apparmor: respect "unconfined" setting
The "unconfined" profile must be treated specially to turn off apparmor
confinement and to avoid applying any other profile.
Closes:
Approved by: mheon
@@ -231,7 +231,7 @@ func parseSecurityOpt(config *cc.CreateConfig, securityOpts []string) error {
logrus.Infof("Sucessfully loaded AppAmor profile '%s'", profile)
config.ApparmorProfile = profile
}
- } else if config.ApparmorProfile != "" {
+ } else if config.ApparmorProfile != "" && config.ApparmorProfile != "unconfined" {
if !apparmor.IsEnabled() {
return fmt.Errorf("profile specified but AppArmor is disabled on the host")
}
