apparmor: Implement ApplyProfileTid()

We need to implement ApplyProfileTid() to apply a profile
via /proc/<tid>/attr/exec rather than /proc/self/attr/exec
otherwise we get (~50%) failures trying to write the profile
to /proc/self/attr/exec when trying to apply a profile to swtpm.
When using the tid in the proc file path we get 100% success.

Signed-off-by: Stefan Berger <[email protected]>

Author: stefanberger

libcontainer/apparmor/apparmor.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io/ioutil"
 	"os"
+	"syscall"
 
 	"github.com/opencontainers/runc/libcontainer/utils"
 )
@@ -21,10 +22,15 @@ func IsEnabled() bool {
 	return false
 }
 
-func setProcAttr(attr, value string) error {
+func setProcAttr(attr, value string, useTid bool) error {
 	// Under AppArmor you can only change your own attr, so use /proc/self/
 	// instead of /proc/<tid>/ like libapparmor does
-	path := fmt.Sprintf("/proc/self/attr/%s", attr)
+	var path string
+	if useTid {
+		path = fmt.Sprintf("/proc/%d/attr/%s",syscall.Gettid(), attr)
+	} else {
+		path = fmt.Sprintf("/proc/self/attr/%s", attr)
+	}
 
 	f, err := os.OpenFile(path, os.O_WRONLY, 0)
 	if err != nil {
@@ -41,20 +47,30 @@ func setProcAttr(attr, value string) error {
 }
 
 // changeOnExec reimplements aa_change_onexec from libapparmor in Go
-func changeOnExec(name string) error {
+func changeOnExec(name string, useTid bool) error {
 	value := "exec " + name
-	if err := setProcAttr("exec", value); err != nil {
+	if err := setProcAttr("exec", value, useTid); err != nil {
 		return fmt.Errorf("apparmor failed to apply profile: %s", err)
 	}
 	return nil
 }
 
+// ApplyProfileTid will apply the profile with the specified name to the process
+// after the next exec. It will use the thread id of the process to apply
+// the profile
+func ApplyProfileTid(name string) error {
+	if name == "" {
+		return nil
+	}
+	return changeOnExec(name, true)
+}
+
 // ApplyProfile will apply the profile with the specified name to the process after
 // the next exec.
 func ApplyProfile(name string) error {
 	if name == "" {
 		return nil
 	}
 
-	return changeOnExec(name)
+	return changeOnExec(name, false)
 }