[pve-devel] [PATCH lxc 0/2] fix apparmor rules and improve cgroupv2 experience

[Stoiko Ivanov]

This patchset addresses 2 minor inconveniences I ran into, while running my
host with 'systemd.unified_cgroup_hierarchy=1':

* apparmor mount denies for '/proc/sys/kernel/random/boot_id' (this happens
  irrespective of the cgroup-layout
* having to add
  `lxc.init.cmd: /lib/systemd/systemd systemd.unified_cgroup_hierarchy=1`
  to all my container configs (for debian and arch containers at least
  alpine runs without issues) - see [0] for a discussion of the topic

While investigating this I noticed that the fixes for both issues were already
on upstream/master (with one small other fix in between) - so instead of
cherry-picking both patches I fast-forwarded to the last needed commit.
Glad to resend with the patches cherry-picked and added to our patchqueue.

I would probably submit the apparmor fix upstream (after a quick check by
another set of eyes :)

[0] https://github.com/lxc/lxc/issues/3183

Stoiko Ivanov (2):
  update lxc to include fixes for cgroupv2 setups
  apparmor: add rule for allowing remount of boot_id

 ...apparmor-Allow-ro-remount-of-boot_id.patch | 26 +++++++++++++++++++
 debian/patches/series                         |  1 +
 lxc                                           |  2 +-
 3 files changed, 28 insertions(+), 1 deletion(-)
 create mode 100644 debian/patches/pve/0004-apparmor-Allow-ro-remount-of-boot_id.patch

-- 
2.20.1