I have a problem which might be normal behavior or not, I'm looking for confirmation.
Every time I start a privileged container or restart apparmor inside I get the following message in the host's syslog:
Also apparmor inside the container fails:
Even so everything works this really grinds my gears.
Running unprivileged container with or without nesting does not produce this error message. Enabling nesting on the privileged container after creation does not change anything, I still get the error message.
(I'm running privileged containers because I'm bind mounting ZFS datasets inside the container and I want to see the same user/groups inside and outside. It's a home server on a local network)
The template is base Ubuntu 20.04 downloaded via the GUI.
pveversion -v
Every time I start a privileged container or restart apparmor inside I get the following message in the host's syslog:
Code:
Apr 12 17:49:12 pm kernel: [154462.321869] audit: type=1400 audit(1649778552.937:390): apparmor="STATUS" operation="profile_replace" info="not policy admin" error=-13 label="lxc-115_</var/lib/lxc>//&:lxc-115_<-var-lib-lxc>:unconfined" pid=4082008 comm="apparmor_parser"Also apparmor inside the container fails:
Code:
* apparmor.service - Load AppArmor profiles
Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor preset: enabled)
Active: failed (Result: exit-code) since Tue 2022-04-12 16:03:06 UTC; 15s ago
Docs: man:apparmor(7)
https://gitlab.com/apparmor/apparmor/wikis/home/
Process: 77 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited, status=1/FAILURE)
Main PID: 77 (code=exited, status=1/FAILURE)
CPU: 1.058s
Apr 12 16:03:05 ptest apparmor.systemd[128]: /sbin/apparmor_parser: Unable to replace "nvidia_modprobe". Permission denied; attempted to load a profile wh>
Apr 12 16:03:06 ptest apparmor.systemd[130]: /sbin/apparmor_parser: Unable to replace "/usr/lib/NetworkManager/nm-dhcp-client.action". Permission denied; >
Apr 12 16:03:06 ptest apparmor.systemd[132]: /sbin/apparmor_parser: Unable to replace "/usr/bin/man". Permission denied; attempted to load a profile while>
Apr 12 16:03:06 ptest apparmor.systemd[134]: Skipping profile in /etc/apparmor.d/disable: usr.sbin.rsyslogd
Apr 12 16:03:06 ptest apparmor.systemd[136]: /sbin/apparmor_parser: Unable to replace "/usr/sbin/tcpdump". Permission denied; attempted to load a profile >
Apr 12 16:03:06 ptest apparmor.systemd[77]: Error: At least one profile failed to load
Apr 12 16:03:06 ptest systemd[1]: apparmor.service: Main process exited, code=exited, status=1/FAILURE
Apr 12 16:03:06 ptest systemd[1]: apparmor.service: Failed with result 'exit-code'.
Apr 12 16:03:06 ptest systemd[1]: Failed to start Load AppArmor profiles.
Apr 12 16:03:06 ptest systemd[1]: apparmor.service: Consumed 1.058s CPU time.Even so everything works this really grinds my gears.
Running unprivileged container with or without nesting does not produce this error message. Enabling nesting on the privileged container after creation does not change anything, I still get the error message.
(I'm running privileged containers because I'm bind mounting ZFS datasets inside the container and I want to see the same user/groups inside and outside. It's a home server on a local network)
The template is base Ubuntu 20.04 downloaded via the GUI.
pveversion -v
Code:
proxmox-ve: 7.1-1 (running kernel: 5.13.19-4-pve)
pve-manager: 7.1-10 (running version: 7.1-10/6ddebafe)
pve-kernel-helper: 7.1-10
pve-kernel-5.13: 7.1-7
pve-kernel-5.11: 7.0-10
pve-kernel-5.4: 6.4-7
pve-kernel-libc-dev: 5.15.19-1
pve-kernel-5.13.19-4-pve: 5.13.19-9
pve-kernel-5.11.22-7-pve: 5.11.22-12
pve-kernel-5.11.22-5-pve: 5.11.22-10
pve-kernel-5.4.143-1-pve: 5.4.143-1
pve-kernel-5.4.78-2-pve: 5.4.78-2
pve-kernel-5.4.73-1-pve: 5.4.73-1
ceph-fuse: 14.2.21-1
corosync: 3.1.5-pve2
criu: 3.15-1+pve-1
glusterfs-client: 9.2-1
ifupdown: residual config
ifupdown2: 3.1.0-1+pmx3
ksm-control-daemon: 1.4-1
libjs-extjs: 7.0.0-1
libknet1: 1.22-pve2
libproxmox-acme-perl: 1.4.1
libproxmox-backup-qemu0: 1.2.0-1
libpve-access-control: 7.1-6
libpve-apiclient-perl: 3.2-1
libpve-common-perl: 7.1-2
libpve-guest-common-perl: 4.0-3
libpve-http-server-perl: 4.1-1
libpve-storage-perl: 7.1-1
libqb0: 1.0.5-1
libspice-server1: 0.14.3-2.1
lvm2: 2.03.11-2.1
lxc-pve: 4.0.11-1
lxcfs: 4.0.11-pve1
novnc-pve: 1.3.0-1
proxmox-backup-client: 2.1.5-1
proxmox-backup-file-restore: 2.1.5-1
proxmox-mini-journalreader: 1.3-1
proxmox-widget-toolkit: 3.4-5
pve-cluster: 7.1-3
pve-container: 4.1-3
pve-docs: 7.1-2
pve-edk2-firmware: 3.20210831-2
pve-firewall: 4.2-5
pve-firmware: 3.3-5
pve-ha-manager: 3.3-3
pve-i18n: 2.6-2
pve-qemu-kvm: 6.1.1-1
pve-xtermjs: 4.16.0-1
qemu-server: 7.1-4
smartmontools: 7.2-pve2
spiceterm: 3.2-2
swtpm: 0.7.0~rc1+2
vncterm: 1.7-1
zfsutils-linux: 2.1.2-pve1
