Repository navigation
internal/server/util: Recognize named unconfined AppArmor profiles - #3977
Conversation
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestAppArmorProfileName(t *testing.T) { |
| return "" | ||
| } | ||
|
|
||
| func appArmorProfileName(profile string) string { |
There was a problem hiding this comment.
move into the existing function
Signed-off-by: Simon Zhou <jp.zdm2008@gmail.com>
a51ac34 to
de73cd6
Compare
|
Moved the label handling into the existing |
|
The Could you rerun the failed job when convenient? The rerun API requires upstream repository admin rights, which my account does not have. Failed job: https://github.com/lxc/incus/actions/runs/34797365780/job/103832961518 |
/proc/self/attr/currentcan contain a named profile in unconfined mode, such asrunc (unconfined). Comparing that string with justunconfinedmakes Incus incorrectly treat its daemon as already confined and disable its own AppArmor profile handling.Normalize labels ending in
(unconfined)inside the existingAppArmorProfilefunction. Keep enforced, complain and mixed labels unchanged.Runtime validation on Linux 7.0.0-28 with AppArmor parser 4.0.1 and runc 1.3.4 covered named unconfined and enforced profiles. Kernel stacking with
aa-execreports(unconfined)for two unconfined profiles and(mixed)when one profile is enforced; the latter remains confined after this change.Validation:
go test -v ./...andmake static-analysis. The separate helper and added unit test were removed following review.