Documentation
¶
Overview ¶
Package apparmor contains primitives for working with apparmor.
References:
- http://wiki.apparmor.net/index.php/Kernel_interfaces
- http://apparmor.wiki.kernel.org/
- http://manpages.ubuntu.com/manpages/xenial/en/man7/apparmor.7.html
Package apparmor implements integration between snappy and ubuntu-core-launcher around apparmor.
Snappy creates apparmor profiles for each application (for each snap) present in the system. Upon each execution of ubuntu-core-launcher application process is launched under the profile. Prior to that the profile must be parsed, compiled and loaded into the kernel using the support tool "apparmor_parser".
Each apparmor profile contains a simple <header><content><footer> structure. The header specifies the profile name that the launcher will use to launch a process under this profile. Snappy uses "abstract identifiers" as profile names.
The actual profiles are stored in /var/lib/snappy/apparmor/profiles.
NOTE: A systemd job (apparmor.service) loads all snappy-specific apparmor profiles into the kernel during the boot process.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func LoadProfile ¶
LoadProfile loads an apparmor profile from the given file.
If no such profile was previously loaded then it is simply added to the kernel. If there was a profile with the same name before, that profile is replaced.
func LoadedProfiles ¶
LoadedProfiles interrogates the kernel and returns a list of loaded apparmor profiles.
Snappy manages apparmor profiles named "snap.*". Other profiles might exist on the system (via snappy dimension) and those are filtered-out.
func UnloadProfile ¶
UnloadProfile removes the named profile from the running kernel.
The operation is done with: apparmor_parser --remove $name The binary cache file is removed from /var/cache/apparmor
Types ¶
type Backend ¶
type Backend struct{}
Backend is responsible for maintaining apparmor profiles for ubuntu-core-launcher.
func (*Backend) Setup ¶
func (b *Backend) Setup(snapInfo *snap.Info, devMode bool, repo *interfaces.Repository) error
Setup creates and loads apparmor profiles specific to a given snap. The snap can be in developer mode to make security violations non-fatal to the offending application process.
This method should be called after changing plug, slots, connections between them or application present in the snap.
Source Files