Function CanApplyExistingProfile

pkg/apparmorutil/apparmorutil_linux.go:91–97

CanApplyExistingProfile returns whether the current process can apply an existing AppArmor profile to processes. CanApplyExistingProfile does NOT need root. CanApplyExistingProfile checks /sys/module/apparmor/parameters/enabled ,but does NOT check /sys/kernel/security/apparmor , which might not be

()

//
// Related: https://gitlab.com/apparmor/apparmor/-/blob/v3.0.3/libraries/libapparmor/src/kernel.c#L311
func CanApplyExistingProfile() bool {
	paramEnabledOnce.Do(func() {
		buf, err := filesystem.ReadFile("/sys/module/apparmor/parameters/enabled")
		paramEnabled = err == nil && len(buf) == 2 && string(buf) == "Y\n"
	})
	return paramEnabled
}

// CanApplySpecificExistingProfile attempts to run `aa-exec -p <NAME> -- true` to check whether
// the profile can be applied.