Actually, this issue is not directly related to containers but to delegations. Unconfined does object delegation of open descriptors. This is not the case for confined profiles. So when lsblk is launched from a confined process (the container), then the permission is required.
$ aa-exec -p Xorg -- sh -c lsblk Segmentation fault In the above example, the profile transitions are: unconfined -> Xorg -> lsblk, so lsblk won't work, while from a regular bash (unconfined -> lsblk), lsblk can work even without this rule. -- You received this bug notification because you are a member of Ubuntu Touch seeded packages, which is subscribed to apparmor in Ubuntu. https://bugs.launchpad.net/bugs/2107455 Title: segfault of lsblk s390x in containers due to apparmor Status in Ubuntu on IBM z Systems: Confirmed Status in apparmor package in Ubuntu: Confirmed Bug description: Hey, while debugging bug 2107402 we found that there is more to fix. Running lsblk in a container on s390x hits this: [12064869.934674] audit: type=1400 audit(1744791155.353:111962): apparmor="DENIED" operation="file_mmap" class="file" namespace="root//lxd-p_<var-snap-lxd-common-lxd>" profile="lsblk" name="/usr/bin/lsblk" pid=3286747 comm="lsblk" requested_mask="rm" denied_mask="rm" fsuid=1000000 ouid=1000000 To the user it just segfaults. root@p:~# lsblk Segmentation fault root@p:~# aa-disable lsblk Disabling /usr/bin/lsblk. root@p:~# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS loop0 7:0 0 93.8M 1 loop loop1 7:1 0 94M 1 l ... To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu-z-systems/+bug/2107455/+subscriptions -- Mailing list: https://launchpad.net/~touch-packages Post to : touch-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~touch-packages More help : https://help.launchpad.net/ListHelp
