mirror/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2026-07-10 21:53:57 +08:00
Code Issues Packages Projects Releases Wiki Activity

libct/apparmor: simplify isEnabled

Browse Source 
1. Use sync.OnceValue.

2. Fix the len(buf) check -- we only need 1 byte. Real kernel output
   is "Y\n" so practically this change is a no-op.

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
This commit is contained in:
Kir Kolyshkin
2026-04-23 11:13:27 -07:00
parent 95998b8a7f
commit 2ae07a45d6
1 changed files with 7 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libcontainer/apparmor/apparmor_linux.go
+7 -14
View File
@@ -11,21 +11,14 @@ import (
"github.com/opencontainers/runc/internal/pathrs" "github.com/opencontainers/runc/internal/pathrs"
) )
var (
appArmorEnabled bool
checkAppArmor sync.Once
)
// isEnabled returns true if apparmor is enabled for the host. // isEnabled returns true if apparmor is enabled for the host.
func isEnabled() bool { var isEnabled = sync.OnceValue(func() bool {
checkAppArmor.Do(func() { if _, err := os.Stat("/sys/kernel/security/apparmor"); err != nil {
if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil { return false
buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled") }
appArmorEnabled = err == nil && len(buf) > 1 && buf[0] == 'Y' buf, err := os.ReadFile("/sys/module/apparmor/parameters/enabled")
} return err == nil && len(buf) > 0 && buf[0] == 'Y'
}) })
return appArmorEnabled
}
func setProcAttr(attr, value string) error { func setProcAttr(attr, value string) error {
attr = pathrs.LexicallyCleanPath(attr) attr = pathrs.LexicallyCleanPath(attr)