** Description changed:

  lxc.conf currently does the container autostarts before it loads the
  apparmor profiles.  That is wrong.  Those must be reversed.
  
  ==========================
  SRU Justification
  1. Impact: auto-start containers could be started without apparmor enforcement
  2. Development fix: start auto-start containers after apparmor policy loads
  3. Stable fix: same as development fix
  4. Test case:
-    Delay /etc/init.d/apparmor (add a sleep 10 to its start section), and 
create an auto-start container.  Reboot the system.  Check 
/proc/pid/attr/current for the container init - if broken, it will be 
unconfined rather than lxc-container-default
+    unload apparmor profiles (sudo /etc/init.d/apparmor stop; sudo 
/etc/init.d/apparmor teardown;), and create an auto-start container.  stop and 
restart lxc (sudo stop lxc; sudo start lxc)  Check for the running container 
(sudo lxc-ls).  It will not be running without this fix.
  5. Regression potential: none.
  ==========================

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to lxc in Ubuntu.
https://bugs.launchpad.net/bugs/989853

Title:
  autostart containers must be started after apparmor profiles are
  loaded

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/989853/+subscriptions

-- 
Ubuntu-server-bugs mailing list
Ubuntu-server-bugs@lists.ubuntu.com
Modify settings or unsubscribe at: 
https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs

Reply via email to