apparmor: Implement ApplyProfileThread()

We need to implement ApplyProfileThread() to apply a profile
via /proc/self-thread/attr/exec rather than /proc/self/attr/exec
otherwise we get (~50%) failures trying to write the profile
to /proc/self/attr/exec. When using self-thread we get 100% success.

Signed-off-by: Stefan Berger <[email protected]>

Author: stefanberger

libcontainer/apparmor/apparmor.go

@@ -21,10 +21,15 @@ func IsEnabled() bool {
 	return false
 }
 
-func setProcAttr(attr, value string) error {
+func setProcAttr(attr, value string, useThread bool) error {
 	// Under AppArmor you can only change your own attr, so use /proc/self/
 	// instead of /proc/<tid>/ like libapparmor does
-	path := fmt.Sprintf("/proc/self/attr/%s", attr)
+	var path string
+	if useThread {
+		path = fmt.Sprintf("/proc/thread-self/attr/%s", attr)
+	} else {
+		path = fmt.Sprintf("/proc/self/attr/%s", attr)
+	}
 
 	f, err := os.OpenFile(path, os.O_WRONLY, 0)
 	if err != nil {
@@ -41,20 +46,29 @@ func setProcAttr(attr, value string) error {
 }
 
 // changeOnExec reimplements aa_change_onexec from libapparmor in Go
-func changeOnExec(name string) error {
+func changeOnExec(name string, useThread bool) error {
 	value := "exec " + name
-	if err := setProcAttr("exec", value); err != nil {
+	if err := setProcAttr("exec", value, useThread); err != nil {
 		return fmt.Errorf("apparmor failed to apply profile: %s", err)
 	}
 	return nil
 }
 
+// ApplyProfileThread will apply the profile with the specified name to the process
+// after the next exec using /proc/self-thread rather than /proc/self
+func ApplyProfileThread(name string) error {
+	if name == "" {
+		return nil
+	}
+	return changeOnExec(name, true)
+}
+
 // ApplyProfile will apply the profile with the specified name to the process after
 // the next exec.
 func ApplyProfile(name string) error {
 	if name == "" {
 		return nil
 	}
 
-	return changeOnExec(name)
+	return changeOnExec(name, false)
 }

libcontainer/apparmor/apparmor_disabled.go

@@ -12,6 +12,13 @@ func IsEnabled() bool {
 	return false
 }
 
+func ApplyProfileThread(name string) error {
+	if name != "" {
+		return ErrApparmorNotEnabled
+	}
+	return nil
+}
+
 func ApplyProfile(name string) error {
 	if name != "" {
 		return ErrApparmorNotEnabled