[SOLVED] apache2.service: Failed to set up mount namespacing: Permission denied

[RobFantini]

this issue started when we upgraded an lxc to buster.

systemctl status apache2.service
● apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2019-08-11 09:52:05 EDT; 9ms ago
     Docs: https://httpd.apache.org/docs/2.4/
  Process: 32501 ExecStart=/usr/sbin/apachectl start (code=exited, status=226/NAMESPACE)

Aug 11 09:52:05 backuppc systemd[1]: Starting The Apache HTTP Server...
Aug 11 09:52:05 backuppc systemd[32501]: apache2.service: Failed to set up mount namespacing: Permission denied
Aug 11 09:52:05 backuppc systemd[32501]: apache2.service: Failed at step NAMESPACE spawning /usr/sbin/apachectl: Permission denied
Aug 11 09:52:05 backuppc systemd[1]: apache2.service: Control process exited, code=exited, status=226/NAMESPACE
Aug 11 09:52:05 backuppc systemd[1]: apache2.service: Failed with result 'exit-code'.
Aug 11 09:52:05 backuppc systemd[1]: Failed to start The Apache HTTP Server.

solution was to set nesting option for the lxc.

 

[puldi]

Thank you very much. Had the same issue and just was about to reinstall the container. Your hint helped me fix it.
BUT: I neither did an upgrade to buster inside container nor did I on Proxmox host. The issue appeared after restarting the container which hasn't been modified for some months now. Strange!

 

[RobFantini]

Thank you very much. Had the same issue and just was about to reinstall the container. Your hint helped me fix it.
BUT: I neither did an upgrade to buster inside container nor did I on Proxmox host. The issue appeared after restarting the container which hasn't been modified for some months now. Strange!

may have due to an update to apache2 or something ? or lxc on the host.

 

[Yuneldeltoro]

this issue started when we upgraded an lxc to buster.

systemctl status apache2.service
● apache2.service - The Apache HTTP Server
   Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
   Active: failed (Result: exit-code) since Sun 2019-08-11 09:52:05 EDT; 9ms ago
     Docs: https://httpd.apache.org/docs/2.4/
  Process: 32501 ExecStart=/usr/sbin/apachectl start (code=exited, status=226/NAMESPACE)

Aug 11 09:52:05 backuppc systemd[1]: Starting The Apache HTTP Server...
Aug 11 09:52:05 backuppc systemd[32501]: apache2.service: Failed to set up mount namespacing: Permission denied
Aug 11 09:52:05 backuppc systemd[32501]: apache2.service: Failed at step NAMESPACE spawning /usr/sbin/apachectl: Permission denied
Aug 11 09:52:05 backuppc systemd[1]: apache2.service: Control process exited, code=exited, status=226/NAMESPACE
Aug 11 09:52:05 backuppc systemd[1]: apache2.service: Failed with result 'exit-code'.
Aug 11 09:52:05 backuppc systemd[1]: Failed to start The Apache HTTP Server.

solution was to set nesting option for the lxc.

the solution without nesting:
https://stackoverflow.com/questions/55728957/apache-failed-at-step-namespace
https://help.directadmin.com/item.php?id=614

$ sudo sed -i -e 's,PrivateTmp=true,PrivateTmp=false\nNoNewPrivileges=yes,g' /lib/systemd/system/apache2.service
$ sudo systemctl daemon-reload
$ sudo systemctl start apache2.service
$ sudo systemctl status apache2.service

 

[owlnical]

Just to verify, Yuneldeltoro's solution works as well. I used it on a Debian 10 container.

 

[Psilospiral]

solution was to set nesting option for the lxc.

Thank you for posting this, RobFantini. Your post allowed me to quickly solve a problem. I ran into this same 'namespacing permission denied' issue that was noted in my systemctl logs while creating a CT for a Syncthing server. Simply checking Options>Features>Nesting:ON took care of the problem!

 

[BrandonN]

the solution without nesting:
https://stackoverflow.com/questions/55728957/apache-failed-at-step-namespace
https://help.directadmin.com/item.php?id=614

$ sudo sed -i -e 's,PrivateTmp=true,PrivateTmp=false\nNoNewPrivileges=yes,g' /lib/systemd/system/apache2.service
$ sudo systemctl daemon-reload
$ sudo systemctl start apache2.service
$ sudo systemctl statup apache2.service

Hi for everyone, I confirm the solution too. Thank you so much!

 

[lenny30]

Hi,
can you explain, why nested helps in this case?
Thanks

 

[RobFantini]

not sure if you were asking about nesting or systemd method.

i am not an expert at lxc. however I've read a few places where nesting is a useful feature. for instance this mentions 'However, we heavily encourage the use of unprivileged containers whenever possible. Nesting with unprivileged containers works just as well, but requires an extra step.'

https://ubuntu.com/blog/nested-containers-in-lxd

 

[Baulder]

The solution provided by Yuneldeltoro is right but direct editing of service configuration file is not so beautiful. It's better to edit it by `systemctl edit apache2` command or create override config:

$ sudo cat << EOF >> /etc/systemd/system/apache2.service.d/override.conf # /lib/systemd/system/apache2.service [Service] PrivateTmp=false NoNewPrivileges=yes EOF sudo systemctl daemon-reload sudo systemctl start apache2.service

 

[Darkk]

When I upgraded the LXC container from Debian 10 to 11 it broke redis-server for Nextcloud. I've spent countless hours reading through the forums for any idea how to fix it until I saw this post. I've figured it had to be permission issue. chown / chgrp had no effect.

Enabling the nesting feature on the container worked. It also fixed the slow logging into SSH and changing to root. Strange.

Also, I've noticed new containers automatically enable nesting by default.

 

[Stoiko Ivanov]

Enabling the nesting feature on the container worked. It also fixed the slow logging into SSH and changing to root. Strange.

Newer systemd-based containers need the setting (it's mentioned in the 7.1 release-notes) - which is also why it's enabled by default for new (unprivileged) container creations
https://pve.proxmox.com/wiki/Roadmap#Proxmox_VE_7.1

I hope this explains it!

 

[Darkk]

Newer systemd-based containers need the setting (it's mentioned in the 7.1 release-notes) - which is also why it's enabled by default for new (unprivileged) container creations
https://pve.proxmox.com/wiki/Roadmap#Proxmox_VE_7.1

I hope this explains it!

Thanks for pointing that out. Didn't know.

 

[GargFunk]

We had some problems with pages that use setuid and setgid scripts (eg to inject mail). The above comment #10 worked with =no instead of =yes to allow those through again, in case someone else hits this page to figure out these issues!

 

[le_top]

I created this script (for apache) to add the override to the systemd configuration.
Easier to repeat on different servers.

#!/bin/bash

# run using sudo or root

OVERRIDE_FILE=/etc/systemd/system/apache2.service.d/override.conf
if [ ! -r "${OVERRIDE_FILE}" ] ; then
    mkdir -p "$(dirname "${OVERRIDE_FILE}")"
    cat > "${OVERRIDE_FILE}" <<EOF
[Service]
PrivateTmp=false
NoNewPrivileges=yes
EOF
    systemctl daemon-reload
else
    echo "'${OVERRIDE_FILE}' already exists"
fi

echo "Contents of '${OVERRIDE_FILE}':"
cat "${OVERRIDE_FILE}"

It was also possible to restart apache interactively using "apachectl -k restart" - useful as a quick fix before permanently fixing it.