apparmor unconfined profile blocks pivot_root

This requires a v4.0 apparmor parser and Ubuntu not upstream kernel.

The ubuntu kernel carries a patch that is work toward splitting unconfined and making so it can replaced and only cause mediation overhead for the classes being mediated.

The 4.0 parser is setting mediated classes in unconfined profiles when it shouldn't, causing pivot root to fail.

It looks like the same issue happens with "kill" syscall:

Jul 01 15:52:45 kernel: audit: type=1400 audit(1719849165.951:291): apparmor="DENIED" operation="signal" class="signal" profile="lxd-v1_</var/snap/lxd/common/lxd>" pid=15369 comm="lxd" requested_mask="receive" denied_mask="receive" signal=kill peer="snap.lxd.daemon"

this started to appear after LXD was enabled to use unconfined profile mode.

This issue is now occuring in lxd latest/edge builds after we merged initial support for restricted user namespaces.

Is there an eta on a fix?

upstream discussion https://gitlab.com/apparmor/apparmor/-/merge_requests/1247

Hi all, what is the latest on this? It appears to not have been fixed in Ubuntu 24.04.1

https://github.com/canonical/lxd/issues/13389#issuecomment-2319129052

AFAIK, fix was landed https://gitlab.com/apparmor/apparmor/-/commit/4bb134e4bb950a8c9a1f70a27eb2acd2a35df412

But changelog
https://changelogs.ubuntu.com/changelogs/pool/main/a/apparmor/apparmor_4.0.1really4.0.0-beta3-0ubuntu0.1/changelog
says that everything was reverted back to 4.0.0~beta.

Sorry for the delay. The fix had landed but it was reverted due to a regression. We have a 4.0.1really4.0.1-0ubuntu0.24.04.3 update but it is still sitting in noble-proposed https://people.canonical.com/~ubuntu-archive/pending-sru.html

We have another problem which disappears when I revert dc757a645cfa82f6ac252365df20a36a9ff82760 ("UBUNTU: SAUCE: apparmor4.0.0 [81/90]: apparmor: convert easy uses of unconfined() to label_mediates()") commit.

Now it is not connected with unconfined profiles at all, it involves Ubuntu Noble (host) + LXD (any version) + Ubuntu 12.04 container. And that container fails to get an IPv4 address using dhcp client with the following error:
dhclient3 eth0
RTNETLINK answers: Operation not permitted
RTNETLINK answers: Operation not permitted

On the host side we can see a following AppArmor denial:
Sep 05 12:01:09 kernel: audit: type=1400 audit(1725534069.603:228): apparmor="DENIED" operation="capable" class="cap" namespace="root//lxd-c1_<var-lib-lxd>" profile="/sbin/dhclient" pid=28122 comm="ip" capability=12 capname="net_admin"

Precisely the same user space works well with upstream kernels 6.8.12 and 6.11.0-rc7. But fails on 6.8.12-based Ubuntu Noble's kernel. Reverting of dc757a645cfa82f6ac252365df20a36a9ff82760 makes things to work again.

Reproducer is as simple as lxc launch ubuntu:12.04 myct and check if myct gets an IPv4 address (it won't).

External link: https://discourse.ubuntu.com/t/containers-with-ubuntu-12-04-5-lts-are-not-getting-ipv4s-anymore

Hi, mihalicyn, sorry for the delay answering.

That's unfortunately right. Ubuntu 12.04 ships apparmor 2.7 which didn't have support for ABIs yet, so dc757a645cfa82f6ac252365df20a36a9ff82760 causes a regression on those early versions. I talked to @jjohansen and we have agreed that this patch needs to be reverted, or partially reverted so it doesn't affect older versions of the apparmor_parser - even though are not currently supported, shouldn't break on newer kernels.

This partial revert makes it work in my tests:

--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -665,7 +665,7 @@ static struct aa_label *profile_transition(const struct cred *subj_cred,
                goto audit;
        }

- if (!profile_mediates(profile, AA_CLASS_FILE)) {
+ if (profile_unconfined(profile)) {
                new = find_attach(bprm, profile->ns,
                                  &profile->ns->base.profiles, name, &info);
                if (new) {

Hi Georgia,

thanks a lot for looking into this issue!

Kind regards,
Alex

This bug is awaiting verification that the linux/6.8.0-56.58 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux' to 'verification-done-noble-linux'. If the problem still exists, change the tag 'verification-needed-noble-linux' to 'verification-failed-noble-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Verification completed on noble kernel 6.8.0-56.58:

$ lxc launch ubuntu:24.04 test -c security.nesting=true
Launching test
$ lxc exec test bash
root@test:~# uname -a
Linux test 6.8.0-56-generic #58-Ubuntu SMP PREEMPT_DYNAMIC Fri Feb 14 15:33:28 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
root@test:~# apt update; apt install -y docker.io
[...]
root@test:~# docker run hello-world
Hello from Docker!
This message shows that your installation appears to be working correctly.
[...]

This bug is awaiting verification that the linux/6.11.0-21.21 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-oracular-linux' to 'verification-done-oracular-linux'. If the problem still exists, change the tag 'verification-needed-oracular-linux' to 'verification-failed-oracular-linux'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

Verification completed in oracular linux/6.11.0-21.21. Works as expected.

georgia@sec-oracular-amd64:~$ uname -a
Linux sec-oracular-amd64 6.11.0-21-generic #21-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb 19 16:50:40 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux

georgia@sec-oracular-amd64:~$ sudo lxc launch ubuntu:12.04
[sudo] password for georgia:
Launching the instance
Instance name is: grateful-muskrat
georgia@sec-oracular-amd64:~$ sudo lxc ls name=grateful-muskrat
+------------------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+------------------+---------+-----------------------+-----------------------------------------------+-----------+-----------+
| grateful-muskrat | RUNNING | 10.212.214.210 (eth0) | fd42:fbca:f64c:406c:216:3eff:fe36:f101 (eth0) | CONTAINER | 0 |
+------------------+---------+-----------------------+-----------------------------------------------+-----------+-----------+

georgia@sec-oracular-amd64:~$ sudo apt install docker.io docker-compose-v2
georgia@sec-oracular-amd64:~$ sudo docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
e6590344b1a5: Pull complete
Digest: sha256:e0b569a5163a5e6be84e210a2587e7d447e08f87a0e90798363fa44a0464a1e8
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

Dear Georgia,
can you please test that docker works *within* an LXC container (better if provisioned via LXD) with the same OS version of the host?
The bug would not show when the 2 would run alongside on the host, but instead when docker runs within an LXC container.

Hi The Owl, my apologies. I updated the description containing the SRU justification with the thorough testing steps.
Here's the correct verification:

root@sec-oracular-amd64:~# lxc launch ubuntu:24.10 test -c security.nesting=true
Launching test
root@sec-oracular-amd64:~# lxc exec test bash
root@test:~# uname -a
Linux test 6.11.0-21-generic #21-Ubuntu SMP PREEMPT_DYNAMIC Wed Feb 19 16:50:40 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
root@test:~# apt update
root@test:~# apt install docker.io
root@test:~# docker run hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
e6590344b1a5: Pull complete
Digest: sha256:e0b569a5163a5e6be84e210a2587e7d447e08f87a0e90798363fa44a0464a1e8
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.

Hello Georgia, no need to apologize, you have done what I wanted to do "as soon as I have 10 minutes" :).

Thanks!