clearlinux/docker
2
0
Fork 0
mirror of https://github.com/clearlinux/docker.git synced 2026-09-06 05:31:47 +00:00
Code Issues Packages Projects Releases Wiki Activity

Restore AppArmor profile generation

Browse Source 
Will attempt to load profiles automatically. If loading fails
but the profiles are already loaded, execution will continue.

A hard failure will only occur if Docker cannot load
the profiles *and* they have not already been loaded via
some other means.

Also introduces documentation for AppArmor.

Signed-off-by: Eric Windisch <eric@windisch.us>
(cherry picked from commit 3edc88f76d)
This commit is contained in:
Eric Windisch
2015-07-29 09:54:16 -07:00
committed by David Calavera
parent b537508f8c
commit e0e852ee6f
5 changed files with 235 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration-cli/docker_cli_run_test.go
+29 -4
View File
@@ -2396,8 +2396,11 @@ func (s *DockerSuite) TestRunWriteToProcAsound(c *check.C) {
func (s *DockerSuite) TestRunReadProcTimer(c *check.C) {
testRequires(c, NativeExecDriver)
out, code, err := dockerCmdWithError(c, "run", "busybox", "cat", "/proc/timer_stats")
if err != nil || code != 0 {
out, code, err := dockerCmdWithError("run", "busybox", "cat", "/proc/timer_stats")
if code != 0 {
return
}
if err != nil {
c.Fatal(err)
}
if strings.Trim(out, "\n ") != "" {
@@ -2413,8 +2416,11 @@ func (s *DockerSuite) TestRunReadProcLatency(c *check.C) {
c.Skip("kernel doesnt have latency_stats configured")
return
}
out, code, err := dockerCmdWithError(c, "run", "busybox", "cat", "/proc/latency_stats")
if err != nil || code != 0 {
out, code, err := dockerCmdWithError("run", "busybox", "cat", "/proc/latency_stats")
if code != 0 {
return
}
if err != nil {
c.Fatal(err)
}
if strings.Trim(out, "\n ") != "" {
@@ -2422,6 +2428,24 @@ func (s *DockerSuite) TestRunReadProcLatency(c *check.C) {
}
}
func (s *DockerSuite) TestRunReadFilteredProc(c *check.C) {
testRequires(c, Apparmor)
testReadPaths := []string{
"/proc/latency_stats",
"/proc/timer_stats",
"/proc/kcore",
}
for i, filePath := range testReadPaths {
name := fmt.Sprintf("procsieve-%d", i)
shellCmd := fmt.Sprintf("exec 3<%s", filePath)
if out, exitCode, err := dockerCmdWithError("run", "--privileged", "--security-opt", "apparmor:docker-default", "--name", name, "busybox", "sh", "-c", shellCmd); err == nil || exitCode == 0 {
c.Fatalf("Open FD for read should have failed with permission denied, got: %s, %v", out, err)
}
}
}
func (s *DockerSuite) TestMountIntoProc(c *check.C) {
testRequires(c, NativeExecDriver)
_, code, err := dockerCmdWithError(c, "run", "-v", "/proc//sys", "busybox", "true")
@@ -2515,6 +2539,7 @@ func (s *DockerSuite) TestRunWriteFilteredProc(c *check.C) {
"/proc/sys/kernel/modprobe",
"/proc/sys/kernel/core_pattern",
"/proc/sysrq-trigger",
"/proc/kcore",
}
for i, filePath := range testWritePaths {
name := fmt.Sprintf("writeprocsieve-%d", i)