[Bug 989853] Re: autostart containers must be started after apparmor profiles are loaded

[Serge Hallyn]

** Description changed:

  lxc.conf currently does the container autostarts before it loads the
  apparmor profiles.  That is wrong.  Those must be reversed.
  
  ==========================
  SRU Justification
  1. Impact: auto-start containers could be started without apparmor enforcement
  2. Development fix: start auto-start containers after apparmor policy loads
  3. Stable fix: same as development fix
  4. Test case:
-    Delay /etc/init.d/apparmor (add a sleep 10 to its start section), and create an auto-start container.  Reboot the system.  Check /proc/pid/attr/current for the container init - if broken, it will be unconfined rather than lxc-container-default
+    unload apparmor profiles (sudo /etc/init.d/apparmor stop; sudo /etc/init.d/apparmor teardown;), and create an auto-start container.  stop and restart lxc (sudo stop lxc; sudo start lxc)  Check for the running container (sudo lxc-ls).  It will not be running without this fix.
  5. Regression potential: none.
  ==========================

-- 
You received this bug notification because you are a member of Ubuntu
Server Team, which is subscribed to lxc in Ubuntu.
https://bugs.launchpad.net/bugs/989853

Title:
  autostart containers must be started after apparmor profiles are
  loaded

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/989853/+subscriptions