0

I am trying to set up a privileged container on Ubuntu where apparmor denies to mount /run /run/lock and /sys/fs/cgroup while running lxc-start.

Violations

[ 1621.278919] audit: type=1400 audit(1499177276.634:12): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="/usr/bin/lxc-start" name="/run/" pid=2097 comm="systemd" fstype="tmpfs" srcname="tmpfs" flags="rw, nosuid, nodev, strictatime"
[ 1621.302331] audit: type=1400 audit(1499177276.658:13): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="/usr/bin/lxc-start" name="/run/lock/" pid=2097 comm="systemd" fstype="tmpfs" srcname="tmpfs" flags="rw, nosuid, nodev, noexec"
[ 1621.325944] audit: type=1400 audit(1499177276.682:14): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="/usr/bin/lxc-start" name="/sys/fs/cgroup/" pid=2097 comm="systemd" fstype="tmpfs" srcname="tmpfs" flags="rw, nosuid, nodev, noexec, strictatime"

lxc-start --version: 2.0.6

Kernel version: 4.9

Any hints?

Improve this question
2
  • Are you looking to deny them or is apparmor automatically denying them and you want to allow them?
    – Raman Sailopal
    Aug 7, 2017 at 12:00
  • @RamanSailopal : Apparmor is automatically denying these mounts for the lxc-start profile and I want apparmor to allow them. I haven't changed anything in the usr.bin.lxc-start apparmor profile,It's the default one which came along with the distribution.
    – Thushi
    Aug 7, 2017 at 12:08

2 Answers 2

Reset to default
0

Install the apparmor-utils package and then kick off two sessions to the server. In one session, run:

genprof /usr/bin/lxc-start

In the other, actually run the process. The genprof session will then prompt you for what you actually want the process to have access to.

Improve this answer
1
  • Would be nice for people to actually add comments as to why they have down voted!
    – Raman Sailopal
    Aug 7, 2017 at 14:07
0

Just as Raman Sailopal said - genprof can help here. Thou it's aa-genprof <path to application>

$ sudo aa-genprof /usr/bin/lxc-start
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .