Also affects linux-aws 7.0.0-1016.17 (arm64, EC2), which is built on linux 7.0.0-42.42; 7.0.0-1014.14 is fine.
I believe the cause is AppArmor commit 08c2f7c8d4b1 "apparmor: fix unconfined user namespace restriction forced stack" (CVE-2026-90231, in 7.0.0-41.41), not the signal patches, which only change signal queueing after the LSM check. It moves the "converted to stacking" handling into the exec label build, so runc's exec into docker-default now yields the stacked label docker-default//&unconfined. docker-default only allows signals to peer=docker-default, so tasks can no longer signal their own threads. The audit record shows the code move: 1014.14 (works, no denials): apparmor="AUDIT" operation="change_onexec" info="change_profile unprivileged unconfined converted to stacking" profile="unconfined" name="docker-default" comm="runc:[2:INIT]" 1016.17 (broken): apparmor="AUDIT" operation="change_onexec" info="change_profile unprivileged unconfined converted to stacking" profile="unconfined" name="/usr/bin/id" comm="runc:[2:INIT]" target="docker-default//&unconfined" apparmor="DENIED" operation="signal" profile="docker-default" comm="gosu" signal=rtmin+1 peer="docker-default//&unconfined" kernel.apparmor_restrict_unprivileged_unconfined is 1 on both kernels. Workaround (verified on 7.0.0-1016.17): set it to 0 before containers start sysctl -w kernel.apparmor_restrict_unprivileged_unconfined=0 With that, postgres:18.4 under docker-default starts normally. ** CVE added: https://cve.org/CVERecord?id=CVE-2026-90231 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172422 Title: Regression 7.0.0-42/-43: Go 1.24 programs livelock in setuid (gosu); official DB Docker images hang on start To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172422/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
