{"action":"opened","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/593","labels_url":"https://api.github.com/repos/lxc/lxc/issues/593/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/593/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/593/events","html_url":"https://github.com/lxc/lxc/issues/593","id":95272659,"number":593,"title":"AppArmor prevents networking for unprivileged Debian and CentOS containers","user":{"login":"jnschaeffer","id":1588395,"avatar_url":"https://avatars.githubusercontent.com/u/1588395?v=3","gravatar_id":"","url":"https://api.github.com/users/jnschaeffer","html_url":"https://github.com/jnschaeffer","followers_url":"https://api.github.com/users/jnschaeffer/followers","following_url":"https://api.github.com/users/jnschaeffer/following{/other_user}","gists_url":"https://api.github.com/users/jnschaeffer/gists{/gist_id}","starred_url":"https://api.github.com/users/jnschaeffer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jnschaeffer/subscriptions","organizations_url":"https://api.github.com/users/jnschaeffer/orgs","repos_url":"https://api.github.com/users/jnschaeffer/repos","events_url":"https://api.github.com/users/jnschaeffer/events{/privacy}","received_events_url":"https://api.github.com/users/jnschaeffer/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-07-15T19:35:16Z","updated_at":"2015-07-15T19:35:16Z","closed_at":null,"body":"Using LXC 1.0.7 from aptitude and Linux Mint 17, I created and launched a Debian Wheezy container with the download template:\r\n\r\n    john@john-laptop ~ $ lxc-create -t download -n p1\r\n    ...\r\n    Distribution: debian\r\n    Release: wheezy\r\n    Architecture: amd64\r\n    john@john-laptop ~ $ lxc-start -n p1 -d\r\n\r\nOn start, the kernel log in /var/log/kern.log shows that AppArmor has denied /sbin/dhclient access to something. My home directory is encrypted with eCryptfs though, so I can't see what it's denying access to. The same issue occurs with CentOS containers.\r\n\r\nMoving /sbin/dhclient to /usr/sbin/dhclient, as has been suggested for Docker containers using LXC (http://unix.stackexchange.com/questions/155990/docker-bridges-dhcp), works by getting around the AppArmor policy. But this is at the expense of having networking available on boot and seems like a fairly poor workaround.\r\n\r\nFor what it's worth, the Ubuntu Trusty container works just fine, with networking enabled on start and no AppArmor issues."}}