This bug is missing log files that will aid in diagnosing the problem. >From a terminal window please run:
apport-collect 1652101 and then change the status of the bug to 'Confirmed'. If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'. This change has been made by an automated script, maintained by the Ubuntu Kernel Team. ** Changed in: linux (Ubuntu) Status: New => Incomplete -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/1652101 Title: Can't created nested AppArmor namespaces Status in apparmor package in Ubuntu: New Status in linux package in Ubuntu: Incomplete Bug description: A user with CAP_MAC_ADMIN in the init namespace can create an AppArmor policy namespace and load a profile belonging to that AppArmor namespace. Once that's done, the user can confine a process with that namespaced AppArmor profile and enter into a user namespace. That process can then load additional AppArmor profiles inside of the AppArmor and user namespace. Here's an example: We need to set up the namespace, n1, and load the profile, p1. $ export rules="file, signal, unix, dbus, ptrace, mount, pivot_root, capability," $ sudo mkdir /sys/kernel/security/apparmor/policy/namespaces/n1 $ echo "profile p1 { $rules }" | sudo apparmor_parser -qrn n1 Now we enter into confinement using the AppArmor namespace and profile and then enter into an unprivileged user namespace $ aa-exec -n n1 -p p1 -- unshare -Ur We can now load profiles as the privileged user inside of the unprivileged user namespace # echo "profile test {}" | apparmor_parser -qr The reason for this bug report is that we cannot create a nested AppArmor policy namespace inside of the unprivileged user namespace # mkdir /sys/kernel/security/apparmor/policy/namespaces/n1/namespaces/p1 mkdir: cannot create directory ‘/sys/kernel/security/apparmor/policy/namespaces/n1/namespaces/p1’: Permission denied If that worked, we could adjust LXD to read /sys/kernel/security/apparmor/.ns_name to get the current AppArmor namespace, then create a new namespace under the current namespace, and leverage the nested namespace for its nested containers. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apparmor/+bug/1652101/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp