systemd v239 (networkd && resolved) containers broken by AA

[jwh]

Hi guys,

Just stumbled across this one - using Arch in a container, once upgraded to v239 (which uses dynamic users for networkd and resolved), AA seems to be breaking it for some reason, setting the profile to unconfined allows it to work - unprivileged container is not enough

Just wondering if anyone had come across this yet?

Container journal:

systemd[51]: systemd-networkd.service: Failed to update dynamic user credentials: Permission denied
systemd[51]: systemd-networkd.service: Failed at step USER spawning /usr/lib/systemd/systemd-networkd: Permission denied

 

[jwh]

So it's actually being denied the ability to create a lock on a socket it would appear?

Jul 14 16:47:44 vm1 audit[3315869]: AVC apparmor="DENIED" operation="file_lock" profile="lxc-container-default-cgns" pid=3315869 comm="systemd" family="unix" sock_type="dgram" protocol=0 addr=none
Jul 14 16:47:44 vm1 audit[3315869]: AVC apparmor="DENIED" operation="file_lock" profile="lxc-container-default-cgns" pid=3315869 comm="systemd" family="unix" sock_type="dgram" protocol=0 addr=none
Jul 14 16:47:44 vm1 audit[3316074]: AVC apparmor="DENIED" operation="file_lock" profile="lxc-container-default-cgns" pid=3316074 comm="(networkd)" family="unix" sock_type="dgram" protocol=0 addr=none
Jul 14 16:47:44 vm1 audit[3316074]: AVC apparmor="DENIED" operation="file_lock" profile="lxc-container-default-cgns" pid=3316074 comm="(networkd)" family="unix" sock_type="dgram" protocol=0 addr=none
Jul 14 16:47:44 vm1 audit[3316074]: AVC apparmor="DENIED" operation="file_lock" profile="lxc-container-default-cgns" pid=3316074 comm="(networkd)" family="unix" sock_type="dgram" protocol=0 addr=none
Jul 14 16:47:44 vm1 audit[3316074]: AVC apparmor="DENIED" operation="file_lock" profile="lxc-container-default-cgns" pid=3316074 comm="(networkd)" family="unix" sock_type="dgram" protocol=0 addr=none

How do I tell this apparmor nonsense to allow it?

 

[wbumiller]

Apparmor in the ubuntu bionic kernel supports a new feature (socket mediation) which the userspace tools don't make use of because upstream it was moved to a newer ABI version. (Iow. our kernel doesn't advertise the feature to the user space tools and therefore they don't know about it and therefore don't configure it as needed.)

See also:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1780227
https://github.com/systemd/systemd/issues/9493

 

[jwh]

Ah I didn't come across those, makes sense!

Are you guys going to wait until its backported?

 

[wbumiller]

Depends on how long it takes. The fixes need to appear upstream first.

 

[wbumiller]

They ended up with a kernel-side fix for this. There's a kernel in the `pvetest` repository ready to be tested. Package pve-kernel-4.15.18-1-pve version 4.15.18-17.

 

[tippy]

New kernel fixed it for me. I can now boot Arch containers that use the new systemd version.