3

System:
Debian Testing (Bullseye)

I am trying to get an LXC container up and running as per here, however, when I get to lxc-start -n my-container -d I get the following:

$ lxc-start -n test1 -d
lxc-start: test1: lxccontainer.c: wait_on_daemonized_start: 851 No such file or directory - Failed to receive the container state
lxc-start: test1: tools/lxc_start.c: main: 308 The container failed to start
lxc-start: test1: tools/lxc_start.c: main: 311 To get more details, run the container in foreground mode
lxc-start: test1: tools/lxc_start.c: main: 313 Additional information can be obtained by setting the --logfile and --logpriority options

running it in foreground mode I get

$ lxc-start -n test1 -F
lxc-start: test1: lsm/apparmor.c: apparmor_prepare: 1051 Cannot use generated profile: apparmor_parser not available
                                        lxc-start: test1: start.c: lxc_init: 832 Failed to initialize LSM
                             lxc-start: test1: start.c: __lxc_start: 1945 Failed to initialize container "test1"
lxc-start: test1: tools/lxc_start.c: main: 308 The container failed to start
lxc-start: test1: tools/lxc_start.c: main: 313 Additional information can be obtained by setting the --logfile and --logpriority options

From what I've discovered so far the error apparmor_parser not available occurs when apparmor is not installed/enabled. Except apparmor is installed and running on my system.

$ systemctl status apparmor.service
● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor >
     Active: active (exited) since Sat 2021-02-06 21:00:28 EST; 1h 37min ago
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
   Main PID: 524 (code=exited, status=0/SUCCESS)
      Tasks: 0 (limit: 8176)
     Memory: 0B
        CPU: 0
     CGroup: /system.slice/apparmor.service

Warning: some journal files were not opened due to insufficient permissions.

What gives?

EDIT:

Creating and running the container as root (sudo) works as expected, however the instructions in the link also provide for running them as a regular user.

With systemd-run --unit=myshell --user --scope -p "Delegate=yes" lxc-start -l INFO -o test1.log test1 the following log is produced

lxc-start test1 20210611133631.168 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133631.195 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1051 - Cannot use generated profile: apparmor_parser not available
lxc-start test1 20210611133631.195 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133631.195 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133631.712 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133631.712 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133631.712 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133631.712 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133722.933 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133722.933 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133722.934 INFO     lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133722.934 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133722.934 INFO     lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133722.942 NOTICE   utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133722.942 NOTICE   utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133722.942 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133722.945 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1051 - Cannot use generated profile: apparmor_parser not available
lxc-start test1 20210611133722.945 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133722.945 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133722.951 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133722.951 INFO     conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133723.454 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133723.454 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133723.454 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133723.454 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133821.478 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133821.478 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133821.478 INFO     lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133821.479 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133821.479 INFO     lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133821.487 NOTICE   utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133821.487 NOTICE   utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133821.487 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133821.568 ERROR    apparmor - lsm/apparmor.c:make_apparmor_namespace:840 - Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-test1_<-home-bobby-.local-share-lxc>
lxc-start test1 20210611133821.568 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1057 - Failed to load generated AppArmor profile
lxc-start test1 20210611133821.568 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133821.568 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133821.575 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133821.576 INFO     conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133822.796 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133822.798 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133822.801 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133822.802 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133926.195 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133926.195 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133926.196 INFO     lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133926.196 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133926.196 INFO     lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133926.199 NOTICE   utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133926.199 NOTICE   utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133926.200 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133926.201 ERROR    apparmor - lsm/apparmor.c:make_apparmor_namespace:840 - Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-test1_<-home-bobby-.local-share-lxc>
lxc-start test1 20210611133926.201 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1057 - Failed to load generated AppArmor profile
lxc-start test1 20210611133926.201 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133926.201 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133926.204 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133926.204 INFO     conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133926.706 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133926.707 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133926.707 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133926.707 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
4
  • I did also try to run the systemd command, but it fails the same way, except in foreground mode where it prints the same error messages, but doesn't close; when that happens lxc-ls -f also blocks without output until I send either a Ctrl+C.
    – Enter Display Name Here
    Feb 8, 2021 at 0:59
  • 1
    My apologies, it does work when I try creating and running it with sudo, but I don't like doing things as root if it is possible to do them as a normal user... In my previous comment I meant the adaptation provided in the link does not work. Adding /usr/sbin and /sbin to my $PATH as Claudio suggests also does not work.
    – Enter Display Name Here
    Jun 10, 2021 at 4:26
  • You should edit the question and add this information. And also run the container with options --logfile and --logpriority to see if the error is related to systemd & cgroups, apparmor_parser's path, other apparmor errors, or anything else unusual.
    – A.B
    Jun 10, 2021 at 7:27
  • Now add the new error logs when you apply @ClaudioAcioli 's answer where you wrote "This does not work for me. " . I bet the error log will show something different.
    – A.B
    Jun 11, 2021 at 13:59

