Ubuntu
apparmor package

  1. Bug #1811248
  2. Comment #8

Comment 8 for bug 1811248

Revision history for this message
km (n8v8r) wrote :

https://github.com/lxc/lxd/issues/5439#issuecomment-461257784

> The fix in LXD is only partial because there's currently no safe way for us to fix that for privileged containers due to an apparmor parser bug that the AppArmor team is still working on.

So we've made the change only to the unprivileged policy for now as the AppArmor bug isn't causing too much damage in that case.

There's no such distinction in profile in LXC, so putting those same lines in the LXC policy would allow every user to bypass all mount protections, which isn't acceptable from a security point of view.
So the LXC fix is effectively blocked on the AppArmor security bug being resolved first.