1000's of audit message

[lweidig]

Our dmesg is filled with 1000's of these messages on one of our cluster machines:

[786621.940755] audit: type=1400 audit(1454507557.790:1241952): apparmor="DENIED"
 operation="ptrace" profile="lxc-container-default" pid=29054 comm="ps" requested_mask="trace"
 denied_mask="trace" peer="unconfined"

How do we go about figuring out which container is causing this (NO we cannot shut them all down and start one at a time, this is production) and then in the container the reason?

Thanks!

 

[morph027]

Have a look at this...

https://forum.proxmox.com/threads/apparmor-fills-up-log-with-denied-ptrace-messages.25532/

My workaround did it for some time, but now the messages are back

 

[wbumiller]

Looks like either a host process (unconfined) entered the container's PID namespace, or something executed 'ps' on the host with the lxc-container-default profile.
Or someone passed a filehandle to a trace-permission protected /proc file to the container somehow...
None of these things should happen... if you're using check_mk (like in the other thread) you should probably ping the check_mk devs.

 

[morph027]

Just checked a bunch of our servers and the messages are gone. So you might try the solution from the other thread. And please don't run anything with unconfined profiles like someone might suggest just make things work/gone/easy...