Proxmox with working apparmor inside debian containers

[user18587]

Hello

I'm trying to make Apparmor work inside debian containers ( on proxmox 6), i mean nested apparmor rules (container rules for services running inside the container).

I've come with a working configuration on a default debian Buster, by adding the following to the LXC container configuration:

#the ubuntu one has the needed /sys mounts
lxc.include: /usr/share/lxc/config/ubuntu.common.conf
lxc.include: /usr/share/lxc/config/nesting.conf
lxc.apparmor.profile: generated
lxc.cap.drop:
lxc.cap.drop: sys_time sys_module sys_rawio
lxc.apparmor.allow_nesting: 1

and it works almost perfectly inside the vps. There are only 2 downsides:

1) Profiles need to be reenforced on container start as it doesn't save them
2) Network rules are ignored and never enforced

With proxmox it's annoying as it will reorder some things inside the LXC configuration, but we can do this trick in the proxmox container configuration:

replace
ostype: debian

with
ostype: ubuntu

This forces the lxc configuration to have ubuntu.common.conf which contains the required /sys mounts

and add:

features: nesting=1

There is the same issue that apparmor profiles need to be reenforced on boot, but there is one huge issue:
Network rules for DGRAM and RAW packets are enforced but CANNOT be whitelisted.

For example adding an apparmor profile for traceroute will trigger

[XXX] audit: type=1400 audit(XXX): apparmor="DENIED" operation="create" namespace="root//lxc-XXXXXX_<-var-lib-lxc>" profile="traceroute" pid=2451 comm="traceroute" family="inet" sock_type="dgram" protocol=17 requested_mask="create" denied_mask="create"

even if we allow dgram/raw packets in the profile

This bug was already present on a default debian stretch, but it is fixed in a default debian buster install by simply ignoring network rules.

I don't know if it's a proxmox kernel bug but right now i'm unable to have a working apparmor inside proxmox containers.

Did anybody succeed?

 

[user18587]

it works as it should with an ubuntu container: ignores network rules, but works on reboot and other protections work.
I tried with a debian bullseye container (debian testing), and profiles reload on reboot, but there's the same bug with the network rules..
I installed debian buster and installed ubuntu apparmor packages, and it works like in ubuntu, network rules ignored which is fine.

I'm curious that nobody has requested about this issue, maybe everybody switched to ubuntu...

However since it works on debian lxc, with a debian kernel, i wonder if this is because the ubuntu apparmor package contains something specific that the proxmox (based on ubuntu) kernel has?

Is there any workaround apart from installing the ubuntu apparmor package?

 

[user18587]

This seems to be this bug:

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1842459

What breaks is

features-file=/usr/share/apparmor-features/features

In /etc/apparmor/parser.conf in debian

This might be in the compiler
The feature file you are inning supports v8 socket mediation. The user space however does not. The ubuntu kernel supports v7 and v8 socket mediation, but the user space only supports v7. I need to dig into this more but it looks like the user space compiler is generating v7 network rules when using the ubuntu kernel.
2.13 actually uses two feature sets the kernel features (--kernel-features, used to determine cache location and bound compile features to what the kernel can actually load) and the compile features (--compile-features). They can be set separately but the --features-file option is supposed to set both of them to the same value.
There is a a bug in 2.13.2 where --features-file is only setting the compile-features. This was addressed by upstream commit e83fa67edfb534976dc4133e634519084153c0e7.
We should be able to test whether this patch is the fix by set both features-file and kernel-features to the same file.