3 Answers 3

Reset to default
1

I had exactly the same problem on Debian Buster, and the solution for me was to put the /usr/sbin or /sbin (because the apparmor_* stay there) in the $PATH like I saw in this link:

https://github.com/lxc/lxc/issues/3049

Put the following command in the last line on your ~/.bashrc for the current user or for all users on /etc/profile (Thanks, Thomas N!):

export PATH=/sbin:/usr/sbin:$PATH

After that update your terminal source ~/.bashrc or source /etc/profile.

4
  • You should explain how to perform this action (e.g., export PATH=/sbin:/usr/sbin:${PATH} to help answer the question.
    – Thomas N
    Jun 9, 2021 at 17:08
  • 1
    This does not work for me. Only running the commands as root works for now, which is not satisfactory since the instructions in the link do provide a way to do this without root, but for some reason it doesn't work.
    – Enter Display Name Here
    Jun 10, 2021 at 4:30
  • 2
    This does not work for me. It just changes the error message from apparmor_prepare: 1051 Cannot use generated profile: apparmor_parser not available to make_apparmor_namespace: 840 Permission denied - Error creating AppArmor namespace.
    – Michael Franzl
    Mar 31, 2022 at 7:44
  • @MichaelFranzl Use lxc.apparmor.profile = unconfined.
    – x-yuri
    Oct 19, 2022 at 7:02
0

This is a comment, I just wanted to attach my configuration, it may help you. LXC on Debian stable - Buster, without apparmor, I've uninstalled it before start using lxc; so I can't advice on lxc + apparmor. But it's possible to have lxc without apparmor.

/etc/lxc/default.conf

lxc.apparmor.profile = unconfined
lxc.apparmor.allow_nesting = 0
lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:FF:xx:xx:xx:xx
4
  • I tried this config both in /etc/lxc and ~/.config/lxc, nothing changed... Would I have to disable/uninstall apparmor as well? I would prefer not to do that.
    – Enter Display Name Here
    Feb 8, 2021 at 1:02
  • 1
    Apparently yes; that's how it works for me. I put my config as a guide to you, to further search about these parametres. You may find what is needed for your setup. I don't understand though why somebody gave me a negative vote.
    – Krackout
    Feb 8, 2021 at 7:21
  • @Krackout Happy to nullify that negative vote. I agree with Enter Display Name Here that I'd prefer not to disable AppArmor, but this is still useful information. Perhaps someone thought it belongs in a comment rather than a response.
    – Teekin
    Aug 14, 2022 at 16:12
  • @Krackout: In fact, this is similar to what's actually recommended in the Debian wiki regarding unprivileged containers, here: wiki.debian.org/LXC#Privileged_Vs._Unprivileged_Containers
    – Teekin
    Aug 14, 2022 at 16:16
0

Unprivileged users can't create apparmor namespaces. Use lxc.apparmor.profile = unconfined. That's also what the Debian Wiki suggests. You can also try lxc.apparmor.profile = lxc-container-default-cgns, but in this case network doesn't work in the container.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .