Disable restricting unprivileged change_profile by default, due to LXD latest/stable not yet compatible with this new apparmor feature
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
Release Notes for Ubuntu |
New
|
Undecided
|
Unassigned | ||
apparmor (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned | ||
linux (Ubuntu) |
Fix Released
|
Critical
|
Unassigned | ||
lxd (Ubuntu) |
Triaged
|
High
|
Unassigned | ||
snapd (Ubuntu) |
Confirmed
|
Undecided
|
Unassigned |
Bug Description
Following upgrade to 6.5.0-7 kernel in mantic cloud images we are seeing a regression in our cloud image tests. The test runs the following:
```
lxd init --auto --storage-backend dir
lxc launch ubuntu-daily:mantic mantic
lxc info mantic
lxc exec mantic -- cloud-init status --wait
```
The `lxc exec mantic -- cloud-init status --wait` times out after 240s and will fail our test as a result.
I have been able to replicate in a local VM
```
wget http://
wget --output-
chmod +x launch-
./launch-
cat <<EOF > "./reproducer.sh"
#!/bin/bash -eux
lxd init --auto --storage-backend dir
lxc launch ubuntu-daily:mantic mantic
lxc info mantic
lxc exec mantic -- cloud-init status --wait
EOF
chmod +x ./reproducer.sh
sshpass -p passw0rd scp -o UserKnownHostsF
sshpass -p passw0rd ssh -o UserKnownHostsF
sshpass -p passw0rd ssh -o UserKnownHostsF
sshpass -p passw0rd ssh -o UserKnownHostsF
```
The issue is not present with the 6.5.0-5 kernel and the issue is present regardless of the container launched. I tried the jammy container to test this.
From my test VM
```
ubuntu@cloudimg:~$ uname --all
Linux cloudimg 6.5.0-7-generic #7-Ubuntu SMP PREEMPT_DYNAMIC Fri Sep 29 09:14:56 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
ubuntu@cloudimg:~$ uname --kernel-release
6.5.0-7-generic
```
This is a regression in our test that will block 23.10 cloud image release next week.
Changed in linux (Ubuntu): | |
milestone: | none → ubuntu-23.10 |
importance: | Undecided → Critical |
summary: |
- Mantic 6.5.0-7 kernel causes regression in LXD container usage + Disable restricting unprivileged change_profile by default, due to LXD + latest/snap not yet compatible with this new apparmor feature |
Changed in lxd (Ubuntu): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux (Ubuntu): | |
status: | Incomplete → Triaged |
summary: |
Disable restricting unprivileged change_profile by default, due to LXD - latest/snap not yet compatible with this new apparmor feature + latest/stable not yet compatible with this new apparmor feature |
This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:
apport-collect 2038567
and then change the status of the bug to 'Confirmed'.
If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.
This change has been made by an automated script, maintained by the Ubuntu Kernel Team.