func (pl *ProfileLoader) CommitSecurityProfile(profile *ProfileMetadata, container *ContainerMetadata) error {
	// Decide if the profile should be inserted in the kernel
	var currentProfile *ProfileMetadata
	var ok, newVersion bool
	if container.ProfileVersion.IsEmpty() {
		currentProfile, ok = pl.LoadedProfiles[profile.ProfileVersion]
	} else {
		currentProfile, ok = pl.LoadedProfiles[container.ProfileVersion]
	}
	newVersion = ok && profile.ProfileVersion != container.ProfileVersion && !container.ProfileVersion.IsEmpty()
	if !ok || newVersion {
		if err := pl.InsertSecurityProfile(profile.Profile); err != nil {
			return errors.Wrap(err, "couldn't insert security profile in kernel")
		}
	}
	// Swap netns / pidns / process mappings
	if err := pl.SwapProfileMappings(profile, container); err != nil {
		return errors.Wrap(err, "couldn't update profile mappings")
	}
	if newVersion {
		// Delete old profile
		if err := pl.DeleteSecurityProfile(currentProfile.Profile); err != nil {
			return errors.Wrap(err, "couldn't delete security profile from the kernel")
		}
		// Remove container from the list of handled containers
		currentProfile.RemoveContainerID(container.ContainerID)
		// Check if the current profile should be delete entirely
		if len(currentProfile.ContainerIDs) <= 0 {
			delete(pl.LoadedProfiles, container.ProfileVersion)
		}
	}
	// Update container metadata
	container.ProfileVersion = profile.ProfileVersion
	// Update profile metadata
	profile.AddContainerID(container.ContainerID)
	return nil
}
// CommitSecurityProfile - Ensures that the provided profile is the one used by the provided container
// When necessary, will either update and / or delete the profile currently in use once the commit is done.
Ensures that the provided profile is the one used by the provided container
When necessary, will either update and / or delete the profile currently in use once the commit is done.
// CommitSecurityProfile - Ensures that the provided profile is the one used by the provided container // When necessary will either update and / or delete the profile currently in use once the commit is done .
func (pl *ProfileLoader) CommitSecurityProfile(profile *ProfileMetadata, container *ContainerMetadata) error {
	var currentProfile *ProfileMetadata
	var ok, newVersion bool
	if container.ProfileVersion.IsEmpty() {
		currentProfile, ok = pl.LoadedProfiles[profile.ProfileVersion]
	} else {
		currentProfile, ok = pl.LoadedProfiles[container.ProfileVersion]
	}
	newVersion = ok && profile.ProfileVersion != container.ProfileVersion && !container.ProfileVersion.IsEmpty()
	if !ok || newVersion {
		if err := pl.InsertSecurityProfile(profile.Profile); err != nil {
			return errors.Wrap(err, "couldn't insert security profile in kernel")
		}
	}
	if err := pl.SwapProfileMappings(profile, container); err != nil {
		return errors.Wrap(err, "couldn't update profile mappings")
	}
	if newVersion {
		if err := pl.DeleteSecurityProfile(currentProfile.Profile); err != nil {
			return errors.Wrap(err, "couldn't delete security profile from the kernel")
		}
		currentProfile.RemoveContainerID(container.ContainerID)
		if len(currentProfile.ContainerIDs) <= 0 {
			delete(pl.LoadedProfiles, container.ProfileVersion)
		}
	}
	container.ProfileVersion = profile.ProfileVersion
	profile.AddContainerID(container.ContainerID)
	return nil
}
func ( pl * ProfileLoader ) CommitSecurityProfile ( profile * ProfileMetadata , container * ContainerMetadata ) error { var currentProfile * ProfileMetadata var ok , newVersion bool if container . ProfileVersion . IsEmpty ( ) { currentProfile , ok = pl . LoadedProfiles [ profile . ProfileVersion ] } else { currentProfile , ok = pl . LoadedProfiles [ container . ProfileVersion ] } newVersion = ok && profile . ProfileVersion != container . ProfileVersion && ! container . ProfileVersion . IsEmpty ( ) if ! ok || newVersion { if err := pl . InsertSecurityProfile ( profile . Profile ) ; err != nil { return errors . Wrap ( err , " " ) } } if err := pl . SwapProfileMappings ( profile , container ) ; err != nil { return errors . Wrap ( err , " " ) } if newVersion { if err := pl . DeleteSecurityProfile ( currentProfile . Profile ) ; err != nil { return errors . Wrap ( err , " " ) } currentProfile . RemoveContainerID ( container . ContainerID ) if len ( currentProfile . ContainerIDs ) <= 0 { delete ( pl . LoadedProfiles , container . ProfileVersion ) } } container . ProfileVersion = profile . ProfileVersion profile . AddContainerID ( container . ContainerID ) return nil }
Ensures that the provided profile is the one used by the provided container
When necessary, will either update and / or delete the profile currently in use once the commit is done.
Ensures that the provided profile is the one used by the provided container When necessary will either update and / or delete the profile currently in use once the commit is done .
// Decide if the profile should be inserted in the kernel // Swap netns / pidns / process mappings // Delete old profile // Remove container from the list of handled containers // Check if the current profile should be delete entirely // Update container metadata // Update profile metadata