** Description changed: lxc.conf currently does the container autostarts before it loads the apparmor profiles. That is wrong. Those must be reversed. ========================== SRU Justification 1. Impact: auto-start containers could be started without apparmor enforcement 2. Development fix: start auto-start containers after apparmor policy loads 3. Stable fix: same as development fix 4. Test case: - Delay /etc/init.d/apparmor (add a sleep 10 to its start section), and create an auto-start container. Reboot the system. Check /proc/pid/attr/current for the container init - if broken, it will be unconfined rather than lxc-container-default + unload apparmor profiles (sudo /etc/init.d/apparmor stop; sudo /etc/init.d/apparmor teardown;), and create an auto-start container. stop and restart lxc (sudo stop lxc; sudo start lxc) Check for the running container (sudo lxc-ls). It will not be running without this fix. 5. Regression potential: none. ==========================
-- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/989853 Title: autostart containers must be started after apparmor profiles are loaded To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/989853/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
