Bug#880502: [pkg-lxc-devel] Bug#880502: lxc: cannot start container with kernel 4.13.10

From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.debian.bugs.dist, linux.debian.kernel
Subject	Bug#880502: [pkg-lxc-devel] Bug#880502: lxc: cannot start container with kernel 4.13.10
Date	2017-11-01 22:20 +0100
Message-ID	<uH8Ax-5XN-7@gated-at.bofh.it> (permalink)
References	(1 earlier) <uH1po-XL-19@gated-at.bofh.it> <uH1Sq-1og-1@gated-at.bofh.it> <uH2v8-1Fb-5@gated-at.bofh.it> <uH1po-XL-19@gated-at.bofh.it> <uH2v8-1Fb-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

On Wed, 2017-11-01 at 15:38 +0100, Evgeni Golov wrote:
> Ohai,
> 
> On Wed, Nov 01, 2017 at 12:00:12PM -0200, Antonio Terceiro wrote:
> > >       lxc-start 20171101123914.655 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:220 - If you really want to start this container, set
> > >       lxc-start 20171101123914.655 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:221 - lxc.aa_allow_incomplete = 1
> > >       lxc-start 20171101123914.655 ERROR    lxc_apparmor - lsm/apparmor.c:apparmor_process_label_set:222 - in your container configuration file
> > 
> > So, I tried downgrading the kernel to the one in testing, rebooted, and
> > now I can start containers again, So this is being caused by a change in
> > the kernel between 4.13.4-2 and 4.13.10-1
> > 
> > I still need to study the lxc code path that is being triggered to be
> > able to provide more useful information. Since the issue is definitively
> > related to apparmor, I am also copying the apparmor team in case they
> > have any input to provide.
> 
> Can you try to set "lxc.aa_allow_incomplete = 1" in your config?
> LXC expects Ubuntus patched kernels when it comes to AppArmor, not the
> upstream ones :(
> 
> And I think Debian enabled AppArmor by default in the latest kernels.

Yes, that's the change made in 4.13.10-1.

Ben.

-- 
Ben Hutchings
Make three consecutive correct guesses and you will be considered an
expert.

Thread

Bug#880502: lxc: cannot start container (kernel related?) Antonio Terceiro <terceiro@debian.org> - 2017-11-01 14:40 +0100
  Bug#880502: [pkg-lxc-devel] Bug#880502: lxc: cannot start container with kernel 4.13.10 Evgeni Golov <evgeni@debian.org> - 2017-11-01 15:50 +0100
    Bug#880502: [pkg-lxc-devel] Bug#880502: lxc: cannot start container with kernel 4.13.10 Ben Hutchings <ben@decadent.org.uk> - 2017-11-01 22:20 +0100
  Bug#880502: [pkg-apparmor] Bug#880502: [pkg-lxc-devel] Bug#880502: lxc: cannot start container with kernel 4.13.10 Christian Boltz <debian-bugs@cboltz.de> - 2017-11-02 19:30 +0100
    Bug#880502: lxc: cannot start container with kernel 4.13.10 Evgeni Golov <evgeni@debian.org> - 2017-11-02 20:20 +0100
      Bug#880502: [pkg-apparmor] Bug#880502: lxc: cannot start container with kernel 4.13.10 Felix Geyer <fgeyer@debian.org> - 2017-11-03 19:40 +0100
        Bug#880502: [pkg-apparmor] Bug#880502: lxc: cannot start container with kernel 4.13.10 intrigeri <intrigeri@debian.org> - 2017-11-05 13:30 +0100
  Bug#880502: [pkg-apparmor] Bug#880502: [pkg-lxc-devel] Bug#880502: lxc: cannot start container with kernel 4.13.10 intrigeri <intrigeri@debian.org> - 2017-11-05 13:20 +0100

csiph-web