Merge pull request #13335 from jfrazelle/add-apparmor-unshare-test

add unshare apparmor profile test

hack/make/.ensure-frozen-images

@@ -5,6 +5,7 @@ set -e
 images=(
 	busybox:latest
 	hello-world:frozen
+	jess/unshare:latest
 )
 
 if ! docker inspect "${images[@]}" &> /dev/null; then

hack/make/.integration-daemon-start

@@ -27,6 +27,17 @@ if [ -n "$DOCKER_STORAGE_OPTS" ]; then
 fi
 
 if [ -z "$DOCKER_TEST_HOST" ]; then
+	# Start apparmor if it is enabled
+	if [ "$(cat /sys/module/apparmor/parameters/enabled)" == "Y" ]; then
+		# reset container variable so apparmor profile is applied to process
+		# see https://github.com/docker/libcontainer/blob/master/apparmor/apparmor.go#L16
+		export container=""
+		(
+			set -x
+			/etc/init.d/apparmor start
+		)
+	fi
+
 	export DOCKER_HOST="unix://$(cd "$DEST" && pwd)/docker.sock" # "pwd" tricks to make sure $DEST is an absolute path, not a relative one
 	( set -x; exec \
 		docker --daemon --debug \

hack/make/.integration-daemon-stop

@@ -9,3 +9,13 @@ for pidFile in $(find "$DEST" -name docker.pid); do
 		echo >&2 "warning: PID $pid from $pidFile had a nonzero exit code"
 	fi
 done
+
+if [ -z "$DOCKER_TEST_HOST" ]; then
+	# Stop apparmor if it is enabled
+	if [ "$(cat /sys/module/apparmor/parameters/enabled)" == "Y" ]; then
+		(
+			set -x
+			/etc/init.d/apparmor stop
+		)
+	fi
+fi