** Description changed: lxc.conf currently does the container autostarts before it loads the - apparmor profiles. That is wrong. + apparmor profiles. That is wrong. Those must be reversed. - Perhaps the container autostart should be done from start and not pre- - start? But at least those must be reversed. + ========================== + SRU Justification + 1. Impact: auto-start containers could be started without apparmor enforcement + 2. Development fix: start auto-start containers after apparmor policy loads + 3. Stable fix: same as development fix + 4. Test case: + Delay /etc/init.d/apparmor (add a sleep 10 to its start section), and create an auto-start container. Reboot the system. Check /proc/pid/attr/current for the container init - if broken, it will be unconfined rather than lxc-container-default + 5. Regression potential: none. + ==========================
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/989853 Title: autostart containers must be started after apparmor profiles are loaded To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/989853/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
