.setupOCIHooks(ctx, g.Config); err != nil {
+		return nil, errors.Wrapf(err, "error setting up OCI Hooks")
+	}
+
 	return g.Config, nil
 }
 
@@ -481,7 +490,7 @@ func (c *Container) checkpoint(ctx context.Context, options ContainerCheckpointO
 	// Save network.status. This is needed to restore the container with
 	// the same IP. Currently limited to one IP address in a container
 	// with one interface.
-	formatJSON, err := json.MarshalIndent(c.state.NetworkStatus, "", "	")
+	formatJSON, err := json.MarshalIndent(c.state.NetworkStatus, "", "     ")
 	if err != nil {
 		return err
 	}
@@ -547,10 +556,8 @@ func (c *Container) restore(ctx context.Context, options ContainerCheckpointOpti
 			}
 		}
 		if IP != nil {
-			env := fmt.Sprintf("IP=%s", IP)
 			// Tell CNI which IP address we want.
-			os.Setenv("CNI_ARGS", env)
-			logrus.Debugf("Restoring container with %s", env)
+			c.requestedIP = IP
 		}
 	}
 
@@ -566,12 +573,6 @@ func (c *Container) restore(ctx context.Context, options ContainerCheckpointOpti
 		return err
 	}
 
-	// TODO: use existing way to request static IPs, once it is merged in ocicni
-	// https://github.com/cri-o/ocicni/pull/23/
-
-	// CNI_ARGS was used to request a certain IP address. Unconditionally remove it.
-	os.Unsetenv("CNI_ARGS")
-
 	// Read config
 	jsonPath := filepath.Join(c.bundlePath(), "config.json")
 	logrus.Debugf("generate.NewFromFile at %v", jsonPath)