** Description changed: lxc.conf currently does the container autostarts before it loads the apparmor profiles. That is wrong. Those must be reversed. ========================== SRU Justification 1. Impact: auto-start containers could be started without apparmor enforcement 2. Development fix: start auto-start containers after apparmor policy loads 3. Stable fix: same as development fix 4. Test case: - Delay /etc/init.d/apparmor (add a sleep 10 to its start section), and create an auto-start container. Reboot the system. Check /proc/pid/attr/current for the container init - if broken, it will be unconfined rather than lxc-container-default + unload apparmor profiles (sudo /etc/init.d/apparmor stop; sudo /etc/init.d/apparmor teardown;), and create an auto-start container. stop and restart lxc (sudo stop lxc; sudo start lxc) Check for the running container (sudo lxc-ls). It will not be running without this fix. 5. Regression potential: none. ==========================
-- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/989853 Title: autostart containers must be started after apparmor profiles are loaded To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/989853/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs