Valentin Rothberg edb285d176 apparmor: apply default profile at container initialization ...

Apply the default AppArmor profile at container initialization to cover
all possible code paths (i.e., podman-{start,run}) before executing the
runtime.  This allows moving most of the logic into pkg/apparmor.

Also make the loading and application of the default AppArmor profile
versio-indepenent by checking for the `libpod-default-` prefix and
over-writing the profile in the run-time spec if needed.

The intitial run-time spec of the container differs a bit from the
applied one when having started the container, which results in
displaying a potentially outdated AppArmor profile when inspecting
a container.  To fix that, load the container config from the file
system if present and use it to display the data.

Fixes: #2107
Signed-off-by: Valentin Rothberg <rothberg@redhat.com>

2019-01-09 22:18:11 +01:00

..

config_linux.go

Fix handling of symbolic links

2018-12-28 13:10:15 -05:00

config_unsupported.go

spec: Make addPrivilegedDevices and createBlockIO per-platform

2018-07-06 00:48:40 +00:00

createconfig.go

add container-init support

2019-01-04 11:42:03 +01:00

parse.go

Invalid index for array

2018-12-21 09:25:25 -05:00

ports.go

Spell check strings and comments

2018-05-25 08:45:15 +00:00

spec_test.go

Swap default mount propagation from private to rprivate

2018-09-13 21:35:44 +00:00

spec.go

apparmor: apply default profile at container initialization

2019-01-09 22:18:11 +01:00