[SOLVED] apparmor="DENIED" operation="mount"

[Andrii]

The output of dmesg:

[685820.161777] audit: type=1400 audit(1493135341.465:14758): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=6893 comm="(uetoothd)" flags="rw, rslave"

[685820.253235] audit: type=1400 audit(1493135341.557:14759): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=7122 comm="(uetoothd)" flags="rw, rslave"

[685820.282904] audit: type=1400 audit(1493135341.585:14760): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=7126 comm="(uetoothd)" flags="rw, rslave"

How to fix it?

 

[fabian]

Normally you don't. This just says that "uetoothd" (which is probably "bluetoothd") tried to mount something in the container and was prevented from doing so. Unless you actually need bluetoothd in a container (which I doubt the first place) and bluetoothd in turn actually needs that mount to succeed (which I also doubt), you can just safely ignore it (or even better - uninstall bluetoothd ).

 

[Andrii]

I understood. Thank you.

 

[Andrii]

It is strange, but I created a new node, setup only one VPS with Debian 8. No services on it. But have the same error. Why in this way?

 

[fabian]

This is not an error - it is a notification that AppArmor did its job. Your Debian 8 VPS probably has bluetoothd installed.

 

[Andrii]

It was not.

 

[dcsapak]

the package name is "bluez"

 

[Andrii]

The same answer - not installed.

 

[provotector]

I'm having the same issue, but this time with "nginx" instead of "uetoothd" I'm having this issue in all LXC containers even if nginx is not installed at the container. Maybe the problem source is at the host machine?

This is my error, at dmesg, at all containers:

[1052601.369736] audit: type=1400 audit(1511798473.059:228): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=31357 comm="(nginx)" flags="rw, rslave"

 

[provotector]

I provide an screenshot of dmesg

 

[inomaratadeath]

Hi.
Have same error in LXC container. In KWM VM - all works good, in LXC - mount not working

Spoiler: mount error in LXC

[root@centos6ts log]# mount.cifs //192.168.0.102/install /mnt/srvnas -o user=ftp%xxx
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

Dec 27 12:05:13 centos6ts kernel: [1014363.721593] audit: type=1400 audit(1514394313.428:12): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/mnt/srvnas/" pid=19594 comm="mount.cifs" fstype="cifs" srcname="//192.168.0.102/install/" flags="rw"

Sorry for bad english

 

[inomaratadeath]

So, everyone is fit?

 

[Arian]

Hello, I have a same problem with apparmor, any body have idea about that?
I have installed proxmox 5.1-43.

[1580440.662852] audit: type=1400 audit(1517123942.102:75): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=22423 comm="(httpd)" flags="rw, rslave"
[1580440.776860] audit: type=1400 audit(1517123942.216:76): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=22443 comm="(sh)" flags="rw, rslave"
[1581700.022076] audit: type=1400 audit(1517125201.470:77): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=9360 comm="(httpd)" flags="rw, rslave"
[1581700.601530] audit: type=1400 audit(1517125202.049:78): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=9406 comm="(sh)" flags="rw, rslave"
[1666240.646576] audit: type=1400 audit(1517209742.415:79): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=25080 comm="(httpd)" flags="rw, rslave"
[1666241.455838] audit: type=1400 audit(1517209743.224:80): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=25092 comm="(sh)" flags="rw, rslave"
[1666659.437052] audit: type=1400 audit(1517210161.207:81): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=31658 comm="(httpd)" flags="rw, rslave"
[1668279.478272] audit: type=1400 audit(1517211781.255:82): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-cgns" name="/" pid=24552 comm="(httpd)" flags="rw, rslave"

 

[Colorwebdesigner]

I have the same problem and I have found something similar to the solution here*, but I haven’t yet been able to check it. It is in russian language, but i translate for you the main idea:
---
Install the apparmor-utils package and then send two sessions to the server. In one session, perform:

genprof /usr/bin/lxc-start

In another session run the process. After this, a genprof session will offer you what you really want the process to have access to.
---
AppArmor description.**
How to Create AppArmor Profiles to Lock Down Programs.***

Unfortunately, I did not yet have time to deep study the issue in practice, but I think the solution is here. If someone will try this method, please give a feedback here about result.

* ru.1answer.info/756e6978-7a33383434363
** howtogeek.com/118222/htg-explains-what-apparmor-is-and-how-it-secures-your-ubuntu-system/
*** howtogeek.com/118328/how-to-create-apparmor-profiles-to-lock-down-programs-on-ubuntu/