diff --git a/components/engine/daemon/apparmor_default.go b/components/engine/daemon/apparmor_default.go index e4065b4ad9..790e14b656 100644 --- a/components/engine/daemon/apparmor_default.go +++ b/components/engine/daemon/apparmor_default.go @@ -21,7 +21,7 @@ func installDefaultAppArmorProfile() { // Allow daemon to run if loading failed, but are active // (possibly through another run, manually, or via system startup) for _, policy := range apparmorProfiles { - if err := aaprofile.IsLoaded(policy); err != nil { + if loaded, err := aaprofile.IsLoaded(policy); err != nil || !loaded { logrus.Errorf("AppArmor enabled on system but the %s profile could not be loaded.", policy) } } diff --git a/components/engine/profiles/apparmor/apparmor.go b/components/engine/profiles/apparmor/apparmor.go index 36eb10cdf9..449a8f159b 100644 --- a/components/engine/profiles/apparmor/apparmor.go +++ b/components/engine/profiles/apparmor/apparmor.go @@ -94,22 +94,28 @@ func InstallDefault(name string) error { return nil } -// IsLoaded checks if a passed profile has been loaded into the kernel. -func IsLoaded(name string) error { +// IsLoaded checks if a profile with the given name has been loaded into the +// kernel. +func IsLoaded(name string) (bool, error) { file, err := os.Open("/sys/kernel/security/apparmor/profiles") if err != nil { - return err + return false, err } defer file.Close() r := bufio.NewReader(file) for { p, err := r.ReadString('\n') + if err == io.EOF { + break + } if err != nil { - return err + return false, err } if strings.HasPrefix(p, name+" ") { - return nil + return true, nil } } + + return false, nil }