github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-22 11:21:47 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #115749 from freddie400/removegetAppArmorFS

Browse Source 
removed function getAppArmorFS
This commit is contained in:
Kubernetes Prow Robot 2023-02-23 00:31:34 -08:00 committed by GitHub
commit fc8b5668f5
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
pkg/security/apparmor/validate.go
View File

@ -17,11 +17,8 @@ limitations under the License.
package apparmor
import (
"bufio"
"errors"
"fmt"
"os"
"path"
"strings"
"github.com/opencontainers/runc/libcontainer/apparmor"
@ -30,7 +27,6 @@ import (
podutil "k8s.io/kubernetes/pkg/api/v1/pod"
"k8s.io/kubernetes/pkg/apis/core/validation"
"k8s.io/kubernetes/pkg/features"
utilpath "k8s.io/utils/path"
)
// Whether AppArmor should be disabled by default.
@ -48,20 +44,11 @@ func NewValidator() Validator {
if err := validateHost(); err != nil {
return &validator{validateHostErr: err}
}
appArmorFS, err := getAppArmorFS()
if err != nil {
return &validator{
validateHostErr: fmt.Errorf("error finding AppArmor FS: %v", err),
}
}
return &validator{
appArmorFS: appArmorFS,
}
return &validator{}
}
type validator struct {
validateHostErr error
appArmorFS string
}
func (v *validator) Validate(pod *v1.Pod) error {
@ -117,36 +104,3 @@ func validateHost() error {
return nil
}
func getAppArmorFS() (string, error) {
mountsFile, err := os.Open("/proc/mounts")
if err != nil {
return "", fmt.Errorf("could not open /proc/mounts: %v", err)
}
defer mountsFile.Close()
scanner := bufio.NewScanner(mountsFile)
for scanner.Scan() {
fields := strings.Fields(scanner.Text())
if len(fields) < 3 {
// Unknown line format; skip it.
continue
}
if fields[2] == "securityfs" {
appArmorFS := path.Join(fields[1], "apparmor")
if ok, err := utilpath.Exists(utilpath.CheckFollowSymlink, appArmorFS); !ok {
msg := fmt.Sprintf("path %s does not exist", appArmorFS)
if err != nil {
return "", fmt.Errorf("%s: %v", msg, err)
}
return "", errors.New(msg)
}
return appArmorFS, nil
}
}
if err := scanner.Err(); err != nil {
return "", fmt.Errorf("error scanning mounts: %v", err)
}
return "", errors.New("securityfs not found")
}

23
pkg/security/apparmor/validate_test.go
View File

@ -27,25 +27,6 @@ import (
"github.com/stretchr/testify/assert"
)
func TestGetAppArmorFS(t *testing.T) {
// This test only passes on systems running AppArmor with the default configuration.
// The test should be manually run if modifying the getAppArmorFS function.
t.Skip()
const expectedPath = "/sys/kernel/security/apparmor"
actualPath, err := getAppArmorFS()
assert.NoError(t, err)
assert.Equal(t, expectedPath, actualPath)
}
func TestValidateHost(t *testing.T) {
// This test only passes on systems running AppArmor with the default configuration.
// The test should be manually run if modifying the getAppArmorFS function.
t.Skip()
assert.NoError(t, validateHost())
}
func TestValidateBadHost(t *testing.T) {
hostErr := errors.New("expected host error")
v := &validator{
@ -72,9 +53,7 @@ func TestValidateBadHost(t *testing.T) {
}
func TestValidateValidHost(t *testing.T) {
v := &validator{
appArmorFS: "./testdata/",
}
v := &validator{}
tests := []struct {
profile string