Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
| ... | ... |
@@ -12,14 +12,14 @@ import ( |
| 12 | 12 |
// Define constants for native driver |
| 13 | 13 |
const ( |
| 14 | 14 |
unconfinedAppArmorProfile = "unconfined" |
| 15 |
- defaultApparmorProfile = "docker-default" |
|
| 15 |
+ defaultAppArmorProfile = "docker-default" |
|
| 16 | 16 |
) |
| 17 | 17 |
|
| 18 | 18 |
func ensureDefaultAppArmorProfile() error {
|
| 19 | 19 |
if apparmor.IsEnabled() {
|
| 20 |
- loaded, err := aaprofile.IsLoaded(defaultApparmorProfile) |
|
| 20 |
+ loaded, err := aaprofile.IsLoaded(defaultAppArmorProfile) |
|
| 21 | 21 |
if err != nil {
|
| 22 |
- return fmt.Errorf("Could not check if %s AppArmor profile was loaded: %s", defaultApparmorProfile, err)
|
|
| 22 |
+ return fmt.Errorf("Could not check if %s AppArmor profile was loaded: %s", defaultAppArmorProfile, err)
|
|
| 23 | 23 |
} |
| 24 | 24 |
|
| 25 | 25 |
// Nothing to do. |
| ... | ... |
@@ -28,8 +28,8 @@ func ensureDefaultAppArmorProfile() error {
|
| 28 | 28 |
} |
| 29 | 29 |
|
| 30 | 30 |
// Load the profile. |
| 31 |
- if err := aaprofile.InstallDefault(defaultApparmorProfile); err != nil {
|
|
| 32 |
- return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded: %s", defaultApparmorProfile, err)
|
|
| 31 |
+ if err := aaprofile.InstallDefault(defaultAppArmorProfile); err != nil {
|
|
| 32 |
+ return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded: %s", defaultAppArmorProfile, err)
|
|
| 33 | 33 |
} |
| 34 | 34 |
} |
| 35 | 35 |
|
| ... | ... |
@@ -7,7 +7,7 @@ import ( |
| 7 | 7 |
"github.com/docker/docker/errdefs" |
| 8 | 8 |
) |
| 9 | 9 |
|
| 10 |
-func (daemon *Daemon) saveApparmorConfig(container *container.Container) error {
|
|
| 10 |
+func (daemon *Daemon) saveAppArmorConfig(container *container.Container) error {
|
|
| 11 | 11 |
container.AppArmorProfile = "" // we don't care about the previous value. |
| 12 | 12 |
|
| 13 | 13 |
if !daemon.apparmorEnabled {
|
| ... | ... |
@@ -20,7 +20,7 @@ func (daemon *Daemon) saveApparmorConfig(container *container.Container) error {
|
| 20 | 20 |
|
| 21 | 21 |
if !container.HostConfig.Privileged {
|
| 22 | 22 |
if container.AppArmorProfile == "" {
|
| 23 |
- container.AppArmorProfile = defaultApparmorProfile |
|
| 23 |
+ container.AppArmorProfile = defaultAppArmorProfile |
|
| 24 | 24 |
} |
| 25 | 25 |
|
| 26 | 26 |
} else {
|
| ... | ... |
@@ -127,7 +127,7 @@ func shouldUnmountRoot(root string, info *mountinfo.Info) bool {
|
| 127 | 127 |
if !strings.HasSuffix(root, info.Root) {
|
| 128 | 128 |
return false |
| 129 | 129 |
} |
| 130 |
- return hasMountinfoOption(info.Optional, sharedPropagationOption) |
|
| 130 |
+ return hasMountInfoOption(info.Optional, sharedPropagationOption) |
|
| 131 | 131 |
} |
| 132 | 132 |
|
| 133 | 133 |
// setupResolvConf sets the appropriate resolv.conf file if not specified |
| ... | ... |
@@ -1326,7 +1326,7 @@ func setupDaemonRootPropagation(cfg *config.Config) error {
|
| 1326 | 1326 |
} |
| 1327 | 1327 |
}() |
| 1328 | 1328 |
|
| 1329 |
- if hasMountinfoOption(options, sharedPropagationOption, slavePropagationOption) {
|
|
| 1329 |
+ if hasMountInfoOption(options, sharedPropagationOption, slavePropagationOption) {
|
|
| 1330 | 1330 |
cleanupOldFile = true |
| 1331 | 1331 |
return nil |
| 1332 | 1332 |
} |
| ... | ... |
@@ -40,10 +40,10 @@ func (daemon *Daemon) execSetPlatformOpt(c *container.Container, ec *exec.Config |
| 40 | 40 |
