Same regression here, on Kubernetes (K3s), not Docker. Rolling back to 7.0.0-38 fixes it.
Setup: Ubuntu 26.04.1, apparmor 5.0.2-0ubuntu1~26.04.1, k3s v1.36.5+k3s1 (containerd v2.3.4-k3s1.36), containers confined by cri- containerd.apparmor.d. On 7.0.0-42, AppArmor denies signals sent between processes in the same container. The peer label is the same stacked "//&unconfined" form as in this report: apparmor="DENIED" operation="signal" class="signal" profile="cri- containerd.apparmor.d" pid=1820 comm="speaker" requested_mask="send" denied_mask="send" signal=urg peer="cri- containerd.apparmor.d//&unconfined" One node logged 1,747 of these in 25 minutes on -42. 1,725 were SIGURG and 1,575 came from postgres. The same node logs single digits per boot on -38. What broke: - PostgreSQL 18 (CloudNativePG) standbys stall after "consistent recovery state reached". Postgres uses SIGURG for latch wakeups, so the postmaster never starts the walreceiver. - Inside a pod, `timeout -s KILL 1 sleep 5` returns 0 after 5 s on -42. On -38 it returns 137 after 1 s (same image, same command). - An Elasticsearch JVM (SonarQube) dies at start, and Go programs (helm, controller managers) log denials too. Not affected: plain Docker 29.9.2 with docker-default (enforce) on 7.0.0-42. There, 0 signal denials and `timeout -s KILL 1 sleep 5` returns 137 after 1 s. So a simple parent-to-child kill under docker- default works, while the same kill under cri-containerd does not. Changes between -38 and -42 that touch signal paths, possibly relevant: "signal: avoid shared siginfo namespace rewrites" (CVE-2026-93222, in -39) and "signal: Prevent exec() race" (-41). Not bisected. ** CVE added: https://cve.org/CVERecord?id=CVE-2026-93222 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2172422 Title: Regression 7.0.0-42/-43: Go 1.24 programs livelock in setuid (gosu); official DB Docker images hang on start To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2172422/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
