Skip to content
This repository was archived by the owner on Mar 9, 2022. It is now read-only.

Fix apparmor for privileged.#1240

Merged
Random-Liu merged 1 commit intocontainerd:masterfrom
Random-Liu:fix-apparmor-privileged
Aug 20, 2019
Merged

Fix apparmor for privileged.#1240
Random-Liu merged 1 commit intocontainerd:masterfrom
Random-Liu:fix-apparmor-privileged

Conversation

@Random-Liu
Copy link
Member

Fixes #1239.

@mikebrow Do you remember why we didn't clear apparmor when privileged = true before?
I don't remember we intentionally did that.

Signed-off-by: Lantao Liu lantaol@google.com

Signed-off-by: Lantao Liu <lantaol@google.com>
@Random-Liu Random-Liu force-pushed the fix-apparmor-privileged branch from ea1748c to 10acd8e Compare August 19, 2019 23:28
@Random-Liu Random-Liu changed the title Fix apparmor and selinux label for privileged. Fix apparmor for privileged. Aug 19, 2019
@Random-Liu
Copy link
Member Author

Updated the behavior based on Kubernetes documentation https://kubernetes.io/docs/tutorials/clusters/apparmor/#profile-reference

For Docker, this resolves to the docker-default profile for non-privileged containers, and unconfined (no profile) for privileged containers.

Copy link
Member

@mikebrow mikebrow left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/LGTM
seems odd to ask for the default profile and privileged, and expect the default to not be used but ok, I suppose it does make sense if the default is "unconfined" for privileged :)

@Random-Liu Random-Liu merged commit eed3956 into containerd:master Aug 20, 2019
@Random-Liu Random-Liu deleted the fix-apparmor-privileged branch August 20, 2019 17:13
Random-Liu added a commit that referenced this pull request Aug 20, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Runtime default AppArmor profile gets applied to privileged containers

3 participants