Description
I would like to be able to see the plaintext contents of the AppArmor profile "docker-default", for debugging/audit purposes.

This bug/feature-request is related to #24786 (fix implemented in #26518), and to a lesser extent #26823, #25935 (claimed to be fixed in #27083, however in my 17.04 install 'docker-inspect' still doesn't show the new behavior)

Prior to Docker 1.13, it stored the AppArmor Profile in /etc/apparmor.d/docker-default (which was overwritten when Docker started, so users couldn't modify it. Docker devs added the --security-opt to let users specify a profile. After v1.13, Docker now generates docker-default in tmpfs, uses apparmor_parser to load it into kernel, then deletes the file. All of the AppArmor utils (aa-* on Ubuntu) expect a file parameter, and /sys/kernel/security/apparmor/policy/profiles/* only has cached binaries.

In discussion of #24786, @cyphar mentions this being opaque, and I agree.

Steps to reproduce the issue:

1. docker run a container (without --privileged)
2. aa-status to confirm "docker-default" profile is being enforced
3. try to find what "docker-default" profile actually is, and the Policy/Policies being enforced

Describe the results you received:
failed to find information in step 3.

Describe the results you expected:
expected to find exactly what is being enforced. (without reading the source code and running a Go template parser)

Additional information you deem important (e.g. issue happens only occasionally):
This came up as I was trying to debug a Docker container (Rails application based on phusion/passenger-ruby) because kern.log/syslog had excessive AppArmor DENIED ptrace for a 'ps', which according to Docker documentation should be allowed in the default profile.

I apologize in advance, if there is already some way to get this info. (I'm new to Docker and AppArmor, but old to Linux/Solaris/AIX/BSD/etc)

Possible solution/suggestions:

• restore /etc/apparmor.d/default-docker, and only change it during install time (dpkg and rpm can handle this, or check differences as part of your auto-setup script). If the user/admin changes that file, then load their modified file instead of overwriting it. (If someone has /etc/ mounted read-only, they should be expected to remount rw during install/update of software.)
• instead of 'tmpfs', store the docker-default file somewhere under /var/run/docker/ (and don't delete it while the containers are running). Then docker inspect and aa-status can reference the path to the profile, which can easily be seen by those who care.
• I could submit a feature request to the AppArmor folks requesting a config-file directive for their parser, such that it always caches the plaintext versions of all profiles.

Output of docker version:

Client:
 Version:      17.04.0-ce
 API version:  1.28
 Go version:   go1.7.5
 Git commit:   4845c56
 Built:        Mon Apr  3 18:07:42 2017
 OS/Arch:      linux/amd64

Server:
 Version:      17.04.0-ce
 API version:  1.28 (minimum version 1.12)
 Go version:   go1.7.5
 Git commit:   4845c56
 Built:        Mon Apr  3 18:07:42 2017
 OS/Arch:      linux/amd64
 Experimental: false

Output of docker info:

Containers: 3
 Running: 3
 Paused: 0
 Stopped: 0
Images: 47
Server Version: 17.04.0-ce
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 71
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary:
containerd version: 422e31ce907fd9c3833a38d7b8fdd023e5a76e73
runc version: 9c2d8d184e5da67c95d601382adf14862e4f2228
init version: 949e6fa
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.4.0-75-generic
Operating System: Ubuntu 16.04.2 LTS
OSType: linux
Architecture: x86_64
CPUs: 2
Total Memory: 3.859GiB
Name: [redacted]
ID: M2RC:GOLE:6JNO:CRMB:XEO7:FBBN:PNYC:BEUQ:PZUH:L7FN:SZI6:4JPR
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Http Proxy: [redacted]
Registry: https://index.docker.io/v1/
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

WARNING: No swap limit support

Additional environment details (AWS, VirtualBox, physical, etc.):
VM/Instance on OpenStack (13.1)