Hey, so we're seeing an instance of this issue and the problem is that a
lock is taken on an fd instead of a path. This should be legal and we
urgently need a fix for this since this is starting to break all systemd
services running in a container that use PrivateUsers= and anything else
that hits the following codepath:
if (lockf(netns_storage_socket[0], F_LOCK, 0) < 0)
return -errno;
in systemd.
** Changed in: apparmor (Ubuntu)
Status: Triaged => Confirmed
** Changed in: apparmor (Ubuntu)
Importance: High => Critical
--
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to apparmor in Ubuntu.
https://bugs.launchpad.net/bugs/1575779
Title:
hostnamectl fails under lxd unpriv container
Status in apparmor package in Ubuntu:
Confirmed
Bug description:
1. % lsb_release -rd
Description: Ubuntu 16.04 LTS
Release: 16.04
2. % apt-cache policy apparmor
apparmor:
Installed: 2.10.95-0ubuntu2
Candidate: 2.10.95-0ubuntu2
Version table:
*** 2.10.95-0ubuntu2 500
500 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 Packages
100 /var/lib/dpkg/status
% apt-cache policy lxd
lxd:
Installed: 2.0.0-0ubuntu4
Candidate: 2.0.0-0ubuntu4
Version table:
*** 2.0.0-0ubuntu4 500
500 http://us.archive.ubuntu.com/ubuntu xenial/main amd64 Packages
100 /var/lib/dpkg/status
3. lxc launch ubuntu-daily:xenial x1
lxc exec x1 /bin/bash
root@x1:~# hostnamectl status
Static hostname: x1
Icon name: computer-container
Chassis: container
Machine ID: 833b8548c7ce4118b4c9c5c3ae4f133d
Boot ID: 9d5fbb053cf7494589c0863a0a4cf0ca
Virtualization: lxc
Operating System: Ubuntu 16.04 LTS
Kernel: Linux 4.4.0-18-generic
Architecture: x86-64
4. hostnamectl status hangs indefinitely
On the host, there are some audit messages for each invocation of
hostnamectl
[411617.032274] audit: type=1400 audit(1461695563.731:100):
apparmor="DENIED" operation="file_lock" profile="lxd-
x1_</var/lib/lxd>" pid=17100 comm="(ostnamed)" family="unix"
sock_type="dgram" protocol=0 addr=none
It's related to socket activation. One can workaround this by running
systemd-hostnamed in the background first
root@x1:~# /lib/systemd/systemd-hostnamed &
[1] 2462
root@x1:~# hostnamectl status
Static hostname: x1
Icon name: computer-container
Chassis: container
Machine ID: 833b8548c7ce4118b4c9c5c3ae4f133d
Boot ID: 9d5fbb053cf7494589c0863a0a4cf0ca
Virtualization: lxc
Operating System: Ubuntu 16.04 LTS
Kernel: Linux 4.4.0-18-generic
Architecture: x86-64
ProblemType: Bug
DistroRelease: Ubuntu 16.04
Package: apparmor 2.10.95-0ubuntu2
ProcVersionSignature: Ubuntu 4.4.0-18.34-generic 4.4.6
Uname: Linux 4.4.0-18-generic x86_64
NonfreeKernelModules: zfs zunicode zcommon znvpair zavl
ApportVersion: 2.20.1-0ubuntu2
Architecture: amd64
CurrentDesktop: GNOME-Flashback:GNOME
Date: Wed Apr 27 11:19:27 2016
InstallationDate: Installed on 2016-01-01 (117 days ago)
InstallationMedia: Ubuntu 16.04 LTS "Xenial Xerus" - Alpha amd64 (20151209)
ProcKernelCmdline: BOOT_IMAGE=/boot/vmlinuz-4.4.0-18-generic
root=UUID=e0b8b294-f364-4ef5-aa70-1916cdd37192 ro quiet splash vt.handoff=7
SourcePackage: apparmor
Syslog:
UpgradeStatus: No upgrade log present (probably fresh install)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1575779/+subscriptions
--
Mailing list: https://launchpad.net/~touch-packages
Post to : touch-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp
