From 438e1227121e9d4bbca7b12b6e1b715524d512c2 Mon Sep 17 00:00:00 2001
From: Dmitry Vyukov <dvyukov@google.com>
Date: Sun, 5 Jan 2020 17:48:19 +0100
Subject: pkg/host: fix detection of enabled LSMs

securityfs may not be mounted, but it does not mean that no LSMs are enabled.
---
 pkg/host/syscalls_linux.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

(limited to 'pkg/host/syscalls_linux.go')

diff --git a/pkg/host/syscalls_linux.go b/pkg/host/syscalls_linux.go
index 99f413981..7a8765868 100644
--- a/pkg/host/syscalls_linux.go
+++ b/pkg/host/syscalls_linux.go
@@ -263,7 +263,11 @@ func isSupportedLSM(c *prog.Syscall) string {
 	lsmOnce.Do(func() {
 		data, err := ioutil.ReadFile("/sys/kernel/security/lsm")
 		if err != nil {
-			lsmError = err
+			// securityfs may not be mounted, but it does not mean
+			// that no LSMs are enabled.
+			if !os.IsNotExist(err) {
+				lsmError = err
+			}
 			return
 		}
 		lsmDisabled = make(map[string]bool)
-- 
cgit mrf-deployment