Good morning,
and good news. After moving all important VMs to the other two servers I have been able to reboot the first Proxmox server.
Before the reboot the two mitigations for the recent kernel security issues (Copy Fail and Dirty Frag...
@fabian: ptrace_Scope gets not set via /lib/sysctl.d. The directory /usr/local/lib/sysctl.d does not exist.
I think I will try to reboot one server tomorrow morning. Let see to what the value of kernel.yama.ptrace_scope will be set to.
And let's...
@fabian: no worries. I am glad that we have found the reason for the non-starting LXCs. Even when I still not understand how and why the value has been changed to 3.
@Impact: no files found
I theory I should be able to change the value on...
So now I do understand you. The non-default kernel.yama.ptrace_scope = 3 might cause the issues. Now we need to understand why it is not set to 1 which I assume should be the default. At least I see kernel.yama.ptrace_scope = 1 on my home-lab...
As far as I know the only changes that have been made can be found in /etc/modprobe.de:
One is dirty-frag.conf
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
And for copy-fail called disable-algif.conf
install...
Hm,
not sure if this setting has been touched. Here is the wanted output:
root@proxmox-2:~# sysctl kernel.yama.ptrace_scope
kernel.yama.ptrace_scope = 3
Thanks Daniel for providing the correct command syntax.
Here is the correct output from journalctl that does contain the failed start of LXC. Just the clearify: it is not only this container that fails. I see all containers not working on our 3...
Good morning,
apt -U dist-upgrade works fine. No errors. I just have updated librabbitmq4.
systemctl --failed shows me those two LXCs that I tried to restart on this server:
root@proxmox-2:~# systemctl --failed
UNIT LOAD...
Sorry I forgot to post this part. I am not sure what part is of interest. I think this line might show the error?
[Jun12 13:24] audit: type=1400 audit(1781263485.458:15832): apparmor="DENIED" operation="getattr" class="posix_mqueue"...
Hi,
I just have upgraded our PVE environment from 9.1.x (not sure which version it has been) to 9.2.2. using the productive repro. PVE-Container version is 6.1.10
Now I am not able to start any LXCs anymore.
Starting the LCX in debug shows me...