From d359ab9e02d86d2d13955e5be0bcf58ebf0e2682 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?ROBERTO=20=20MU=C3=91OZ?=
 <roberto.munoz.fernandez.contractor@bbva.com>
Date: Mon, 19 Dec 2016 13:22:45 +0100
Subject: [PATCH] Added an apparmorEnabled boolean in the Daemon struct to
 indicate if AppArmor is enabled or not. It is set in NewDaemon using sysInfo
 information.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Roberto Muñoz Fernández <robertomf@gmail.com>

Added an apparmorEnabled boolean in the Daemon struct to indicate if AppArmor is enabled or not. It is set in NewDaemon using sysInfo information.

Signed-off-by: Roberto Muñoz Fernández <robertomf@gmail.com>

gofmt'd

Signed-off-by: Roberto Muñoz Fernández <robertomf@gmail.com>

change the function name to something more adequate and changed the behaviour to show empty value on an apparmor disabled system.

Signed-off-by: Roberto Muñoz Fernández <robertomf@gmail.com>

go fmt

Signed-off-by: Roberto Muñoz Fernández <robertomf@gmail.com>
Upstream-commit: d97a00dfd5ec884a98e087b1fc6e705459ca81e9
Component: engine
---
 components/engine/daemon/container_linux.go   | 29 +++++++++++++++++++
 components/engine/daemon/container_windows.go | 11 +++++++
 components/engine/daemon/daemon.go            |  2 ++
 components/engine/daemon/start.go             |  4 +++
 4 files changed, 46 insertions(+)
 create mode 100644 components/engine/daemon/container_linux.go
 create mode 100644 components/engine/daemon/container_windows.go

diff --git a/components/engine/daemon/container_linux.go b/components/engine/daemon/container_linux.go
new file mode 100644
index 0000000000..2c8771575a
--- /dev/null
+++ b/components/engine/daemon/container_linux.go
@@ -0,0 +1,29 @@
+//+build !windows
+
+package daemon
+
+import (
+	"github.com/docker/docker/container"
+)
+
+func (daemon *Daemon) saveApparmorConfig(container *container.Container) error {
+	container.AppArmorProfile = "" //we don't care about the previous value.
+
+	if !daemon.apparmorEnabled {
+		return nil // if apparmor is disabled there is nothing to do here.
+	}
+
+	if err := parseSecurityOpt(container, container.HostConfig); err != nil {
+		return err
+	}
+
+	if !container.HostConfig.Privileged {
+		if container.AppArmorProfile == "" {
+			container.AppArmorProfile = defaultApparmorProfile
+		}
+
+	} else {
+		container.AppArmorProfile = "unconfined"
+	}
+	return nil
+}
diff --git a/components/engine/daemon/container_windows.go b/components/engine/daemon/container_windows.go
new file mode 100644
index 0000000000..6fdd1e678e
--- /dev/null
+++ b/components/engine/daemon/container_windows.go
@@ -0,0 +1,11 @@
+//+build windows
+
+package daemon
+
+import (
+	"github.com/docker/docker/container"
+)
+
+func (daemon *Daemon) saveApparmorConfig(container *container.Container) error {
+	return nil
+}
diff --git a/components/engine/daemon/daemon.go b/components/engine/daemon/daemon.go
index 5266c5af13..5e310f321c 100644
--- a/components/engine/daemon/daemon.go
+++ b/components/engine/daemon/daemon.go
@@ -92,6 +92,7 @@ type Daemon struct {
 	discoveryWatcher          discoveryReloader
 	root                      string
 	seccompEnabled            bool
+	apparmorEnabled           bool
 	shutdown                  bool
 	uidMaps                   []idtools.IDMap
 	gidMaps                   []idtools.IDMap
@@ -683,6 +684,7 @@ func NewDaemon(config *Config, registryService registry.Service, containerdRemot
 	d.uidMaps = uidMaps
 	d.gidMaps = gidMaps
 	d.seccompEnabled = sysInfo.Seccomp
+	d.apparmorEnabled = sysInfo.AppArmor
 
 	d.nameIndex = registrar.NewRegistrar()
 	d.linkIndex = newLinkIndex()
diff --git a/components/engine/daemon/start.go b/components/engine/daemon/start.go
index 6c94fd5482..cc9d614fb7 100644
--- a/components/engine/daemon/start.go
+++ b/components/engine/daemon/start.go
@@ -164,6 +164,10 @@ func (daemon *Daemon) containerStart(container *container.Container, checkpoint
 		checkpointDir = container.CheckpointDir()
 	}
 
+	if daemon.saveApparmorConfig(container); err != nil {
+		return err
+	}
+
 	if err := daemon.containerd.Create(container.ID, checkpoint, checkpointDir, *spec, container.InitializeStdio, createOptions...); err != nil {
 		errDesc := grpc.ErrorDesc(err)
 		contains := func(s1, s2 string) bool {