APPLIED: [SRU][N, O][PATCH v3 0/1] apparmor: Revert conversion of unconfined() to fix label_mediates()

Koichiro Den koichiro.den at canonical.com
Fri Feb 14 07:07:39 UTC 2025


On Sun, Jan 05, 2025 at 10:33:15AM GMT, Maxime Bélair wrote:
> BugLink: https://bugs.launchpad.net/bugs/2067900
> 
> SRU Justification:
> 
> [Impact]
> 
> Ubuntu sauce commit "apparmor: convert easy uses of unconfined() to label_mediates()" was applied to Noble and Oracular respectively as dc757a645cfa ("UBUNTU: SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy uses of unconfined() to label_mediates()") and 621bcec8dae4 ("UBUNTU: SAUCE: apparmor4.0.0 [80/99]: apparmor: convert easy uses of unconfined() to label_mediates()"). This commit prevents the launching of Docker containers inside a LXC container because apparmor unconfined profile blocks pivot_root. It also blocks containers that uses an old apparmor version (e.g. 2.7) to get an IPV4 address through DHCP.
> 
> [Fix]
> 
> Noble: 
>  - Backport a revert of commit dc757a645cfa ("UBUNTU: SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy uses of unconfined() to label_mediates()")
> Oracular:
>  - Backport a revert of commit 621bcec8dae4 ("UBUNTU: SAUCE: apparmor4.0.0 [80/99]: apparmor: convert easy uses of unconfined() to label_mediates()")
> 
> [Test Plan]
> 
> This fix can be tested in Noble and Oracular by running docker in LXC and checking how they behave, as below:
> 
>  1/ Install LXD on a 24.04 machine
>  2/ Run a LXD container with support for security.nesting
>  3/ In the LXD container install docker.io
>  4/ Run a Docker container
> 
> With this patch applied, the docker container will work instead of failing with the following error:
> 
> ```
> docker: Error response from daemon: failed to create task for container: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: error during container init: error jailing process inside rootfs: pivot_root .: permission denied: unknown.
> ERRO[0000] error waiting for container:
> ```
> 
> The other issue related to old apparmor versions not supporting ABIs can be tested by running:
> 
> ```
> $ lxc launch ubuntu:12.04
> $ lxc list status=running
> ```
> 
> and checking that the IPV4 field is non-null in the newly-started container
> 
> [Where problems could occur]
> 
> This revert backport is small and returns to the old tested behavior. Hence, this SRU should not cause problems.
> 
> [Changes between v2 and v3]
> 
>  - Create separate patches for Noble and Oracular.
>  - Fix patch corruption in v2.
> 
> [Other Info]
> 
> External links:
>  - https://github.com/canonical/lxd/issues/13389
>  - https://discourse.ubuntu.com/t/containers-with-ubuntu-12-04-5-lts-are-not-getting-ipv4s-anymore/47371
> 
> 
> Maxime Bélair (1):
>   UBUNTU: SAUCE: Revert "UBUNTU: SAUCE: apparmor4.0.0 [80/99]: apparmor: convert easy uses of unconfined() to label_mediates()"
> 
>  security/apparmor/apparmorfs.c |  2 +-
>  security/apparmor/domain.c     | 40 +++++++++++++---------------------
>  security/apparmor/file.c       |  4 ++--
>  security/apparmor/ipc.c        |  2 +-
>  security/apparmor/label.c      |  8 +++----
>  security/apparmor/lsm.c        | 16 +++++++-------
>  security/apparmor/mount.c      |  3 ++-
>  security/apparmor/net.c        |  2 +-
>  security/apparmor/task.c       | 12 ++++++----
>  9 files changed, 42 insertions(+), 47 deletions(-)
> 

Applied to oracular:linux, noble:linux master-next branches. Thanks!



More information about the kernel-team mailing list