{"action":"created","comment":{"url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments/90889503","pull_request_review_id":11402826,"id":90889503,"diff_hunk":"@@ -0,0 +1,155 @@\n+#!/usr/bin/env bats\n+\n+load helpers\n+\n+function teardown() {\n+    cleanup_test\n+}\n+\n+# 1. test running with loading the default apparmor profile.\n+# test that we can run with the default apparomr profile which will not block touching a file in `.`\n+@test \"load default apparomr profile and run a container with it\" {\n+    # this test requires docker, thus it can't yet be run in a container\n+    if [ \"$TRAVIS\" = \"true\" ]; then # instead of $TRAVIS, add a function is_containerized to skip here\n+        skip \"cannot yet run this test in a container, use sudo make localintegration\"\n+    fi\n+\n+    # this test requires apparomr, so skip this test if apparomr is not enabled.\n+    enabled=is_apparmor_enabled\n+    if [[ \"$enabled\" =~ \"0\" ]]; then\n+        skip \"skip this test since apparomr is not enabled.\"\n+    fi\n+\n+    start_ocid\n+\n+    sed -e 's/%VALUE%/,\"container\\.apparmor\\.security\\.beta\\.kubernetes\\.io\\/testname1\": \"runtime\\/default\"/g' \"$TESTDATA\"/sandbox_config_seccomp.json > \"$TESTDIR\"/apparmor1.json\n+\n+    run ocic pod create --name apparmor1 --config \"$TESTDIR\"/apparmor1.json\n+    echo \"$output\"\n+    [ \"$status\" -eq 0 ]\n+    pod_id=\"$output\"\n+    run ocic ctr create --name testname1 --config \"$TESTDATA\"/container_redis.json --pod \"$pod_id\"\n+    echo \"$output\"\n+    [ \"$status\" -eq 0 ]\n+    ctr_id=\"$output\"\n+    [ \"$status\" -eq 0 ]\n+    run ocic ctr execsync --id \"$ctr_id\" touch test.txt\n+    echo \"$output\"\n+    [ \"$status\" -eq 0 ]\n+\n+\n+    cleanup_ctrs\n+    cleanup_pods\n+    stop_ocid\n+}\n+\n+# 2. test running with loading a specific apparmor profile as ocid default apparmor profile.\n+# test that we can run with a specific apparmor profile which will block touching a file in `.` as ocid default apparmor profile.\n+@test \"load a specific apparomr profile as default apparmor and run a container with it\" {\n+    # this test requires docker, thus it can't yet be run in a container\n+    if [ \"$TRAVIS\" = \"true\" ]; then # instead of $TRAVIS, add a function is_containerized to skip here\n+        skip \"cannot yet run this test in a container, use sudo make localintegration\"\n+    fi\n+\n+    # this test requires apparomr, so skip this test if apparomr is not enabled.\n+    enabled=is_apparmor_enabled\n+    if [[ \"$enabled\" =~ \"0\" ]]; then\n+        skip \"skip this test since apparomr is not enabled.\"\n+    fi\n+\n+    load_apparmor_test_profile\n+    start_ocid \"\" \"$APPARMOR_TEST_PROFILE_NAME\"\n+\n+    sed -e 's/%VALUE%/,\"container\\.apparmor\\.security\\.beta\\.kubernetes\\.io\\/testname2\": \"apparmor-test-deny-write\"/g' \"$TESTDATA\"/sandbox_config_seccomp.json > \"$TESTDIR\"/apparmor2.json\n+\n+    run ocic pod create --name apparmor2 --config \"$TESTDIR\"/apparmor2.json\n+    echo \"$output\"\n+    [ \"$status\" -eq 0 ]\n+    pod_id=\"$output\"\n+    run ocic ctr create --name testname2 --config \"$TESTDATA\"/container_redis.json --pod \"$pod_id\"\n+    echo \"$output\"\n+    [ \"$status\" -eq 0 ]\n+    ctr_id=\"$output\"\n+    [ \"$status\" -eq 0 ]\n+    run ocic ctr execsync --id \"$ctr_id\" touch test.txt\n+    echo \"$output\"\n+    [ \"$status\" -ne 0 ]\n+    [[ \"$output\" =~ \"Permission denied\" ]]\n+\n+    cleanup_ctrs\n+    cleanup_pods\n+    stop_ocid\n+    remove_apparmor_test_profile\n+}\n+\n+# 3. test running with loading a specific apparmor profile but not as ocid default apparmor profile.\n+# test that we can run with a specific apparmor profile which will block touching a file in `.`\n+@test \"load default apparomr profile and run a container with another apparmor profile\" {\n+    # this test requires docker, thus it can't yet be run in a container\n+    if [ \"$TRAVIS\" = \"true\" ]; then # instead of $TRAVIS, add a function is_containerized to skip here\n+        skip \"cannot yet run this test in a container, use sudo make localintegration\"\n+    fi\n+\n+    # this test requires apparomr, so skip this test if apparomr is not enabled.\n+    enabled=is_apparmor_enabled\n+    if [[ \"$enabled\" =~ \"0\" ]]; then\n+        skip \"skip this test since apparomr is not enabled.\"","path":"test/apparmor.bats","position":20,"original_position":96,"commit_id":"f45e1708913e83b29f2958fd33b78682eaa3d7ba","original_commit_id":"f45e1708913e83b29f2958fd33b78682eaa3d7ba","user":{"login":"mrunalp","id":53798,"avatar_url":"https://avatars.githubusercontent.com/u/53798?v=3","gravatar_id":"","url":"https://api.github.com/users/mrunalp","html_url":"https://github.com/mrunalp","followers_url":"https://api.github.com/users/mrunalp/followers","following_url":"https://api.github.com/users/mrunalp/following{/other_user}","gists_url":"https://api.github.com/users/mrunalp/gists{/gist_id}","starred_url":"https://api.github.com/users/mrunalp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mrunalp/subscriptions","organizations_url":"https://api.github.com/users/mrunalp/orgs","repos_url":"https://api.github.com/users/mrunalp/repos","events_url":"https://api.github.com/users/mrunalp/events{/privacy}","received_events_url":"https://api.github.com/users/mrunalp/received_events","type":"User","site_admin":false},"body":"typo: apparomr -> apparmor","created_at":"2016-12-05T15:40:28Z","updated_at":"2016-12-05T15:40:28Z","html_url":"https://github.com/kubernetes-incubator/cri-o/pull/215#discussion_r90889503","pull_request_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215","_links":{"self":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments/90889503"},"html":{"href":"https://github.com/kubernetes-incubator/cri-o/pull/215#discussion_r90889503"},"pull_request":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215"}}},"pull_request":{"url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215","id":95178837,"html_url":"https://github.com/kubernetes-incubator/cri-o/pull/215","diff_url":"https://github.com/kubernetes-incubator/cri-o/pull/215.diff","patch_url":"https://github.com/kubernetes-incubator/cri-o/pull/215.patch","issue_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/215","number":215,"state":"open","locked":false,"title":"support apparmor","user":{"login":"xlgao-zju","id":1636894,"avatar_url":"https://avatars.githubusercontent.com/u/1636894?v=3","gravatar_id":"","url":"https://api.github.com/users/xlgao-zju","html_url":"https://github.com/xlgao-zju","followers_url":"https://api.github.com/users/xlgao-zju/followers","following_url":"https://api.github.com/users/xlgao-zju/following{/other_user}","gists_url":"https://api.github.com/users/xlgao-zju/gists{/gist_id}","starred_url":"https://api.github.com/users/xlgao-zju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xlgao-zju/subscriptions","organizations_url":"https://api.github.com/users/xlgao-zju/orgs","repos_url":"https://api.github.com/users/xlgao-zju/repos","events_url":"https://api.github.com/users/xlgao-zju/events{/privacy}","received_events_url":"https://api.github.com/users/xlgao-zju/received_events","type":"User","site_admin":false},"body":"- [x] Set apparmor profile which is set by k8s, when we create container.\r\n- [x] Add default apparmor profile, and load this profile when we start ocid.\r\n- [x] Make the profile configurable, add a flag like `--apparmor-profile`.\r\n- [x] Add docs about apparmor profile setting.\r\n- [x] Add tests for this pr.\r\n\r\nclose #201\r\n\r\ncc @feiskyer @mrunalp @runcom \r\nSigned-off-by: Xianglin Gao <xlgao@zju.edu.cn>","created_at":"2016-11-24T13:30:10Z","updated_at":"2016-12-05T15:40:28Z","closed_at":null,"merged_at":null,"merge_commit_sha":"65aaacbba8fdfaa204774f3040ee5cc95c906459","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215/commits","review_comments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215/comments","review_comment_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments{/number}","comments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/215/comments","statuses_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/statuses/f45e1708913e83b29f2958fd33b78682eaa3d7ba","head":{"label":"xlgao-zju:support-apparmor","ref":"support-apparmor","sha":"f45e1708913e83b29f2958fd33b78682eaa3d7ba","user":{"login":"xlgao-zju","id":1636894,"avatar_url":"https://avatars.githubusercontent.com/u/1636894?v=3","gravatar_id":"","url":"https://api.github.com/users/xlgao-zju","html_url":"https://github.com/xlgao-zju","followers_url":"https://api.github.com/users/xlgao-zju/followers","following_url":"https://api.github.com/users/xlgao-zju/following{/other_user}","gists_url":"https://api.github.com/users/xlgao-zju/gists{/gist_id}","starred_url":"https://api.github.com/users/xlgao-zju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xlgao-zju/subscriptions","organizations_url":"https://api.github.com/users/xlgao-zju/orgs","repos_url":"https://api.github.com/users/xlgao-zju/repos","events_url":"https://api.github.com/users/xlgao-zju/events{/privacy}","received_events_url":"https://api.github.com/users/xlgao-zju/received_events","type":"User","site_admin":false},"repo":{"id":70563825,"name":"cri-o","full_name":"xlgao-zju/cri-o","owner":{"login":"xlgao-zju","id":1636894,"avatar_url":"https://avatars.githubusercontent.com/u/1636894?v=3","gravatar_id":"","url":"https://api.github.com/users/xlgao-zju","html_url":"https://github.com/xlgao-zju","followers_url":"https://api.github.com/users/xlgao-zju/followers","following_url":"https://api.github.com/users/xlgao-zju/following{/other_user}","gists_url":"https://api.github.com/users/xlgao-zju/gists{/gist_id}","starred_url":"https://api.github.com/users/xlgao-zju/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/xlgao-zju/subscriptions","organizations_url":"https://api.github.com/users/xlgao-zju/orgs","repos_url":"https://api.github.com/users/xlgao-zju/repos","events_url":"https://api.github.com/users/xlgao-zju/events{/privacy}","received_events_url":"https://api.github.com/users/xlgao-zju/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/xlgao-zju/cri-o","description":"Open