apparmor

Documentation

Index

• Constants
• type Config
  • func New() *Config
  • func (c *Config) Apply(p *runtimeapi.LinuxContainerSecurityContext) (string, error)
  • func (c *Config) IsEnabled() bool
  • func (c *Config) LoadProfile(profile string) error

Constants

const DefaultProfile = "crio-default"

DefaultProfile is the default profile name

Types

type Config

type Config struct {
	// contains filtered or unexported fields
}

Config is the global AppArmor configuration type

func New

func New() *Config

New creates a new default AppArmor configuration instance

func (*Config) Apply

func (c *Config) Apply(p *runtimeapi.LinuxContainerSecurityContext) (string, error)

Apply returns the trimmed AppArmor profile to be used and reloads if the default profile is specified. The AppArmor profile to the CRI via the deprecated apparmor_profile field in favor of the newer structured apparmor field. CRI provides the AppArmor profile via both fields to maintain backwards compatibility. ref https://github.com/kubernetes/kubernetes/pull/123811 Process new field and fallback to deprecated. From the kubernetes side both fields are populated. TODO: Clean off deprecated AppArmorProfile usage

func (*Config) IsEnabled

func (c *Config) IsEnabled() bool

IsEnabled returns true if AppArmor is enabled via the `apparmor` buildtag and globally by the system.

func (*Config) LoadProfile

func (c *Config) LoadProfile(profile string) error

LoadProfile can be used to load a AppArmor profile from the provided path. This method will not fail if AppArmor is disabled.