Package: release.debian.org Severity: normal Tags: trixie User: [email protected] Usertags: pu X-Debbugs-Cc: [email protected], [email protected] Control: affects -1 + src:lxc
[ Reason ] Two issues have been found that would be good to get fixed in trixie: * Fix a memory cleanup issue that can occasionally cause containers to fail to start. * Adjust apparmor profile generation when nesting is enabled. This is needed by newer versions of runc (ie, Docker) that have the fix for CVE-2025-52881 applied. Without it, attempting to start nested containers within the lxc container will fail. (Reported as bug #1146472.) [ Impact ] LXC in trixie currently suffers from two issues that have been fixed upstream. [ Tests ] None -- the memory fix is trivial, and the apparmor profile update has been in upstream lxc releases since the 6.0.6 release. [ Risks ] Minor/none -- two targeted fixes cherry-picked from the upstream git repo. [ Checklist ] [*] *all* changes are documented in the d/changelog [*] I reviewed all changes and I approve them [*] attach debdiff against the package in (old)stable [*] the issue is verified as fixed in unstable [ Changes ] Two fixes as outlined above. [ Other info ] The source debdiff is attached.
diff --git a/debian/changelog b/debian/changelog index 0557c23..d25b857 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +lxc (1:6.0.4-4+deb13u4) trixie; urgency=medium + + * Cherry-pick fix to properly free libcap-allocated memory + * Cherry-pick fix for running nested containers using current versions of + runc (ie, Docker) (Closes: #1146472) + + -- Mathias Gibbens <[email protected]> Wed, 02 Sep 2026 17:20:27 +0000 + lxc (1:6.0.4-4+deb13u3) trixie; urgency=medium * Cherry-pick upstream fix for CVE-2026-39402 diff --git a/debian/patches/0107-cherry-pick-fix-cap_to_text.patch b/debian/patches/0107-cherry-pick-fix-cap_to_text.patch new file mode 100644 index 0000000..9145fd8 --- /dev/null +++ b/debian/patches/0107-cherry-pick-fix-cap_to_text.patch @@ -0,0 +1,31 @@ +From e4e1fa469228db6d54c4945bbcdbd5abe52bb1ca Mon Sep 17 00:00:00 2001 +From: Li Lu <[email protected]> +Date: Tue, 19 May 2026 15:07:33 +0800 +Subject: [PATCH] lxc/caps: fix cap_to_text() memory cleanup + +Signed-off-by: DreamConnected <[email protected]> +--- + src/lxc/caps.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/src/lxc/caps.c b/src/lxc/caps.c +index 206488ff43..f6c5770ed3 100644 +--- a/src/lxc/caps.c ++++ b/src/lxc/caps.c +@@ -88,7 +88,7 @@ int lxc_caps_up(void) + int lxc_ambient_caps_up(void) + { + call_cleaner(cap_free) cap_t caps = NULL; +- __do_free char *cap_names = NULL; ++ char *cap_names = NULL; + int ret; + cap_value_t cap; + cap_value_t last_cap = CAP_LAST_CAP; +@@ -135,6 +135,7 @@ int lxc_ambient_caps_up(void) + return log_warn_errno(0, errno, "Failed to convert capabilities %d", cap); + + TRACE("Raised %s in inheritable and ambient capability set", cap_names); ++ cap_free(cap_names); + return 0; + } + diff --git a/debian/patches/0108-cherry-pick-runc-nested-containers.patch b/debian/patches/0108-cherry-pick-runc-nested-containers.patch new file mode 100644 index 0000000..120d412 --- /dev/null +++ b/debian/patches/0108-cherry-pick-runc-nested-containers.patch @@ -0,0 +1,69 @@ +From c21296262745c31760d5751fc219d627567a6139 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Fabian=20Gr=C3=BCnbichler?= <[email protected]> +Date: Thu, 13 Nov 2025 13:25:04 +0100 +Subject: [PATCH] apparmor: skip /proc and /sys restrictions if nesting is + enabled +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +If nesting is enabled, it's already possible to mount your own +instance of both procfs and sysfs inside the container, so protecting +the "original" ones at /proc and /sys makes no sense, but breaks +certain nested container setups. + +See: https://github.com/lxc/incus/pull/2624/commits/1fbe4bffb9748cc3b07aaf5db310d463c1e827d0 + +Signed-off-by: Fabian Grünbichler <[email protected]> +Signed-off-by: Thomas Lamprecht <[email protected]> +--- + src/lxc/lsm/apparmor.c | 15 ++++++++++++--- + 1 file changed, 12 insertions(+), 3 deletions(-) + +diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c +index d6516ae9f5..9f31840ff7 100644 +--- a/src/lxc/lsm/apparmor.c ++++ b/src/lxc/lsm/apparmor.c +@@ -170,6 +170,9 @@ static const char AA_PROFILE_BASE[] = + " mount options=(rw,move) /s[^y]*{,/**},\n" + " mount options=(rw,move) /sy[^s]*{,/**},\n" + " mount options=(rw,move) /sys?*{,/**},\n" ++"\n"; ++ ++static const char AA_PROFILE_BASE_NO_NESTING[] = + "\n" + " # generated by: lxc-generate-aa-rules.py container-rules.base\n" + " deny /proc/sys/[^kn]*{,/**} wklx,\n" +@@ -755,6 +758,10 @@ static char *get_apparmor_profile_content(struct lsm_ops *ops, struct lxc_conf * + must_append_sized(&profile, &size, AA_PROFILE_BASE, + STRARRAYLEN(AA_PROFILE_BASE)); + ++ if (!conf->lsm_aa_allow_nesting) ++ must_append_sized(&profile, &size, AA_PROFILE_BASE_NO_NESTING, ++ STRARRAYLEN(AA_PROFILE_BASE_NO_NESTING)); ++ + append_all_remount_rules(&profile, &size); + + if (ops->aa_supports_unix) +@@ -768,8 +775,10 @@ static char *get_apparmor_profile_content(struct lsm_ops *ops, struct lxc_conf * + if (ops->aa_can_stack && !ops->aa_is_stacked) { + char *namespace, *temp; + +- must_append_sized(&profile, &size, AA_PROFILE_STACKING_BASE, +- STRARRAYLEN(AA_PROFILE_STACKING_BASE)); ++ ++ if (!conf->lsm_aa_allow_nesting) ++ must_append_sized(&profile, &size, AA_PROFILE_STACKING_BASE, ++ STRARRAYLEN(AA_PROFILE_STACKING_BASE)); + + namespace = apparmor_namespace(conf->name, lxcpath); + temp = must_concat(NULL, " change_profile -> \":", namespace, ":*\",\n" +@@ -779,7 +788,7 @@ static char *get_apparmor_profile_content(struct lsm_ops *ops, struct lxc_conf * + + must_append_sized(&profile, &size, temp, strlen(temp)); + free(temp); +- } else { ++ } else if (!conf->lsm_aa_allow_nesting) { + must_append_sized(&profile, &size, AA_PROFILE_NO_STACKING, + STRARRAYLEN(AA_PROFILE_NO_STACKING)); + } diff --git a/debian/patches/series b/debian/patches/series index 64eeac8..4a76fb0 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -9,3 +9,5 @@ 0104-Add-lxc-net-as-dependency-in-sysvinit-script.patch 0105-cherry-pick-fix-heavy-io-pts.patch 0106-cherry-pick-CVE-2026-39402.patch +0107-cherry-pick-fix-cap_to_text.patch +0108-cherry-pick-runc-nested-containers.patch
signature.asc
Description: This is a digitally signed message part
