[Bug 989853] Re: autostart containers must be started after apparmor profiles are loaded

[Serge Hallyn]

** Description changed:

  lxc.conf currently does the container autostarts before it loads the
- apparmor profiles.  That is wrong.
+ apparmor profiles.  That is wrong.  Those must be reversed.
  
- Perhaps the container autostart should be done from start and not pre-
- start?  But at least those must be reversed.
+ ==========================
+ SRU Justification
+ 1. Impact: auto-start containers could be started without apparmor enforcement
+ 2. Development fix: start auto-start containers after apparmor policy loads
+ 3. Stable fix: same as development fix
+ 4. Test case:
+    Delay /etc/init.d/apparmor (add a sleep 10 to its start section), and create an auto-start container.  Reboot the system.  Check /proc/pid/attr/current for the container init - if broken, it will be unconfined rather than lxc-container-default
+ 5. Regression potential: none.
+ ==========================

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to lxc in Ubuntu.
https://bugs.launchpad.net/bugs/989853

Title:
  autostart containers must be started after apparmor profiles are
  loaded

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/989853/+subscriptions