libcontainer/apparmor: split api (exported) from implementation

This prevents having to maintain GoDoc for the stub implementations,
and makes sure that the "stub" implementations have the same signature
as the "non-stub" versions.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

libcontainer/apparmor/apparmor.go

@@ -0,0 +1,16 @@
+package apparmor
+
+import "errors"
+
+var (
+	// IsEnabled returns true if apparmor is enabled for the host.
+	IsEnabled = isEnabled
+
+	// ApplyProfile will apply the profile with the specified name to the process after
+	// the next exec. It is only supported on Linux and produces an ErrApparmorNotEnabled
+	// on other platforms.
+	ApplyProfile = applyProfile
+
+	// ErrApparmorNotEnabled indicates that AppArmor is not enabled or not supported.
+	ErrApparmorNotEnabled = errors.New("apparmor: config provided but apparmor not supported")
+)

libcontainer/apparmor/apparmor_linux.go

@@ -15,8 +15,8 @@ var (
 	checkAppArmor   sync.Once
 )
 
-// IsEnabled returns true if apparmor is enabled for the host.
+// isEnabled returns true if apparmor is enabled for the host.
-func IsEnabled() bool {
+func isEnabled() bool {
 	checkAppArmor.Do(func() {
 		if _, err := os.Stat("/sys/kernel/security/apparmor"); err == nil {
 			buf, err := ioutil.ReadFile("/sys/module/apparmor/parameters/enabled")
@@ -57,9 +57,10 @@ func changeOnExec(name string) error {
 	return nil
 }
 
-// ApplyProfile will apply the profile with the specified name to the process after
+// applyProfile will apply the profile with the specified name to the process after
-// the next exec.
+// the next exec. It is only supported on Linux and produces an error on other
-func ApplyProfile(name string) error {
+// platforms.
+func applyProfile(name string) error {
 	if name == "" {
 		return nil
 	}

libcontainer/apparmor/apparmor_unsupported.go

@@ -2,17 +2,11 @@
 
 package apparmor
 
-import (
+func isEnabled() bool {
-	"errors"
-)
-
-var ErrApparmorNotEnabled = errors.New("apparmor: config provided but apparmor not supported")
-
-func IsEnabled() bool {
 	return false
 }
 
-func ApplyProfile(name string) error {
+func applyProfile(name string) error {
 	if name != "" {
 		return ErrApparmorNotEnabled
 	}