Container Initiative-based implementation of Kubernetes Container Runtime Interface","fork":true,"url":"https://api.github.com/repos/xlgao-zju/cri-o","forks_url":"https://api.github.com/repos/xlgao-zju/cri-o/forks","keys_url":"https://api.github.com/repos/xlgao-zju/cri-o/keys{/key_id}","collaborators_url":"https://api.github.com/repos/xlgao-zju/cri-o/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/xlgao-zju/cri-o/teams","hooks_url":"https://api.github.com/repos/xlgao-zju/cri-o/hooks","issue_events_url":"https://api.github.com/repos/xlgao-zju/cri-o/issues/events{/number}","events_url":"https://api.github.com/repos/xlgao-zju/cri-o/events","assignees_url":"https://api.github.com/repos/xlgao-zju/cri-o/assignees{/user}","branches_url":"https://api.github.com/repos/xlgao-zju/cri-o/branches{/branch}","tags_url":"https://api.github.com/repos/xlgao-zju/cri-o/tags","blobs_url":"https://api.github.com/repos/xlgao-zju/cri-o/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/xlgao-zju/cri-o/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/xlgao-zju/cri-o/git/refs{/sha}","trees_url":"https://api.github.com/repos/xlgao-zju/cri-o/git/trees{/sha}","statuses_url":"https://api.github.com/repos/xlgao-zju/cri-o/statuses/{sha}","languages_url":"https://api.github.com/repos/xlgao-zju/cri-o/languages","stargazers_url":"https://api.github.com/repos/xlgao-zju/cri-o/stargazers","contributors_url":"https://api.github.com/repos/xlgao-zju/cri-o/contributors","subscribers_url":"https://api.github.com/repos/xlgao-zju/cri-o/subscribers","subscription_url":"https://api.github.com/repos/xlgao-zju/cri-o/subscription","commits_url":"https://api.github.com/repos/xlgao-zju/cri-o/commits{/sha}","git_commits_url":"https://api.github.com/repos/xlgao-zju/cri-o/git/commits{/sha}","comments_url":"https://api.github.com/repos/xlgao-zju/cri-o/comments{/number}","issue_comment_url":"https://api.github.com/repos/xlgao-zju/cri-o/issues/comments{/number}","contents_url":"https://api.github.com/repos/xlgao-zju/cri-o/contents/{+path}","compare_url":"https://api.github.com/repos/xlgao-zju/cri-o/compare/{base}...{head}","merges_url":"https://api.github.com/repos/xlgao-zju/cri-o/merges","archive_url":"https://api.github.com/repos/xlgao-zju/cri-o/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/xlgao-zju/cri-o/downloads","issues_url":"https://api.github.com/repos/xlgao-zju/cri-o/issues{/number}","pulls_url":"https://api.github.com/repos/xlgao-zju/cri-o/pulls{/number}","milestones_url":"https://api.github.com/repos/xlgao-zju/cri-o/milestones{/number}","notifications_url":"https://api.github.com/repos/xlgao-zju/cri-o/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/xlgao-zju/cri-o/labels{/name}","releases_url":"https://api.github.com/repos/xlgao-zju/cri-o/releases{/id}","deployments_url":"https://api.github.com/repos/xlgao-zju/cri-o/deployments","created_at":"2016-10-11T06:39:08Z","updated_at":"2016-10-11T06:39:08Z","pushed_at":"2016-12-05T11:05:13Z","git_url":"git://github.com/xlgao-zju/cri-o.git","ssh_url":"git@github.com:xlgao-zju/cri-o.git","clone_url":"https://github.com/xlgao-zju/cri-o.git","svn_url":"https://github.com/xlgao-zju/cri-o","homepage":"","size":2834,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"kubernetes-incubator:master","ref":"master","sha":"6983ae628becc9ea5cecc62e9f7f1856dfe9e9b1","user":{"login":"kubernetes-incubator","id":20862812,"avatar_url":"https://avatars.githubusercontent.com/u/20862812?