starred/cli
1
0
Fork 0
mirror of https://github.com/docker/cli.git synced 2026-09-28 02:06:53 -04:00
Code Issues Packages Projects Releases Wiki Activity

apparmor: make pkg/aaparser work on read-only root

Browse Source 
This is necessary because normally `apparmor_parser -r` will try to
create a temporary directory on the host (which is not allowed if the
host has a rootfs). However, the -K option bypasses saving things to the
cache (which avoids this issue).

  % apparmor_parser -r /tmp/docker-profile
  mkstemp: Read-only file system
  % apparmor_parser -Kr /tmp/docker-profile
  %

In addition, add extra information to the ensureDefaultAppArmorProfile
errors so that problems like this are easier to debug.

Fixes: 2f7596aaef3a ("apparmor: do not save profile to /etc/apparmor.d")
Signed-off-by: Aleksa Sarai <asarai@suse.de>
Upstream-commit: dd340c52cb37d29d8bae687fdc60e039341b4295
Component: engine
This commit is contained in:
Aleksa Sarai
2017-05-18 00:05:13 +10:00
parent f81cca9824
commit e7e4e93352
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/daemon/apparmor_default.go
+1 -1
View File
@@ -28,7 +28,7 @@ func ensureDefaultAppArmorProfile() error {
// Load the profile.
if err := aaprofile.InstallDefault(defaultApparmorProfile); err != nil {
return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", defaultApparmorProfile)
return fmt.Errorf("AppArmor enabled on system but the %s profile could not be loaded: %s", defaultApparmorProfile, err)
}
}