Function Profiles

pkg/apparmorutil/apparmorutil_linux.go:128–155

Profiles return profiles. Profiles does not need the root but needs access to /sys/kernel/security/apparmor/policy/profiles, which might not be accessible from user namespaces (because securityfs cannot be mounted in a user namespace) So, Profiles cannot be called from rootless child.

()

//
// So, Profiles cannot be called from rootless child.
func Profiles() ([]Profile, error) {
	const profilesPath = "/sys/kernel/security/apparmor/policy/profiles"
	ents, err := os.ReadDir(profilesPath)
	if err != nil {
		return nil, err
	}
	res := make([]Profile, len(ents))
	for i, ent := range ents {
		namePath := filepath.Join(profilesPath, ent.Name(), "name")
		b, err := filesystem.ReadFile(namePath)
		if err != nil {
			log.L.WithError(err).Warnf("failed to read %q", namePath)
			continue
		}
		profile := Profile{
			Name: strings.TrimSpace(string(b)),
		}
		modePath := filepath.Join(profilesPath, ent.Name(), "mode")
		b, err = os.ReadFile(modePath)
		if err != nil {
			log.L.WithError(err).Warnf("failed to read %q", namePath)
		} else {
			profile.Mode = strings.TrimSpace(string(b))
		}
		res[i] = profile
	}
	return res, nil
}

// Unload unloads a profile. Needs access to /sys/kernel/security/apparmor/.remove .
func Unload(target string) error {