Function loadData

contrib/apparmor/template.go:117–156

(name string)

}

func loadData(name string) (*data, error) {
	p := data{
		Name: name,
	}

	const abi = "abi/3.0"
	if macroExists(abi) {
		p.Abi = abi
	}

	if macroExists("tunables/global") {
		p.Imports = append(p.Imports, "#include <tunables/global>")
	} else {
		p.Imports = append(p.Imports, "@{PROC}=/proc/")
	}
	if macroExists("abstractions/base") {
		p.InnerImports = append(p.InnerImports, "#include <abstractions/base>")
	}

	// Figure out the daemon profile.
	currentProfile, err := os.ReadFile("/proc/self/attr/current")
	if err != nil {
		// If we couldn't get the daemon profile, assume we are running
		// unconfined which is generally the default.
		currentProfile = nil
	}
	p.DaemonProfile = cleanProfileName(string(currentProfile))

	// If we were running in Rootless mode, we could read `/proc/$(cat ${ROOTLESSKIT_STATE_DIR}/child_pid)/exe`,
	// but `nerdctl apparmor load` has to be executed as the root.
	// So, do not check ${ROOTLESSKIT_STATE_DIR} (nor EUID) here.
	p.RootlessKit, err = exec.LookPath("rootlesskit")
	if err != nil {
		log.L.WithError(err).Debug("apparmor: failed to determine the RootlessKit binary path")
		p.RootlessKit = ""
	}
	log.L.Debugf("apparmor: RootlessKit=%q", p.RootlessKit)

	return &p, nil
}

func generate(p *data, o io.Writer) error {
	t, err := template.New("apparmor_profile").Parse(defaultTemplate)