Quoting Stéphane Graber ([email protected]): > On Thu, Jan 22, 2015 at 09:32:50PM +0000, Serge Hallyn wrote: > > Quoting Johannes Kastl ([email protected]): > > > -----BEGIN PGP SIGNED MESSAGE----- > > > Hash: SHA1 > > > > > > On 21.01.2015 Stéphane Graber wrote: > > > > > > > That means that from now on, we won't be taking new features and > > > > will instead work on fixing any remaining rough edges with 1.1. > > > > > > I just tested the packages from my repository on the openSUSE build > > > service, and I can't start any container on my openSUSE Tumbleweed host: > > > > > > > $ sudo lxc-start -n DEBIAN lxc-start: lxc_start.c: main: 345 The > > > > container failed to start. lxc-start: lxc_start.c: main: 347 To get > > > > more details, run the container in foreground mode. lxc-start: > > > > lxc_start.c: main: 349 Additional information can be obtained by > > > > setting the --logfile and --logpriority options. > > > > > > Apparently this is an issue with apparmor: > > > > lxc-start 1421956341.455 ERROR lxc_apparmor - > > > > lsm/apparmor.c:apparmor_process_label_set:171 - If you really want > > > > to start this container, set lxc-start 1421956341.455 ERROR > > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:172 - > > > > lxc.aa_allow_incomplete = 1 lxc-start 1421956341.455 ERROR > > > > lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:173 - in > > > > your container configuration file > > > > > > Adding lxc.aa_allow_incomplete = 1 allows me to start the container. > > > > > > How to solve this for the 1.1 release? I am not familiar with > > > apparmor, and I have no idea where the error is. Apparmor profile? lxc? > > > > Your kernel doesn't have the patches for apparmor mount restrictions. > > (You can verify this by looking for the file > > /sys/kernel/security/apparmor/features/mount/mask ) > > > > (The patches to provide that are not yet upstream, unfortunately, > > but hopefully that'll be fixed soon) > > > > The three possible workarounds are: > > > > 1. get the apparmor mount feature patchset into your kernel (probably > > not very feasible?) > > 2. run containers unconfined by default > > 3. add lxc.aa_allow_incomplete = 1 to /usr/share/lxc/config/common.conf > > or (perhaps better) a file under /usr/share/lxc/config/common.conf.d > > > > The lack of mount restrictions significantly weakens the security > > guarantees apparmor can provide, so unless you will default to > > unprivileged containers, (1) may be the hardest but would be the > > best solution. > > Or just comment those lines?
You mean the lines in src/lxc/lsm/apparmor.c? _______________________________________________ lxc-devel mailing list [email protected] http://lists.linuxcontainers.org/listinfo/lxc-devel
