Again, avila's kernel is pretty outdated, and its user namespace support is so poor that it's actually mis-behave on a certain security related operations.
In security/commoncap.c, function cap_prctl_drop, it should check `ns_capable(...)`, not just `capable(...)`. See https://github.com/lxc/lxd/issues/2039 . At lease commit 160da84 "userns: Allow PR_CAPBSET_DROP in a user namespace" has to be cherry- picked, but besides that, I also found a lot similar places to be fixed. ** Bug watch added: LXD bug tracker #2039 https://github.com/lxc/lxd/issues/2039 -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to lxc-android-config in Ubuntu. https://bugs.launchpad.net/bugs/1641549 Title: migrate lxc android container to lxd Status in Canonical System Image: New Status in lxc-android-config package in Ubuntu: New Bug description: Several things to do here: * include lxd, lxd-client in default installation, * writable path for lxd: lxd resides at /var/lib/lxd and it takes write permission to fully function, * migrate lxc tmpfs-based rootfs to lxd image, lxc configs to lxd profiles, etc., * migrate systemd service definitions, etc. To manage notifications about this bug go to: https://bugs.launchpad.net/canonical-devices-system-image/+bug/1641549/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : [email protected] Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
