From f3f563bc0f70963411b1bd797a664544351c3a96 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Wed, 10 Feb 2021 16:22:16 +0900
Subject: [PATCH] apparmor: try attr/apparmor/exec before attr/exec

Fix issue 2801

Tested on Arch Linux with the following configuration
```
[root@archlinux ~]# pacman -Q runc containerd docker linux
runc 1.0.0rc93-1
containerd 1.4.3-1
docker 1:20.10.3-1
linux 5.10.14.arch1-1

[root@archlinux ~]# cat /proc/cmdline
BOOT_IMAGE=/boot/vmlinuz-linux root=UUID=bd8aaf58-8735-4fd5-a0c1-804a998f8d57 rw net.ifnames=0 rootflags=compress-force=zstd apparmor=1 lsm=capability,lockdown,yama,bpf,apparmor

[root@archlinux ~]# cat /etc/docker/daemon.json
{
  "runtimes": {
    "runc-tmp": {
      "path": "/tmp/runc"
    }
  }
}

[root@archlinux ~]# docker run -it --rm alpine
docker: Error response from daemon: OCI runtime create failed: container_linux.go:367: starting container process caused: process_linux.go:495: container init caused: apply apparmor profile: apparmor failed to apply profile: write /proc/self/attr/exec: invalid argument: unknown.

[root@archlinux ~]# docker run -it --rm --runtime=runc-tmp alpine
/ # cat /proc/self/attr/apparmor/current
docker-default (enforce)
/ # cat /proc/self/attr/current
cat: read error: Invalid argument
``

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 libcontainer/apparmor/apparmor_linux.go | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go
index 73965f12d..65e7c1d55 100644
--- a/libcontainer/apparmor/apparmor_linux.go
+++ b/libcontainer/apparmor/apparmor_linux.go
@@ -2,6 +2,7 @@ package apparmor
 
 import (
 	"bytes"
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -21,7 +22,13 @@ func IsEnabled() bool {
 func setProcAttr(attr, value string) error {
 	// Under AppArmor you can only change your own attr, so use /proc/self/
 	// instead of /proc/<tid>/ like libapparmor does
-	f, err := os.OpenFile("/proc/self/attr/"+attr, os.O_WRONLY, 0)
+	attrPath := "/proc/self/attr/apparmor/" + attr
+	if _, err := os.Stat(attrPath); errors.Is(err, os.ErrNotExist) {
+		// fall back to the old convention
+		attrPath = "/proc/self/attr/" + attr
+	}
+
+	f, err := os.OpenFile(attrPath, os.O_WRONLY, 0)
 	if err != nil {
 		return err
 	}