--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: trixie
User: [email protected]
Usertags: pu
X-Debbugs-Cc: [email protected], [email protected]
Control: affects -1 + src:lxc
[ Reason ]
Two issues have been found that would be good to get fixed in trixie:
* Fix a memory cleanup issue that can occasionally cause containers
to fail to start.
* Adjust apparmor profile generation when nesting is enabled. This is
needed by newer versions of runc (ie, Docker) that have the fix for
CVE-2025-52881 applied. Without it, attempting to start nested
containers within the lxc container will fail. (Reported as bug
#1146472.)
[ Impact ]
LXC in trixie currently suffers from two issues that have been fixed
upstream.
[ Tests ]
None -- the memory fix is trivial, and the apparmor profile update has
been in upstream lxc releases since the 6.0.6 release.
[ Risks ]
Minor/none -- two targeted fixes cherry-picked from the upstream git
repo.
[ Checklist ]
[*] *all* changes are documented in the d/changelog
[*] I reviewed all changes and I approve them
[*] attach debdiff against the package in (old)stable
[*] the issue is verified as fixed in unstable
[ Changes ]
Two fixes as outlined above.
[ Other info ]
The source debdiff is attached.
diff --git a/debian/changelog b/debian/changelog
index 0557c23..d25b857 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,11 @@
+lxc (1:6.0.4-4+deb13u4) trixie; urgency=medium
+
+ * Cherry-pick fix to properly free libcap-allocated memory
+ * Cherry-pick fix for running nested containers using current versions of
+ runc (ie, Docker) (Closes: #1146472)
+
+ -- Mathias Gibbens <[email protected]> Wed, 02 Sep 2026 17:20:27 +0000
+
lxc (1:6.0.4-4+deb13u3) trixie; urgency=medium
* Cherry-pick upstream fix for CVE-2026-39402
diff --git a/debian/patches/0107-cherry-pick-fix-cap_to_text.patch b/debian/patches/0107-cherry-pick-fix-cap_to_text.patch
new file mode 100644
index 0000000..9145fd8
--- /dev/null
+++ b/debian/patches/0107-cherry-pick-fix-cap_to_text.patch
@@ -0,0 +1,31 @@
+From e4e1fa469228db6d54c4945bbcdbd5abe52bb1ca Mon Sep 17 00:00:00 2001
+From: Li Lu <[email protected]>
+Date: Tue, 19 May 2026 15:07:33 +0800
+Subject: [PATCH] lxc/caps: fix cap_to_text() memory cleanup
+
+Signed-off-by: DreamConnected <[email protected]>
+---
+ src/lxc/caps.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/src/lxc/caps.c b/src/lxc/caps.c
+index 206488ff43..f6c5770ed3 100644
+--- a/src/lxc/caps.c
++++ b/src/lxc/caps.c
+@@ -88,7 +88,7 @@ int lxc_caps_up(void)
+ int lxc_ambient_caps_up(void)
+ {
+ call_cleaner(cap_free) cap_t caps = NULL;
+- __do_free char *cap_names = NULL;
++ char *cap_names = NULL;
+ int ret;
+ cap_value_t cap;
+ cap_value_t last_cap = CAP_LAST_CAP;
+@@ -135,6 +135,7 @@ int lxc_ambient_caps_up(void)
+ return log_warn_errno(0, errno, "Failed to convert capabilities %d", cap);
+
+ TRACE("Raised %s in inheritable and ambient capability set", cap_names);
++ cap_free(cap_names);
+ return 0;
+ }
+
diff --git a/debian/patches/0108-cherry-pick-runc-nested-containers.patch b/debian/patches/0108-cherry-pick-runc-nested-containers.patch
new file mode 100644
index 0000000..120d412
--- /dev/null
+++ b/debian/patches/0108-cherry-pick-runc-nested-containers.patch
@@ -0,0 +1,69 @@
+From c21296262745c31760d5751fc219d627567a6139 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <[email protected]>
+Date: Thu, 13 Nov 2025 13:25:04 +0100
+Subject: [PATCH] apparmor: skip /proc and /sys restrictions if nesting is
+ enabled
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+If nesting is enabled, it's already possible to mount your own
+instance of both procfs and sysfs inside the container, so protecting
+the "original" ones at /proc and /sys makes no sense, but breaks
+certain nested container setups.
