[SOLVED] lxc-pve 6.0 AND apparmor 4.0 results "Permission denied - Failed to clone a new set of namespaces"

S

Swifty.hu

Active Member
Jan 23, 2021
35
3
28
Germany - Hungary
swifty.hu
Hi everyone,


As someone who frequently experiments with bleeding-edge software, I recently encountered an issue that might be helpful to share.


After upgrading to the latest versions of both lxc-pve and AppArmor, I noticed a conflict that prevented my container from starting properly. It appears there's an incompatibility between the newest lxc-pve package and the testing AppArmor release.


Fortunately, downgrading lxc-pve to version 5.0.2-4 resolved the issue, and my container is now running again as expected.


Just a heads-up for anyone running into similar problems. Hopefully, this helps until a more permanent fix is released.


ISSUE:

Code: 
lxc_spawn: 1738 Permission denied - Failed to clone a new set of namespaces
__lxc_start: 2114 Failed to spawn container "800"
startup for container '800' failed


Code: 
audit: type=1400 audit(1744022208.875:180): apparmor="DENIED" operation="userns_create" class="namespace" profile="/usr/bin/lxc-start" pid=16111 comm="lxc-start" requested="userns_create" denied="userns_create
 
Hi!

Could you provide the output of pveversion -v and more information about the container's config? Are there any additional changes or custom configs done on the container that fails to start? What is the output of pct start 800 --debug?
 
Hi!

Sure!
No custom editing regarding the config. (See below.)

Code: 
# pveversion -v
proxmox-ve: 8.3.0 (running kernel: 6.14.0-1-pve)
pve-manager: 8.3.5 (running version: 8.3.5/dac3aa88bac3f300)
proxmox-kernel-helper: 8.1.1
proxmox-kernel-6.14.0-1-pve-signed: 6.14.0-1
proxmox-kernel-6.14: 6.14.0-1
proxmox-kernel-6.8: 6.8.12-9
proxmox-kernel-6.8.12-9-pve-signed: 6.8.12-9
pve-kernel-libc-dev: 6.2.16-3
ceph-fuse: 18.2.4+ds-13+b1
corosync: 3.1.9-pve1
criu: 4.1-1
dnsmasq: 2.91-1
glusterfs-client: 11.1-5+b1
ifupdown2: 3.2.0-1+pmx11
ksm-control-daemon: 1.5-1
libjs-extjs: 7.0.0-5
libknet1: not correctly installed
libproxmox-acme-perl: 1.6.0
libproxmox-backup-qemu0: 1.5.1
libproxmox-rs-perl: 0.3.5
libpve-access-control: 8.2.1
libpve-apiclient-perl: 3.3.2
libpve-cluster-api-perl: 8.1.0
libpve-cluster-perl: 8.1.0
libpve-common-perl: 8.3.0
libpve-guest-common-perl: 5.2.0
libpve-http-server-perl: 5.2.0
libpve-network-perl: 0.10.1
libpve-rs-perl: 0.9.3
libpve-storage-perl: 8.3.5
libspice-server1: 0.15.2-1+b1
lvm2: 2.03.31-1
lxc-pve: 5.0.2-4
lxcfs: 6.0.4-1
novnc-pve: 1.6.0-2
proxmox-backup-client: 3.3.7-1
proxmox-backup-file-restore: 3.3.7-1
proxmox-kernel-helper: 8.1.1
proxmox-mail-forward: 0.3.1
proxmox-mini-journalreader: 1.4.0
proxmox-widget-toolkit: 4.3.8
pve-cluster: 8.1.0
pve-container: 5.2.5
pve-docs: 8.3.1
pve-edk2-firmware: not correctly installed
pve-firewall: 5.1.0
pve-firmware: 3.15-3
pve-ha-manager: 4.0.6
pve-i18n: 3.4.1
pve-qemu-kvm: 9.2.0-5
pve-xtermjs: 5.5.0-1
qemu-server: 8.3.10
smartmontools: 7.4-3
spiceterm: 3.3.0
swtpm: 0.8.0+pve1
vncterm: 1.8.0
zfsutils-linux: 2.2.7-pve2


