apparmor cleanup

3 files changed, 5 insertions, 14 deletions

diff --git a/src/firejail/firejail.h b/src/firejail/firejail.h
index f8a23678a..96e3f735e 100644
--- a/src/firejail/firejail.h
+++ b/src/firejail/firejail.h
@@ -385,7 +385,6 @@ char *guess_shell(void);
 #define SANDBOX_DONE '1'
 int sandbox(void* sandbox_arg);
 void start_application(int no_sandbox, int fd, char *set_sandbox_status) __attribute__((noreturn));
-void set_apparmor(void);
 
 // network_main.c
 void net_configure_sandbox_ip(Bridge *br);
diff --git a/src/firejail/join.c b/src/firejail/join.c
index ec9c922ef..4e636ca27 100644
--- a/src/firejail/join.c
+++ b/src/firejail/join.c
@@ -33,10 +33,6 @@
 #define PR_SET_NO_NEW_PRIVS 38
 #endif
 
-#ifdef HAVE_APPARMOR
-#include <sys/apparmor.h>
-#endif
-
 static int apply_caps = 0;
 static uint64_t caps = 0;
 static unsigned display = 0;
@@ -513,10 +509,6 @@ void join(pid_t pid, int argc, char **argv, int index) {
                 // kill the child in case the parent died
                 prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
 
-#ifdef HAVE_APPARMOR
-                set_apparmor();
-#endif
-
                 extract_command(argc, argv, index);
                 if (cfg.command_line == NULL)
                         cfg.window_title = cfg.usershell;
diff --git a/src/firejail/sandbox.c b/src/firejail/sandbox.c
index e8c4a445a..e72b03e15 100644
--- a/src/firejail/sandbox.c
+++ b/src/firejail/sandbox.c
@@ -128,7 +128,7 @@ static void set_caps(void) {
 }
 
 #ifdef HAVE_APPARMOR
-void set_apparmor(void) {
+static void set_apparmor(void) {
         EUID_ASSERT();
         if (checkcfg(CFG_APPARMOR) && arg_apparmor) {
                 if (aa_change_onexec("firejail-default")) {
@@ -486,6 +486,9 @@ static void close_file_descriptors(void) {
 
 void start_application(int no_sandbox, int fd, char *set_sandbox_status) {
         if (no_sandbox == 0) {
+#ifdef HAVE_APPARMOR
+                set_apparmor();
+#endif
                 close_file_descriptors();
 
                 // set nice and rlimits
@@ -1299,10 +1302,7 @@ int sandbox(void* sandbox_arg) {
                 errExit("fork");
 
         if (app_pid == 0) {
-#ifdef HAVE_APPARMOR
-                set_apparmor();
-#endif
-                start_application(0, -1, set_sandbox_status);
+                start_application(0, -1, set_sandbox_status);   // this function does not return
         }
 
         munmap(set_sandbox_status, 1);