From bfb4ea1b1b2452bb3ddc8183b35dec4914bb5128 Mon Sep 17 00:00:00 2001 From: Sascha Grunert Date: Sun, 16 Aug 2020 14:28:50 +0200 Subject: [PATCH] Remove check for apparmor_parser in apparmor.IsEnabled() The `apparmor_parser` binary is not really required for a system to run AppArmor from a runc perspective. How to apply the profile is more in the responsibility of higher level runtimes like Podman and Docker, which may do the binary check on their own. Signed-off-by: Sascha Grunert --- libcontainer/apparmor/apparmor.go | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/libcontainer/apparmor/apparmor.go b/libcontainer/apparmor/apparmor.go index debfc1e48..a12caaec1 100644 --- a/libcontainer/apparmor/apparmor.go +++ b/libcontainer/apparmor/apparmor.go @@ -3,6 +3,7 @@ package apparmor import ( + "bytes" "fmt" "io/ioutil" "os" @@ -12,11 +13,9 @@ import ( // IsEnabled returns true if apparmor is enabled for the host. func IsEnabled() bool { - if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil && os.Getenv("container") == "" { - if _, err = os.Stat("/sbin/apparmor_parser"); err == nil { - buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled") - return err == nil && len(buf) > 1 && buf[0] == 'Y' - } + if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil { + buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled") + return err == nil && bytes.HasPrefix(buf, []byte("Y")) } return false }