From 2ae07a45d61f0692f3c26eb6329ce9f1449953ee Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Thu, 23 Apr 2026 11:13:27 -0700 Subject: [PATCH] libct/apparmor: simplify isEnabled 1. Use sync.OnceValue. 2. Fix the len(buf) check -- we only need 1 byte. Real kernel output is "Y\n" so practically this change is a no-op. Signed-off-by: Kir Kolyshkin --- libcontainer/apparmor/apparmor_linux.go | 21 +++++++-------------- 1 file changed, 7 insertions(+), 14 deletions(-) diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go index 9bb4fb2cd..f7870d217 100644 --- a/libcontainer/apparmor/apparmor_linux.go +++ b/libcontainer/apparmor/apparmor_linux.go @@ -11,21 +11,14 @@ import ( "github.com/opencontainers/runc/internal/pathrs" ) -var ( - appArmorEnabled bool - checkAppArmor sync.Once -) - // isEnabled returns true if apparmor is enabled for the host. -func isEnabled() bool { - checkAppArmor.Do(func() { - if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil { - buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled") - appArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y' - } - }) - return appArmorEnabled -} +var isEnabled = sync.OnceValue(func() bool { + if _, err := os.Stat("/sys/kernel/security/apparmor"); err != nil { + return false + } + buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled") + return err == nil && len(buf) > 0 && buf[0] == 'Y' +}) func setProcAttr(attr, value string) error { attr = pathrs.LexicallyCleanPath(attr)