// profiles. Privileged configuration of the container is inherited |
| 41 | 41 |
appArmorProfile = unconfinedAppArmorProfile |
| 42 | 42 |
} else {
|
| 43 |
- appArmorProfile = defaultApparmorProfile |
|
| 43 |
+ appArmorProfile = defaultAppArmorProfile |
|
| 44 | 44 |
} |
| 45 | 45 |
|
| 46 |
- if appArmorProfile == defaultApparmorProfile {
|
|
| 46 |
+ if appArmorProfile == defaultAppArmorProfile {
|
|
| 47 | 47 |
// Unattended upgrades and other fun services can unload AppArmor |
| 48 | 48 |
// profiles inadvertently. Since we cannot store our profile in |
| 49 | 49 |
// /etc/apparmor.d, nor can we practically add other ways of |
| ... | ... |
@@ -135,10 +135,10 @@ func WithApparmor(c *container.Container) coci.SpecOpts {
|
| 135 | 135 |
} else if c.HostConfig.Privileged {
|
| 136 | 136 |
appArmorProfile = unconfinedAppArmorProfile |
| 137 | 137 |
} else {
|
| 138 |
- appArmorProfile = defaultApparmorProfile |
|
| 138 |
+ appArmorProfile = defaultAppArmorProfile |
|
| 139 | 139 |
} |
| 140 | 140 |
|
| 141 |
- if appArmorProfile == defaultApparmorProfile {
|
|
| 141 |
+ if appArmorProfile == defaultAppArmorProfile {
|
|
| 142 | 142 |
// Unattended upgrades and other fun services can unload AppArmor |
| 143 | 143 |
// profiles inadvertently. Since we cannot store our profile in |
| 144 | 144 |
// /etc/apparmor.d, nor can we practically add other ways of |
| ... | ... |
@@ -397,9 +397,9 @@ const ( |
| 397 | 397 |
slavePropagationOption = "master:" |
| 398 | 398 |
) |
| 399 | 399 |
|
| 400 |
-// hasMountinfoOption checks if any of the passed any of the given option values |
|
| 400 |
+// hasMountInfoOption checks if any of the passed any of the given option values |
|
| 401 | 401 |
// are set in the passed in option string. |
| 402 |
-func hasMountinfoOption(opts string, vals ...string) bool {
|
|
| 402 |
+func hasMountInfoOption(opts string, vals ...string) bool {
|
|
| 403 | 403 |
for _, opt := range strings.Split(opts, " ") {
|
| 404 | 404 |
for _, val := range vals {
|
| 405 | 405 |
if strings.HasPrefix(opt, val) {
|
| ... | ... |
@@ -417,7 +417,7 @@ func ensureShared(path string) error {
|
| 417 | 417 |
return err |
| 418 | 418 |
} |
| 419 | 419 |
// Make sure source mount point is shared. |
| 420 |
- if !hasMountinfoOption(optionalOpts, sharedPropagationOption) {
|
|
| 420 |
+ if !hasMountInfoOption(optionalOpts, sharedPropagationOption) {
|
|
| 421 | 421 |
return errors.Errorf("path %s is mounted on %s but it is not a shared mount", path, sourceMount)
|
| 422 | 422 |
} |
| 423 | 423 |
return nil |
| ... | ... |
@@ -430,7 +430,7 @@ func ensureSharedOrSlave(path string) error {
|
| 430 | 430 |
return err |
| 431 | 431 |
} |
| 432 | 432 |
|
| 433 |
- if !hasMountinfoOption(optionalOpts, sharedPropagationOption, slavePropagationOption) {
|
|
| 433 |
+ if !hasMountInfoOption(optionalOpts, sharedPropagationOption, slavePropagationOption) {
|
|
| 434 | 434 |
return errors.Errorf("path %s is mounted on %s but it is not a shared or slave mount", path, sourceMount)
|
| 435 | 435 |
} |
| 436 | 436 |
return nil |
| ... | ... |
@@ -164,7 +164,7 @@ func (daemon *Daemon) containerStart(container *container.Container, checkpoint |
| 164 | 164 |
container.HasBeenManuallyStopped = false |
| 165 | 165 |
} |
| 166 | 166 |
|
| 167 |
- if err := daemon.saveApparmorConfig(container); err != nil {
|
|
| 167 |
+ if err := daemon.saveAppArmorConfig(container); err != nil {
|
|
| 168 | 168 |
return err |
| 169 | 169 |
} |
| 170 | 170 |
|