apparmor profile fails to load in Ubuntu 15.04

[rajasec]

With the latest Ubuntu 15.04 Vivid( Kernel 3.19), I tried to ran the sample program for aa_change_profile from the man page. Whenever I tried to execute the program, it says No such file or directory. I ran strace for this program, whenever aa_change_profile is called, looks like changeprofile is prefixed with profile. Not sure whether it is intended from asprintf called from aa_change_profile

strace output
write(3, "changeprofile i_cant_be_trusted_"..., 39) = -1 ENOENT (No such file or directory)

[Serge Hallyn (serge-hallyn)]

Thanks for reporting this bug.

Why do you feel this is a bug in lxc? Did you run the sample
program inside a container? Since apparmor profiles cannot be nested
and containers by default run confined, you would indeed not be able
to switch profiles inside a container.

Please show us precisely what you did and what you expected to happen.

[Tyler Hicks (tyhicks)]

Hello - This is expected behavior. When a profile requested in the changeprofile operation has not been loaded into the kernel, the write() on /proc/PID/attr/current will fail with errno set to ENOENT.

This is documented in the aa_change_profile(2) man page:

         ENOENT
           The specified profile does not exist, or is not visible from the current Namespace.