aboutsummaryrefslogtreecommitdiff
path: root/pkg/apparmor
Commit message (Collapse)AuthorAge
* golangci-lint round #3baude2019-07-21
| | | | | | | this is the third round of preparing to use the golangci-lint on our code base. Signed-off-by: baude <bbaude@redhat.com>
* Add DefaultContent API to retrieve apparmor profile contentSascha Grunert2019-07-18
| | | | | | | | The default apparmor profile is not stored on disk which causes confusion when debugging the content of the profile. To solve this, we now add an additional API which returns the profile as byte slice. Signed-off-by: Sascha Grunert <sgrunert@suse.com>
* pkg/apparmor: fix when AA is disabledValentin Rothberg2019-06-14
| | | | | | | | Do not try to load the default profile when AppArmor is disabled on the host. Fixes: #3331 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* apparmor: don't load default profile in rootless modeValentin Rothberg2019-01-29
| | | | | | | | | AppArmor requires root privileges, so skip loading the default profile in rootless mode. Also add a log to ease debugging. Fixes: #2223 Reported-by: @dmacvicar Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* apparmor: apply default profile at container initializationValentin Rothberg2019-01-09
| | | | | | | | | | | | | | | | | | | Apply the default AppArmor profile at container initialization to cover all possible code paths (i.e., podman-{start,run}) before executing the runtime. This allows moving most of the logic into pkg/apparmor. Also make the loading and application of the default AppArmor profile versio-indepenent by checking for the `libpod-default-` prefix and over-writing the profile in the run-time spec if needed. The intitial run-time spec of the container differs a bit from the applied one when having started the container, which results in displaying a potentially outdated AppArmor profile when inspecting a container. To fix that, load the container config from the file system if present and use it to display the data. Fixes: #2107 Signed-off-by: Valentin Rothberg <rothberg@redhat.com>
* pkg/apparmor: use a pipe instead of a tmp fileValentin Rothberg2018-08-14
| | | | | | | | | | Use a pipe instead of a temporary file to load the apparmor profile. This change has a measurable speed improvement for apparmor users. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1262 Approved by: mheon
* pkg/apparmor: move data under Linux/apparmor buildtagsValentin Rothberg2018-08-14
| | | | | | | | | | Move all Linux-related data under the corresponding buildtags to reduce the memory footprint and speed up compilation for non-apparmor builds. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1262 Approved by: mheon
* pkg/apparmor: move all linux-code into apparmor_linux*Valentin Rothberg2018-08-14
| | | | | | | | | For easier maintenance and clearer structure of the code. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1262 Approved by: mheon
* AppArmor: runtime check if it's enabled on the hostValentin Rothberg2018-07-23
| | | | | | | | | Check at runtime if AppArmor is enabled on the host. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1128 Approved by: mheon
* podman/libpod: add default AppArmor profileValentin Rothberg2018-07-11
Make users of libpod more secure by adding the libpod/apparmor package to load a pre-defined AppArmor profile. Large chunks of libpod/apparmor come from github.com/moby/moby. Also check if a specified AppArmor profile is actually loaded and throw an error if necessary. The default profile is loaded only on Linux builds with the `apparmor` buildtag enabled. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1063 Approved by: rhatdan