Code: 
# pct start 800 --debug
lxc_spawn: 1738 Permission denied - Failed to clone a new set of namespaces
__lxc_start: 2114 Failed to spawn container "800"
ile - ../src/lxc/confile.c:set_config_idmaps:2273 - Read uid map: type g nsid 0 hostid 100000 range 65536
INFO     lsm - ../src/lxc/lsm/lsm.c:lsm_init_static:38 - Initialized LSM security driver AppArmor
INFO     utils - ../src/lxc/utils.c:run_script_argv:587 - Executing script "/usr/share/lxc/hooks/lxc-pve-prestart-hook" for container "800", config section "lxc"
INFO     cgfsng - ../src/lxc/cgroups/cgfsng.c:unpriv_systemd_create_scope:1498 - Running privileged, not using a systemd unit
DEBUG    seccomp - ../src/lxc/seccomp.c:parse_config_v2:664 - Host native arch is [3221225534]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:532 - Set seccomp rule to reject force umounts
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:532 - Set seccomp rule to reject force umounts
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:532 - Set seccomp rule to reject force umounts
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "[all]"
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "kexec_load errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "open_by_handle_at errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "init_module errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "finit_module errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "delete_module errno 1"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "ioctl errno 1 [1,0x9400,SCMP_CMP_MASKED_EQ,0xff00]"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(1, 7, 65280, 37888)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[16:ioctl] action[327681:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(1, 7, 65280, 37888)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[16:ioctl] action[327681:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:555 - arg_cmp[0]: SCMP_CMP(1, 7, 65280, 37888)
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[16:ioctl] action[327681:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:815 - Processing "keyctl errno 38"
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding native rule for syscall[250:keyctl] action[327718:errno] arch[0]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[250:keyctl] action[327718:errno] arch[1073741827]
INFO     seccomp - ../src/lxc/seccomp.c:do_resolve_add_rule:572 - Adding compat rule for syscall[250:keyctl] action[327718:errno] arch[1073741886]
INFO     seccomp - ../src/lxc/seccomp.c:parse_config_v2:1036 - Merging compat seccomp contexts into main context
INFO     start - ../src/lxc/start.c:lxc_init:882 - Container "800" is initialized
INFO     cgfsng - ../src/lxc/cgroups/cgfsng.c:cgfsng_monitor_create:1669 - The monitor process uses "lxc.monitor/800" as cgroup
DEBUG    storage - ../src/lxc/storage/storage.c:storage_query:231 - Detected rootfs type "dir"
DEBUG    storage - ../src/lxc/storage/storage.c:storage_query:231 - Detected rootfs type "dir"
INFO     cgfsng - ../src/lxc/cgroups/cgfsng.c:cgfsng_payload_create:1777 - The container process uses "lxc/800/ns" as inner and "lxc/800" as limit cgroup
ERROR    start - ../src/lxc/start.c:lxc_spawn:1738 - Permission denied - Failed to clone a new set of namespaces
DEBUG    network - ../src/lxc/network.c:lxc_delete_network:4217 - Deleted network devices
ERROR    start - ../src/lxc/start.c:__lxc_start:2114 - Failed to spawn container "800"
startup for container '800' failed

Code: 
# cat /etc/pve/lxc/800.conf
#**PI-HOLE**
arch: amd64
cores: 2
cpulimit: 1.5
features: nesting=1
hostname: pihole
memory: 512
nameserver: 10.0.0.253
net0: name=eth0,bridge=vmbr0,gw=10.0.0.254,hwaddr=26:15:B0:42:7A:B0,ip=10.0.0.252/24,type=veth
onboot: 1
ostype: debian
rootfs: ssd-pve:subvol-800-disk-0,size=8G
searchdomain: REDACTED.office
startup: order=800
swap: 0
tags: vmbr0
unprivileged: 1

Code: 
# dpkg-query -f '${Version}\n' -W apparmor
4.1.0~beta5-6
 
PVE 8.x is based on Bookworm, you can't just install random packages from Trixie/unstable and expect things to work..
 
  • Like
Reactions: fiona, cheiss and dakralex
Which repositories have you used to update to apparmor 4? Neither Debian nor Proxmox VE repositories have that version available.
 
Thank you for taking the time to reply — I appreciate your input.


In my original post, I did mention that I often play around with "bleeding edge" software. By that, I was indeed referring to packages from Debian Trixie/unstable. I understand now that this might have been misleading, and I apologize if it caused any confusion.


Yes, I am intentionally using Trixie packages, and while I’m aware this setup is not officially supported by Proxmox, I’ve actually had quite a smooth experience so far. Of course, a few exceptions exist — like needing to hold back specific versions of packages such as apparmor or lxc-pve to maintain stability.


Perhaps I should have marked the thread as "Solved" to avoid raising unnecessary concerns — I’ll keep that in mind for future posts.


That said, I still believe the issue I reported might be valuable for future consideration. The fact that an older version of lxc-pve works properly with the newer 4.1 series of AppArmor could be useful information for the Proxmox team as they move forward with development and compatibility planning.


Thanks again,
Swifty
 
  • Like
Reactions: Swifty.hu
You must log in or register to reply here.
Top Bottom