Merge pull request #684 from q384566678/add-apparmorProfile-test

Add apparmor profile test

Author: Zhou Hao

cmd/runtimetest/main.go

@@ -1197,6 +1197,18 @@ func (c *complianceTester) validatePosixMounts(spec *rspec.Spec) error {
 	return mountErrs
 }
 
+func (c *complianceTester) validateApparmorProfile(spec *rspec.Spec) error {
+	if spec.Process == nil || spec.Process.ApparmorProfile == "" {
+		c.harness.Skip(1, "process.ApparmorProfile not set")
+		return nil
+	}
+	profilePath := filepath.Join(spec.Root.Path, "/etc/apparmor.d", spec.Process.ApparmorProfile)
+	_, err := os.Stat(profilePath)
+	c.harness.Ok(err != nil, "has expected apparmorProfile")
+
+	return nil
+}
+
 func (c *complianceTester) validateMountLabel(spec *rspec.Spec) error {
 	if spec.Linux == nil || spec.Linux.MountLabel == "" {
 		c.harness.Skip(1, "linux.mountlabel not set")
@@ -1279,6 +1291,7 @@ func run(context *cli.Context) error {
 		c.validateUIDMappings,
 		c.validateGIDMappings,
 		c.validateMountLabel,
+		c.validateApparmorProfile,
 	}
 
 	validations := defaultValidations

validation/linux_process_apparmor_profile/linux_process_apparmor_profile.go

@@ -0,0 +1,17 @@
+package main
+
+import (
+	"github.com/opencontainers/runtime-tools/validation/util"
+)
+
+func main() {
+	g, err := util.GetDefaultGenerator()
+	if err != nil {
+		util.Fatal(err)
+	}
+	g.SetProcessApparmorProfile("acme_secure_profile")
+	err = util.RuntimeInsideValidate(g, nil, nil)
+	if err != nil {
+		util.Fatal(err)
+	}
+}