Again, avila's kernel is pretty outdated, and its user namespace support is so poor that it's actually mis-behave on a certain security related operations.
In security/commoncap.c, function cap_prctl_drop, it should check `ns_capable(...)`, not just `capable(...)`. See https://github.com/lxc/lxd/issues/2039 . At lease commit 160da84 "userns: Allow PR_CAPBSET_DROP in a user namespace" has to be cherry- picked, but besides that, I also found a lot similar places to be fixed. ** Bug watch added: LXD bug tracker #2039 https://github.com/lxc/lxd/issues/2039 -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1641549 Title: migrate lxc android container to lxd To manage notifications about this bug go to: https://bugs.launchpad.net/canonical-devices-system-image/+bug/1641549/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
