Dear Maintainer,

Since runc 1.2.8/1.3.3 (hardening for CVE-2025-52881), every container
start under Docker inside an unprivileged, nesting-enabled LXC container
fails during init with:

open sysctl net.ipv4.ip_unprivileged_port_start file: reopen fd 8:
permission denied
runc now writes sysctls through detached procfs mounts. When AppArmor
evaluates the fd re-open, the kernel renders the path without a mount
prefix, so /proc/sys/net/... is matched as /sys/net/... and hits the
"deny /sys/[^fdck]*{,/**} wklx," rule embedded in liblxc's generated
profile. Explicit deny rules are quiet, so nothing is logged, and the
deny cannot be overridden via lxc.apparmor.raw. This affects e.g. any
Docker (docker-ce with containerd.io >= 2.x) installation inside an LXC
container on trixie.

Upstream discussion: https://github.com/lxc/lxc/issues/4606
Upstream fix (merged 2025-11-20): https://github.com/lxc/lxc/pull/4609
i.e. commit b89ed0a "apparmor: skip /proc and /sys restrictions if
nesting is enabled" — included upstream in v6.0.6 and 7.0, and present
on the stable-6.0 branch. Debian testing/sid (7.0.0) are fixed; trixie's
1:6.0.4-4+deb13u3 does not carry it (the AppArmor change in +deb13u2 was
the unrelated static-profile fix for #1111087).

Please consider cherry-picking b89ed0a into the next trixie point
release: it is small, self-contained, and already vetted on the upstream
stable-6.0 branch.

Whether an installed liblxc is affected can be checked with:

strings /usr/lib/x86_64-linux-gnu/liblxc.so.1 | grep -F 'deny /sys/['
which still prints the [^fdck] rule on 1:6.0.4-4+deb13u3+b1.

control: tags -1 + pending

  I've cherry-picked the fix and prepared an update of lxc for trixie.
Hopefully it will be accepted and part of the 13.7 point release
scheduled for next Saturday, September 12th. (See bug #1146505 for more
details if you're interested.)

Mathias

{
  "emoji": "🎉",
  "version": 1
}

We believe that the bug you reported is fixed in the latest version of
lxc, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1146472@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mathias Gibbens <gibmat@debian.org> (supplier of updated lxc package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 02 Sep 2026 17:20:27 +0000
Source: lxc
Architecture: source
Version: 1:6.0.4-4+deb13u4
Distribution: trixie
Urgency: medium
Maintainer: pkg-lxc <pkg-lxc-devel@lists.alioth.debian.org>
Changed-By: Mathias Gibbens <gibmat@debian.org>
Closes: 1146472
Changes:
 lxc (1:6.0.4-4+deb13u4) trixie; urgency=medium
 .
   * Cherry-pick fix to properly free libcap-allocated memory
   * Cherry-pick fix for running nested containers using current versions of
     runc (ie, Docker) (Closes: #1146472)
Checksums-Sha1:
 2eb0d97f9c862d74e0710d0b263d93b8e6e3e5e5 2936 lxc_6.0.4-4+deb13u4.dsc
 08dec36d0076aa803e1bcafb1a7ed1e9e5d629c3 964064 lxc_6.0.4.orig.tar.gz
 d2d222259900d5f1f6118cf55586964acc668d55 833 lxc_6.0.4.orig.tar.gz.asc
 3e51722cc33b992fb1310830e54549dba2fa0a3b 63536 lxc_6.0.4-4+deb13u4.debian.tar.xz
 3449967a5f90a4d00514ca25b4df9ec895b71994 14607 lxc_6.0.4-4+deb13u4_amd64.buildinfo
Checksums-Sha256:
 b6a3673df5b08b022928cf7d56d2cf732493133afd5ecd1cca98a1bdb1fc11c9 2936 lxc_6.0.4-4+deb13u4.dsc
 872d26ce8512b9f993d194816e336bf9f3ad8326f22dc24ef0f01f85599fa8b9 964064 lxc_6.0.4.orig.tar.gz
 413771ad996bee9a5179cc74b17164fb2cfdd874a115873349d3a54bbefcee19 833 lxc_6.0.4.orig.tar.gz.asc
 c41e242088a0c35577fb5d279cff602f272049aaad0030af332ecd9ed1d7e526 63536 lxc_6.0.4-4+deb13u4.debian.tar.xz
 eb575c3aff78193d9a1bc65fa974685c10586383b2461e250d4afe89439bb151 14607 lxc_6.0.4-4+deb13u4_amd64.buildinfo
Files:
 81c02d022b3e8bfd46d54fa49da3ec57 2936 admin optional lxc_6.0.4-4+deb13u4.dsc
 8ddebe17ef04044cfb66a89ede43dd72 964064 admin optional lxc_6.0.4.orig.tar.gz
 ae7c482c5a9fc907dc9ef78b601af4ab 833 admin optional lxc_6.0.4.orig.tar.gz.asc
 fcddff4ef40824ce5a19e351bf054f82 63536 admin optional lxc_6.0.4-4+deb13u4.debian.tar.xz
 8473bbe59bec6586b8dc351dd55dd3dd 14607 admin optional lxc_6.0.4-4+deb13u4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEE1Bp60H32xfynSJ8cKe7i1uz0QvkFAmqayKISHGdpYm1hdEBk
ZWJpYW4ub3JnAAoJECnu4tbs9EL5Dn8P/RnXQ6A6Zik9RF91HKNP9UGM5wQuYRRB
wxa3+WZc8Fp6guYsOn6yFCJOjJpMoFvMVtx5qM+aEpRhl9nUAnGGJkntxEKdc4Td
g/EvbJhbCdj6jOTP/LUMIVK+7QVLaol6FmFIynLFg2pXizG1gxyd7Bilu5upKCoA
tjKnq7XpDca+/RPJsBvhKuDDIJaWVgCUxSw8cUeK/n6z8SQgdwn950DfJ90/+Y0o
A9N3LTHY8x9cxH6/2yNksICPytmYm+8nijWenwWIjEXUX+HQwtv2ZCqpiNLkRBvR
V1/vd+bs3+jjrhpjRjieou6G8G09D82YhVqy0R9743u7Vj9St/i+no4IA2OLzk4T
WE7FiCFUXy8od1PO2DJ+K5XwKpqAEOwm5tszHp7KVnn3EJFC4OldmJLXuSlIMSgd
Tj2W0dPZnCO3LN+AIW/OLx4iBt4tnh08CDmaMyCO/xwevA8vCI2o63CEHfoZMknO
CXuxUtZY4+uOIUbblDF38lYTTiMSLYUTsKFTmBxHsWnawAaVcw3Cu0SGuYIA0nL2
JMWmsLtZZ6PJxmr/X8GYR634jBMTVTC0uGCoEAqNYlw4mAI4v+jbzztHiRF9mK64
hGw+Gt8uiVCNK9ZoEmPZZk5wbom38ByY9vzuU+lSEcUJ0TMuZn5HB4zi3lAb8X/7
OEih9BUCxuWT
=LrXh
-----END PGP SIGNATURE-----