[Bug 1640868] [NEW] network-interface-security upstart job is not container aware

[Tyler Hicks]

Public bug reported:

The network-interface-security upstart job unconditionally loads the
usr.sbin.dhclient AppArmor profile even if the job is running in a
LXC/LXD container that cannot load AppArmor policy.

I don't see any negative side effects from this behavior, so I don't
think this is a high priority bug. If this were to be fixed, the upstart
job would need to check to see if it is running inside of a container
and, if so, if the container is capable of loading its own AppArmor
security policy. See
https://launchpad.net/ubuntu/+source/apparmor/2.10.95-4ubuntu5 for an
example of what this would look like.

** Affects: ifupdown (Ubuntu)
     Importance: Low
         Status: Triaged

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to ifupdown in Ubuntu.
https://bugs.launchpad.net/bugs/1640868

Title:
  network-interface-security upstart job is not container aware

Status in ifupdown package in Ubuntu:
  Triaged

Bug description:
  The network-interface-security upstart job unconditionally loads the
  usr.sbin.dhclient AppArmor profile even if the job is running in a
  LXC/LXD container that cannot load AppArmor policy.

  I don't see any negative side effects from this behavior, so I don't
  think this is a high priority bug. If this were to be fixed, the
  upstart job would need to check to see if it is running inside of a
  container and, if so, if the container is capable of loading its own
  AppArmor security policy. See
  https://launchpad.net/ubuntu/+source/apparmor/2.10.95-4ubuntu5 for an
  example of what this would look like.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ifupdown/+bug/1640868/+subscriptions