Hi,
I have been attempting to mount a ZFS dataset in a LXC container, but cannot get past the "error=-13 profile" error. I have been searching the internet and forums to find a concrete solution, but nothing seems to work. Adding "nesting=1", seems to resolve most of the apparmor errors, except for one. I have tried just about everything, but cannot get rid of the error. I initially tried with the TK File Server, then moved on to Debian with Samba, but always the same error. Does anyone know how to resolve this?
"apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="/usr/bin/lxc-start" name="/proc/sys/kernel/random/boot_id" pid=49104 comm="lxc-start" srcname="/dev/.lxc-boot-id" flags="rw, bind""
I have been attempting to mount a ZFS dataset in a LXC container, but cannot get past the "error=-13 profile" error. I have been searching the internet and forums to find a concrete solution, but nothing seems to work. Adding "nesting=1", seems to resolve most of the apparmor errors, except for one. I have tried just about everything, but cannot get rid of the error. I initially tried with the TK File Server, then moved on to Debian with Samba, but always the same error. Does anyone know how to resolve this?
"apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="/usr/bin/lxc-start" name="/proc/sys/kernel/random/boot_id" pid=49104 comm="lxc-start" srcname="/dev/.lxc-boot-id" flags="rw, bind""
Code:
pveversion
proxmox-ve: 6.2-1 (running kernel: 5.4.44-1-pve)
pve-manager: 6.2-6 (running version: 6.2-6/ee1d7754)
pve-kernel-5.4: 6.2-3
pve-kernel-helper: 6.2-3
pve-kernel-5.3: 6.1-6
pve-kernel-5.4.44-1-pve: 5.4.44-1
pve-kernel-5.4.41-1-pve: 5.4.41-1
pve-kernel-5.3.18-3-pve: 5.3.18-3
pve-kernel-5.3.10-1-pve: 5.3.10-1
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.3-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: residual config
ifupdown2: 3.0.0-1+pve2
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.15-pve1
libproxmox-acme-perl: 1.0.4
libpve-access-control: 6.1-1
libpve-apiclient-perl: 3.0-3
libpve-common-perl: 6.1-3
libpve-guest-common-perl: 3.0-10
libpve-http-server-perl: 3.0-5
libpve-storage-perl: 6.1-8
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 4.0.2-1
lxcfs: 4.0.3-pve2
novnc-pve: 1.1.0-1
openvswitch-switch: 2.12.0-1
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.2-7
pve-cluster: 6.1-8
pve-container: 3.1-8
pve-docs: 6.2-4
pve-edk2-firmware: 2.20200531-1
pve-firewall: 4.1-2
pve-firmware: 3.1-1
pve-ha-manager: 3.0-9
pve-i18n: 2.1-3
pve-qemu-kvm: 5.0.0-4
pve-xtermjs: 4.3.0-1
qemu-server: 6.2-3
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-1
zfsutils-linux: 0.8.4-pve1
Code:
systemctl -a |grep lxcfs
var-lib-lxcfs.mount loaded active mounted /var/lib/lxcfs
lxcfs.service loaded active
Code:
systemctl status -l lxcfs.service
● lxcfs.service - FUSE filesystem for LXC
Loaded: loaded (/lib/systemd/system/lxcfs.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2020-06-19 10:07:36 MDT; 5 days ago
Docs: man:lxcfs(1)
Main PID: 3439 (lxcfs)
Tasks: 4 (limit: 8601)
Memory: 33.6M
CGroup: /system.slice/lxcfs.service
└─3439 /usr/bin/lxcfs /var/lib/lxcfs
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - proc_diskstats
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - proc_loadavg
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - proc_meminfo
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - proc_stat
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - proc_swaps
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - proc_uptime
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - shared_pidns
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - cpuview_daemon
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - loadavg_daemon
Jun 19 10:07:36 tu-psvr-vs-01 lxcfs[3439]: - pidfds
Code:
fgrep -r cgns /etc/apparmor.d
/etc/apparmor.d/lxc/lxc-default-cgns:profile lxc-container-default-cgns flags=(attach_disconnected,mediate_deleted) {
Code:
arch: amd64
cores: 1
features: mount=nfs;cifs,nesting=1
hostname: fileserver
memory: 512
mp0: /dpool/storage,mp=/storage
nameserver: 192.168.10.1
net0: name=eth0,bridge=vmbr1,gw=192.168.10.1,hwaddr=0A:E0:F0:95:8A:3C,ip=192.168.10.31/24,tag=10,type=veth
ostype: debian
rootfs: zfs-containers:subvol-101-disk-0,size=8G
swap: 512
Code:
# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc
profile lxc-container-default-cgns flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/lxc/container-base>
# the container may never be allowed to mount devpts. If it does, it
# will remount the host's devpts. We could allow it to do it with
# the newinstance option (but, right now, we don't).
deny mount fstype=devpts,
mount fstype=cgroup -> /sys/fs/cgroup/**,
mount fstype=cgroup2 -> /sys/fs/cgroup/**,
mount fstype=nfs*,
mount fstype=rpc_pipefs,
}