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes-incubator","html_url":"https://github.com/kubernetes-incubator","followers_url":"https://api.github.com/users/kubernetes-incubator/followers","following_url":"https://api.github.com/users/kubernetes-incubator/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes-incubator/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes-incubator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes-incubator/subscriptions","organizations_url":"https://api.github.com/users/kubernetes-incubator/orgs","repos_url":"https://api.github.com/users/kubernetes-incubator/repos","events_url":"https://api.github.com/users/kubernetes-incubator/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes-incubator/received_events","type":"Organization","site_admin":false},"repo":{"id":67828134,"name":"cri-o","full_name":"kubernetes-incubator/cri-o","owner":{"login":"kubernetes-incubator","id":20862812,"avatar_url":"https://avatars.githubusercontent.com/u/20862812?v=3","gravatar_id":"","url":"https://api.github.com/users/kubernetes-incubator","html_url":"https://github.com/kubernetes-incubator","followers_url":"https://api.github.com/users/kubernetes-incubator/followers","following_url":"https://api.github.com/users/kubernetes-incubator/following{/other_user}","gists_url":"https://api.github.com/users/kubernetes-incubator/gists{/gist_id}","starred_url":"https://api.github.com/users/kubernetes-incubator/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kubernetes-incubator/subscriptions","organizations_url":"https://api.github.com/users/kubernetes-incubator/orgs","repos_url":"https://api.github.com/users/kubernetes-incubator/repos","events_url":"https://api.github.com/users/kubernetes-incubator/events{/privacy}","received_events_url":"https://api.github.com/users/kubernetes-incubator/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kubernetes-incubator/cri-o","description":"Open Container Initiative-based implementation of Kubernetes Container Runtime Interface","fork":false,"url":"https://api.github.com/repos/kubernetes-incubator/cri-o","forks_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/forks","keys_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/teams","hooks_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/hooks","issue_events_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/events{/number}","events_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/events","assignees_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/assignees{/user}","branches_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/branches{/branch}","tags_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/tags","blobs_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/refs{/sha}","trees_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/statuses/{sha}","languages_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/languages","stargazers_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/stargazers","contributors_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/contributors","subscribers_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/subscribers","subscription_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/subscription","commits_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/commits{/sha}","git_commits_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/git/commits{/sha}","comments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/comments{/number}","issue_comment_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/comments{/number}","contents_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/contents/{+path}","compare_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/merges","archive_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/downloads","issues_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues{/number}","pulls_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls{/number}","milestones_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/milestones{/number}","notifications_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/labels{/name}","releases_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/releases{/id}","deployments_url":"https://api.github.com/repos/kubernetes-incubator/cri-o/deployments","created_at":"2016-09-09T19:56:31Z","updated_at":"2016-12-04T14:40:28Z","pushed_at":"2016-12-05T11:05:13Z","git_url":"git://github.com/kubernetes-incubator/cri-o.git","ssh_url":"git@github.com:kubernetes-incubator/cri-o.git","clone_url":"https://github.com/kubernetes-incubator/cri-o.git","svn_url":"https://github.com/kubernetes-incubator/cri-o","homepage":"","size":3284,"stargazers_count":293,"watchers_count":293,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":40,"mirror_url":null,"open_issues_count":39,"forks":40,"open_issues":39,"watchers":293,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215"},"html":{"href":"https://github.com/kubernetes-incubator/cri-o/pull/215"},"issue":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/215"},"comments":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/issues/215/comments"},"review_comments":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215/comments"},"review_comment":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/pulls/215/commits"},"statuses":{"href":"https://api.github.com/repos/kubernetes-incubator/cri-o/statuses/f45e1708913e83b29f2958fd33b78682eaa3d7ba"}}}}
{"actor":{"display_login":"mrunalp"}}