Podman: [ubuntu 20.04] Error: AppArmor profile "container-default" specified but not loaded

[shaicoleman]

/kind bug

Description

$ sudo podman run -it hello-world
Error: AppArmor profile "container-default" specified but not loaded

Steps to reproduce the issue:

1. Clean install of Ubuntu Desktop 20.04 on VirtualBox, minimal installation

2. Install podman 2.0 via the Kubic project packages

3. Run sudo podman run -it hello-world

Output of podman version:

Version:      2.0.0
API Version:  1
Go Version:   go1.13.8
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64

Output of podman info --debug:

host:
  arch: amd64
  buildahVersion: 1.15.0
  cgroupVersion: v1
  conmon:
    package: 'conmon: /usr/libexec/podman/conmon'
    path: /usr/libexec/podman/conmon
    version: 'conmon version 2.0.18, commit: '
  cpus: 4
  distribution:
    distribution: ubuntu
    version: "20.04"
  eventLogger: file
  hostname: shai-VirtualBox
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 5.4.0-37-generic
  linkmode: dynamic
  memFree: 1991516160
  memTotal: 4126953472
  ociRuntime:
    name: runc
    package: 'runc: /usr/sbin/runc'
    path: /usr/sbin/runc
    version: 'runc version spec: 1.0.1-dev'
  os: linux
  remoteSocket:
    path: /run/podman/podman.sock
  rootless: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 968105984
  swapTotal: 968105984
  uptime: 9m 35.21s
registries:
  search:
  - docker.io
  - quay.io
store:
  configFile: /etc/containers/storage.conf
  containerStore:
    number: 1
    paused: 0
    running: 0
    stopped: 1
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/lib/containers/storage
  graphStatus:
    Backing Filesystem: extfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 1
  runRoot: /var/run/containers/storage
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 1
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.13.8
  OsArch: linux/amd64
  Version: 2.0.0

Package info (e.g. output of rpm -q podman or apt list podman):

podman/unknown,now 2.0.0~1 amd64 [installed]

Additional environment details (AWS, VirtualBox, physical, etc.):
Reproduced on a fresh Ubuntu 20.04 VirtualBox machine and a physical machine as well

[rhatdan]

@saschagrunert PTAL
My knowledge of AppArmor is very limited, Prefer SELinux :^)

[saschagrunert]

It looks like the default profile name has changed by switching to github.com/containers/common/pkg/apparmor, I’ll dig into it.

[vrothberg]

I hoped we would have regressed on that in the CI. @lsm5 could it be the containers.conf in the Ubuntu packages?

[saschagrunert]

So it looks like we stopped suffixing the version (was container-default-1.9.3, now just container-default). Was this change intended?

Edit: This can be fixed in multiple ways. I suggest that I just re-add the version suffix to the default profile.

[vrothberg]

Thanks for tracking it down @saschagrunert!

I agree with readding the suffix. This will allow for installing a new (potentially updated) profile after an update while keeping the lazy loads.

[saschagrunert]

Alright I think we have a mismatch in the usage of containers/common:

• The default profile name is set by the default config (which is containers-default)
• The logic in containers/common which prevents the default profile to be loaded is there: https://github.com/containers/common/blob/e505f9348f51b6af02ab6be5c12d768feaea1b41/pkg/apparmor/apparmor_linux.go#L258-L269
  This means that the profile either has to be empty or prefixed by apparmor_profile to be treated as a default profile.

A possible fix would be now to change or add another valid profile prefix which is containers-default-. WDYT?

So 2 fixes:

• readd the version suffix in libpod
• allow containers-default as default profile prefix in containers/common

[vrothberg]

@cevich are we testing on the Ubuntu VMs with AppArmor? This regression worries me a bit.

[vrothberg]

So 2 fixes:

* readd the version suffix in libpod

* allow `containers-default` as default profile prefix in containers/common

I think we need to resolve that in containers/common only. We shouldn't embed libpod in the name any more, such that multiple consumers share the same default profile.

Before we regressed (see https://github.com/containers/libpod/blob/v1.6/pkg/apparmor/apparmor.go#L10) we used the version package in libpod to embed the version into the profile name.

I suggest doing the same in containers/common (as we do in c/image already) and introduce containers/common/version. After that, we can do:

    // DefaultProfilePrefix is used for version-independent presence checks.
    DefaultProfilePrefix = "containers-default" + "-"
    // DefaultProfile is the name of default AppArmor profile.
    DefaultProfile = DefaultProfilePrefix + version.Version

[rhatdan]

Please open a PR into containers/common and then we can roll this forward.

[saschagrunert]

Please open a PR into containers/common and then we can roll this forward.

Yep, that’s the one: https://github.com/containers/common/pull/185

[saschagrunert]

Hey, @mheon can we mention in the release notes that this has been fixed, too? Right now it’s implicitly hidden in the containers/common bump.

[mheon]

Sure