From 94f0b7548f466bc9b51a24eb6c4fed84dedaee30 Mon Sep 17 00:00:00 2001 From: Aleksa Sarai Date: Sun, 20 Mar 2016 19:01:49 +1100 Subject: [PATCH] profiles: apparmor: remove unused fields ExecPath isn't used by anything, and the signal apparmor rule isn't used because it refers to a peer that we don't ship. Signed-off-by: Aleksa Sarai Upstream-commit: 64fb664908f7d3368d1bbfd1efb56cd45e5ed7a3 Component: engine --- components/engine/profiles/apparmor/apparmor.go | 2 -- components/engine/profiles/apparmor/template.go | 4 ---- 2 files changed, 6 deletions(-) diff --git a/components/engine/profiles/apparmor/apparmor.go b/components/engine/profiles/apparmor/apparmor.go index bbcf06e505..a18d0c5f2d 100644 --- a/components/engine/profiles/apparmor/apparmor.go +++ b/components/engine/profiles/apparmor/apparmor.go @@ -24,8 +24,6 @@ var ( type profileData struct { // Name is profile name. Name string - // ExecPath is the path to the docker binary. - ExecPath string // Imports defines the apparmor functions to import, before defining the profile. Imports []string // InnerImports defines the apparmor functions to import in the profile. diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go index db867b9def..ada33bf0f1 100644 --- a/components/engine/profiles/apparmor/template.go +++ b/components/engine/profiles/apparmor/template.go @@ -42,9 +42,5 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) { # suppress ptrace denials when using 'docker ps' or using 'ps' inside a container ptrace (trace,read) peer=docker-default, {{end}} -{{if ge .Version 209000}} - # docker daemon confinement requires explict allow rule for signal - signal (receive) set=(kill,term) peer={{.ExecPath}}, -{{end}} } `