Recompiling apparmor on new kernel

[andwoo8182]

I am attempting to test a few newer but unsupported kernels, which boot fine, but apparmor breaks, diminishing my container security. I am attempting to test a high LXC container count (1350) (see threads below). I could test the containers without apparmor, but I would prefer to try do this recompile first. As I understand it, I have to recompile apparmor based on the new linux headers - in order to ensure that the profiles are set up correctly. Could anyone give me some guidance as to how to do this?

The specific error presented by the apparmor service is:
"profile doesn't conform to protocol"

Here is my current config:

Spoiler: package info

proxmox-ve: 6.2-1 (running kernel: 5.4.44-2-pve)
pve-manager: 6.2-6 (running version: 6.2-6/ee1d7754)
pve-kernel-5.4: 6.2-4
pve-kernel-helper: 6.2-4
pve-kernel-5.3: 6.1-6
pve-kernel-5.4.44-2-pve: 5.4.44-2
pve-kernel-5.4.44-1-pve: 5.4.44-1
pve-kernel-5.4.41-1-pve: 5.4.41-1
pve-kernel-5.4.34-1-pve: 5.4.34-2
pve-kernel-5.4.27-1-pve: 5.4.27-1
pve-kernel-5.4.24-1-pve: 5.4.24-1
pve-kernel-5.3.18-3-pve: 5.3.18-3
pve-kernel-5.3.18-2-pve: 5.3.18-2
pve-kernel-5.3.13-3-pve: 5.3.13-3
pve-kernel-5.3.10-1-pve: 5.3.10-1
ceph-fuse: 12.2.11+dfsg1-2.1+b1
corosync: 3.0.4-pve1
criu: 3.11-3
glusterfs-client: 5.5-3
ifupdown: not correctly installed
ifupdown2: 3.0.0-1+pve2
ksm-control-daemon: 1.3-1
libjs-extjs: 6.0.1-10
libknet1: 1.16-pve1
libproxmox-acme-perl: 1.0.4
libpve-access-control: 6.1-1
libpve-apiclient-perl: 3.0-3
libpve-common-perl: 6.1-3
libpve-guest-common-perl: 3.0-10
libpve-http-server-perl: 3.0-5
libpve-storage-perl: 6.1-8
libqb0: 1.0.5-1
libspice-server1: 0.14.2-4~pve6+1
lvm2: 2.03.02-pve4
lxc-pve: 4.0.2-1
lxcfs: 4.0.3-pve3
novnc-pve: 1.1.0-1
proxmox-mini-journalreader: 1.1-1
proxmox-widget-toolkit: 2.2-8
pve-cluster: 6.1-8
pve-container: 3.1-8
pve-docs: 6.2-4
pve-edk2-firmware: 2.20200531-1
pve-firewall: 4.1-2
pve-firmware: 3.1-1
pve-ha-manager: 3.0-9
pve-i18n: 2.1-3
pve-qemu-kvm: 5.0.0-4
pve-xtermjs: 4.3.0-1
qemu-server: 6.2-3
smartmontools: 7.1-pve2
spiceterm: 3.1-1
vncterm: 1.6-1
zfsutils-linux: 0.8.4-pve1

The reason I am attempting to test these newer kernels, is a result of the issue I have encountered in another thread I've started:

https://forum.proxmox.com/threads/s...seccomp-errors-vmap-allocation-failure.71483/

I have also started these threads, with the serverfault question leading down the attempt to test newer kernels against this issue, but I haven't really gained any further insight into the issue. There is a good level of detail on the serverfault question & comments:

https://serverfault.com/questions/1...aling-lxc-containers-past-1350-on-proxmox-6-2
https://discuss.linuxcontainers.org/t/scaling-past-1350-containers-seccomp-errors/8165

If anyone is able to give me some guidance for recompiling apparmor, thanks!

 

[razum2um]

Double the question. Otherwise people are forced to set unconfined profile into lxc configs (saw couple of such "advices": https://forum.proxmox.com/threads/c...driver-to-remove-rmrr-check.36374/post-305534).