From: the-antz <the-antz@users.noreply.github.com>
To: ml@inbox.vuxu.org
Subject: Re: [ISSUE] [CLOSED] podman-2.0.0 won't work with apparmor enabled
Date: Tue, 04 Aug 2020 19:14:42 +0200 [thread overview]
Message-ID: <20200804171442.y2iKx09ll45LDv3zgVn4ojc4lixvhdbmkwzA3vLqHKk@z> (raw)
In-Reply-To: <gh-mailinglist-notifications-41a7ca26-5023-4802-975b-f1789d68868e-void-packages-23206@inbox.vuxu.org>
[-- Attachment #1: Type: text/plain, Size: 2018 bytes --]
Closed issue by the-antz on void-packages repository
https://github.com/void-linux/void-packages/issues/23206
Description:
### System
* xuname:
Void 5.6.19_1 x86_64 GenuineIntel uptodate rrFF
* package:
podman-2.0.0_1
maybe containers.image-5.0.0_1
### Expected behavior
Both
`sudo podman run --rm -it hello-world`
and
`podman run --rm -it hello-world`
should print some hello-world messages.
### Actual behavior
#### ~~Issue 1~~ (fixed in v2.0.1 #23235 )
`sudo podman run --rm -it hello-world`
fails with
`Error: AppArmor profile "container-default" specified but not loaded`
After loading a dummy apparmor profile in complain mode `/etc/apparmor.d/container-default.profile`
```
#include <tunables/global>
profile container-default flags=(complain) {
#include <abstractions/base>
}
```
running podman as root works as expected.
Related: https://github.com/containers/libpod/issues/6724
We should probably add a container-default.profile to podman (or maybe containers.image?) but I didn't find any example profile in the podman repo.
#### Issue 2
**edit**: https://github.com/containers/libpod/issues/6668
`podman run --rm -it hello-world`
fails with
`Error: container_linux.go:349: starting container process caused "process_linux.go:449: container init caused \"process_linux.go:378: setting rlimits for ready process caused \\\"error setting rlimit type 7: invalid argument\\\"\"": OCI runtime error`
This happens with both apparmor enabled and disabled and might be a different issue.
--
I deleted all container related configs and had them recreate by podman 2 (well actually containers.image) but that didn't have any effect.
### Steps to reproduce the behavior
To load the profile: `apparmor_parser /etc/apparmor.d/container-default.profile`
Otherwise, on an apparmor enabled system, simply:
```
xbps-install podman
podman run --rm -it hello-world
sudo podman run --rm -it hello-world
```
edit: @cameronnemo (ping)
parent reply other threads:[~2020-08-04 17:14 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <gh-mailinglist-notifications-41a7ca26-5023-4802-975b-f1789d68868e-void-packages-23206@inbox.vuxu.org>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200804171442.y2iKx09ll45LDv3zgVn4ojc4lixvhdbmkwzA3vLqHKk@z \
--to=the-antz@users.noreply.github.com \
--cc=ml@inbox.vuxu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).