Public bug reported:
If I create a ubuntu container and start it as a libvirt-lxc container,
it runs under the host dhcp profile. Then when I try virsh -c lxc:///
destroy c1, libvirtd tries to kill dhcp in the container but fails:
Jun 5 17:54:14 t1 kernel: [ 2563.620698] type=1400 audit(1401983654.375:28):
apparmor="DENIED" operation="signal" profile="/sbin/dhclient" pid=4304
comm="libvirtd" requested_mask="receive" denied_mask="receive" signal=term
peer="/usr/sbin/libvirtd"
Jun 5 17:54:14 t1 kernel: [ 2563.660491] type=1400 audit(1401983654.415:29):
apparmor="DENIED" operation="signal" profile="/sbin/dhclient" pid=4293
comm="libvirtd" requested_mask="receive" denied_mask="receive" signal=term
peer="/usr/sbin/libvirtd"
Jun 5 17:54:14 t1 kernel: [ 2563.660600] type=1400 audit(1401983654.415:30):
apparmor="DENIED" operation="signal" profile="/sbin/dhclient" pid=4293
comm="libvirtd" requested_mask="receive" denied_mask="receive" signal=term
peer="/usr/sbin/libvirtd"
I don't actually understand the mechanisms here (that a profile should
be able to refuse receiving signals), and it seems like the proper fix
is to have libvirt-lxc start containers confined in a container policy,
but Jamie seemed to have another solution, which would be great.
** Affects: isc-dhcp (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1326865
Title:
libvirt cannot kill dhcp in containers
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/isc-dhcp/+bug/1326865/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
