Apptainer ineffective application of selinux and apparmor --security options

@@ -2,7 +2,7 @@
 //   Apptainer a Series of LF Projects LLC.
 //   For website terms of use, trademark policy, privacy policy and other
 //   project policies see https://lfprojects.org/policies
-// Copyright (c) 2018-2020, Sylabs Inc. All rights reserved.
+// Copyright (c) 2018-2025, Sylabs Inc. All rights reserved.
 // This software is licensed under a 3-clause BSD license. Please consult the
 // LICENSE.md file distributed with the sources of this project regarding your
 // rights to use or distribute this software.
@@ -32,15 +32,15 @@ func Configure(config *specs.Spec) error {
 					return err
 				}
 			} else {
-				sylog.Warningf("selinux is not enabled or supported on this system")
+				return fmt.Errorf("selinux requested, but is not enabled or supported on this system")
 			}
 		} else if config.Process.ApparmorProfile != "" {
 			if apparmor.Enabled() {
 				if err := apparmor.LoadProfile(config.Process.ApparmorProfile); err != nil {
 					return err
 				}
 			} else {
-				sylog.Warningf("apparmor is not enabled or supported on this system")
+				return fmt.Errorf("apparmor requested, but is not enabled or supported on this system")
 			}
 		}
 	}
@@ -50,7 +50,7 @@ func Configure(config *specs.Spec) error {
 				return err
 			}
 		} else {
-			sylog.Warningf("seccomp requested but not enabled, seccomp library is missing or too old")
+			return fmt.Errorf("seccomp requested but not enabled, seccomp library is missing or too old")
 		}
 	}
 	return nil

@@ -2,22 +2,20 @@
 //   Apptainer a Series of LF Projects LLC.
 //   For website terms of use, trademark policy, privacy policy and other
 //   project policies see https://lfprojects.org/policies
-// Copyright (c) 2019, Sylabs Inc. All rights reserved.
+// Copyright (c) 2019-2025, Sylabs Inc. All rights reserved.
 // This software is licensed under a 3-clause BSD license. Please consult the
 // LICENSE.md file distributed with the sources of this project regarding your
 // rights to use or distribute this software.
 
 package security
 
 import (
-	"os"
 	"runtime"
 	"testing"
 
 	"github.com/apptainer/apptainer/internal/pkg/security/apparmor"
 	"github.com/apptainer/apptainer/internal/pkg/security/selinux"
 	"github.com/apptainer/apptainer/internal/pkg/test"
-	"github.com/apptainer/apptainer/internal/pkg/util/mainthread"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
@@ -93,6 +91,16 @@ func TestConfigure(t *testing.T) {
 			},
 			disabled: !selinux.Enabled(),
 		},
+		{
+			desc: "SELinux when not available",
+			spec: specs.Spec{
+				Process: &specs.Process{
+					SelinuxLabel: "unconfined_u:unconfined_r:unconfined_t:s0",
+				},
+			},
+			expectFailure: true,
+			disabled:      selinux.Enabled(),
+		},
 		{
 			desc: "with bad apparmor profile",
 			spec: specs.Spec{
@@ -112,6 +120,15 @@ func TestConfigure(t *testing.T) {
 			},
 			disabled: !apparmor.Enabled(),
 		},
+		{
+			desc: "apparmor when not available",
+			spec: specs.Spec{
+				Process: &specs.Process{
+					ApparmorProfile: "unconfined",
+				},
+			},
+			disabled: apparmor.Enabled(),
+		},
 	}
 
 	for _, s := range specs {
@@ -122,9 +139,9 @@ func TestConfigure(t *testing.T) {
 
 			var err error
 
-			mainthread.Execute(func() {
-				err = Configure(&s.spec) //nolint:gosec
-			})
+			runtime.LockOSThread()
+			defer runtime.UnlockOSThread()
+			err = Configure(&s.spec)
 
 			if err != nil && !s.expectFailure {
 				t.Errorf("unexpected failure %s: %s", s.desc, err)
@@ -134,18 +151,3 @@ func TestConfigure(t *testing.T) {
 		})
 	}
 }
-
-func init() {
-	runtime.LockOSThread()
-}
-
-func TestMain(m *testing.M) {
-	go func() {
-		os.Exit(m.Run())
-	}()
-
-	// run functions requiring execution in main thread
-	for f := range mainthread.FuncChannel {
-		f()
-	}
-}

@@ -2,7 +2,7 @@
 //   Apptainer a Series of LF Projects LLC.
 //   For website terms of use, trademark policy, privacy policy and other
 //   project policies see https://lfprojects.org/policies
-// Copyright (c) 2018-2022, Sylabs Inc. All rights reserved.
+// Copyright (c) 2018-2025, Sylabs Inc. All rights reserved.
 // This software is licensed under a 3-clause BSD license. Please consult the
 // LICENSE.md file distributed with the sources of this project regarding your
 // rights to use or distribute this software.
@@ -14,6 +14,10 @@ package apparmor
 import (
 	"fmt"
 	"os"
+
+	"github.com/cyphar/filepath-securejoin/pathrs-lite"
+	"github.com/cyphar/filepath-securejoin/pathrs-lite/procfs"
+	"golang.org/x/sys/unix"
 )
 
 // Enabled returns whether AppArmor is enabled.
@@ -27,7 +31,23 @@ func Enabled() bool {
 
 // LoadProfile loads the specified AppArmor profile.
 func LoadProfile(profile string) error {
-	f, err := os.OpenFile("/proc/self/attr/exec", os.O_WRONLY, 0)
+	// We must make sure we are actually opening and writing to a real attr/exec
+	// in a real procfs so that the profile takes effect. Using
+	// pathrs-lite/procfs as below accomplishes this.
+	proc, err := procfs.OpenProcRoot()
+	if err != nil {
+		return err
+	}
+	defer proc.Close()
+
+	attrExec, closer, err := proc.OpenThreadSelf("attr/exec")
+	if err != nil {
+		return err
+	}
+	defer closer()
+	defer attrExec.Close()
+
+	f, err := pathrs.Reopen(attrExec, unix.O_WRONLY|unix.O_CLOEXEC)
 	if err != nil {
 		return err
 	}