+
+See: https://github.com/lxc/incus/pull/2624/commits/1fbe4bffb9748cc3b07aaf5db310d463c1e827d0
+
+Signed-off-by: Fabian Grünbichler <[email protected]>
+Signed-off-by: Thomas Lamprecht <[email protected]>
+---
+ src/lxc/lsm/apparmor.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c
+index d6516ae9f5..9f31840ff7 100644
+--- a/src/lxc/lsm/apparmor.c
++++ b/src/lxc/lsm/apparmor.c
+@@ -170,6 +170,9 @@ static const char AA_PROFILE_BASE[] =
+ " mount options=(rw,move) /s[^y]*{,/**},\n"
+ " mount options=(rw,move) /sy[^s]*{,/**},\n"
+ " mount options=(rw,move) /sys?*{,/**},\n"
++"\n";
++
++static const char AA_PROFILE_BASE_NO_NESTING[] =
+ "\n"
+ " # generated by: lxc-generate-aa-rules.py container-rules.base\n"
+ " deny /proc/sys/[^kn]*{,/**} wklx,\n"
+@@ -755,6 +758,10 @@ static char *get_apparmor_profile_content(struct lsm_ops *ops, struct lxc_conf *
+ must_append_sized(&profile, &size, AA_PROFILE_BASE,
+ STRARRAYLEN(AA_PROFILE_BASE));
+
++ if (!conf->lsm_aa_allow_nesting)
++ must_append_sized(&profile, &size, AA_PROFILE_BASE_NO_NESTING,
++ STRARRAYLEN(AA_PROFILE_BASE_NO_NESTING));
++
+ append_all_remount_rules(&profile, &size);
+
+ if (ops->aa_supports_unix)
+@@ -768,8 +775,10 @@ static char *get_apparmor_profile_content(struct lsm_ops *ops, struct lxc_conf *
+ if (ops->aa_can_stack && !ops->aa_is_stacked) {
+ char *namespace, *temp;
+
+- must_append_sized(&profile, &size, AA_PROFILE_STACKING_BASE,
+- STRARRAYLEN(AA_PROFILE_STACKING_BASE));
++
++ if (!conf->lsm_aa_allow_nesting)
++ must_append_sized(&profile, &size, AA_PROFILE_STACKING_BASE,
++ STRARRAYLEN(AA_PROFILE_STACKING_BASE));
+
+ namespace = apparmor_namespace(conf->name, lxcpath);
+ temp = must_concat(NULL, " change_profile -> \":", namespace, ":*\",\n"
+@@ -779,7 +788,7 @@ static char *get_apparmor_profile_content(struct lsm_ops *ops, struct lxc_conf *
+
+ must_append_sized(&profile, &size, temp, strlen(temp));
+ free(temp);
+- } else {
++ } else if (!conf->lsm_aa_allow_nesting) {
+ must_append_sized(&profile, &size, AA_PROFILE_NO_STACKING,
+ STRARRAYLEN(AA_PROFILE_NO_STACKING));
+ }
diff --git a/debian/patches/series b/debian/patches/series
index 64eeac8..4a76fb0 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -9,3 +9,5 @@
0104-Add-lxc-net-as-dependency-in-sysvinit-script.patch
0105-cherry-pick-fix-heavy-io-pts.patch
0106-cherry-pick-CVE-2026-39402.patch
+0107-cherry-pick-fix-cap_to_text.patch
+0108-cherry-pick-runc-nested-containers.patch
signature.asc
Description: This is a digitally signed message part
--- End Message ---
