Closed Orochimarufan closed 1 year ago
@Orochimarufan thanks for opening the issue.
nobody in the dev team is familiar with AppArmor, would it be possible for you to open a PR with a change you can test with the configuration your are using? I'll be glad to review it
src/libcrun/utils.c set_apparmor_profile() uses the legacy
/proc/thread-self/attr/exec
procfs interface for setting the AppArmor profile. This is brittle because it depends on the exact order of loaded LSMs and can break with as little as a change in kernel command line. It should probably try to use the new/proc/thread-self/attr/apparmor/exec
interface instead.Currently, any (rootful) containers will refuse to start with some LSM configurations:
The workaround is re-ordering the LSMs on the kernel commandline so AppArmor comes earlier
Note that set_selinux_label() may have a similar problem, but I'm not at all familiar with SELinux so I can't say for sure.
See also opencontainers/runc#2801