1+ From 103a94a51ea334d25bf573f2f20cd4d9a099d827 Mon Sep 17 00:00:00 2001
2+ From: Alberto Mardegan <mardy@users.sourceforge.net>
3+ Date: Thu, 17 Jun 2021 14:31:35 +0300
4+ Subject: [PATCH 3/3] standard_init_linux: change AppArmor profile as late as
5+ possible
6+
7+ ---
8+ libcontainer/standard_init_linux.go | 18 +++++++++---------
9+ 1 file changed, 9 insertions(+), 9 deletions(-)
10+
11+ diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go
12+ index d1d9435..7097571 100644
13+ --- a/libcontainer/standard_init_linux.go
14+ +++ b/libcontainer/standard_init_linux.go
15+ @@ -127,10 +127,6 @@ func (l *linuxStandardInit) Init() error {
16+ return &os.SyscallError{Syscall: "sethostname", Err: err}
17+ }
18+ }
19+ - if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
20+ - return fmt.Errorf("unable to apply apparmor profile: %w", err)
21+ - }
22+ -
23+ for key, value := range l.config.Config.Sysctl {
24+ if err := writeSystemProperty(key, value); err != nil {
25+ return err
26+ @@ -150,17 +146,21 @@ func (l *linuxStandardInit) Init() error {
27+ if err != nil {
28+ return fmt.Errorf("can't get pdeath signal: %w", err)
29+ }
30+ - if l.config.NoNewPrivileges {
31+ - if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
32+ - return &os.SyscallError{Syscall: "prctl(SET_NO_NEW_PRIVS)", Err: err}
33+ - }
34+ - }
35+ // Tell our parent that we're ready to Execv. This must be done before the
36+ // Seccomp rules have been applied, because we need to be able to read and
37+ // write to a socket.
38+ if err := syncParentReady(l.pipe); err != nil {
39+ return fmt.Errorf("sync ready: %w", err)
40+ }
41+ + if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil {
42+ + return fmt.Errorf("apply apparmor profile: %w", err)
43+ + }
44+ + if l.config.NoNewPrivileges {
45+ + if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil {
46+ + return fmt.Errorf("set nonewprivileges: %w", err)
47+ + }
48+ + }
49+ +
50+ if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil {
51+ return fmt.Errorf("can't set process label: %w", err)
52+ }
53+ - -
54+ 2.34.1
0 commit comments