Welcome to the Linux Foundation Forum!

Lab3.2 lxc - permission denied - apparmor error?

Posts: 3
edited November 2024 in LFS253 Class Forum

Hello,

I seem to be unable to start a new unpriviliged container with lxc

  1. $ lxc-start -n unpriv-cont-user -F
  2. lxc-start: unpriv-cont-user: ../src/lxc/lsm/apparmor.c: make_apparmor_namespace: 869 Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-unpriv-cont-user_<-home-cherif-.local-share-lxc>
  3. lxc-start: unpriv-cont-user: ../src/lxc/lsm/apparmor.c: apparmor_prepare: 1088 Failed to load generated AppArmor profile
  4. lxc-start: unpriv-cont-user: ../src/lxc/start.c: lxc_init: 876 Failed to initialize LSM
  5. lxc-start: unpriv-cont-user: ../src/lxc/start.c: __lxc_start: 2027 Failed to initialize container "unpriv-cont-user"
  6. lxc-start: unpriv-cont-user: ../src/lxc/tools/lxc_start.c: main: 306 The container failed to start
  7. lxc-start: unpriv-cont-user: ../src/lxc/tools/lxc_start.c: main: 311 Additional information can be obtained by setting the --logfile and --logpriority options

i'm doing this on ubuntu running from Apple M3 in UTM

  1. $ cat /etc/os-release
  2. PRETTY_NAME="Ubuntu 24.04.1 LTS"
  3. NAME="Ubuntu"
  4. VERSION_ID="24.04"
  5. VERSION="24.04.1 LTS (Noble Numbat)"
  6. VERSION_CODENAME=noble
  7. ID=ubuntu
  8. ID_LIKE=debian
  9. HOME_URL="https://www.ubuntu.com/"
  10. SUPPORT_URL="https://help.ubuntu.com/"
  11. BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
  12. PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
  13. UBUNTU_CODENAME=noble
  14. LOGO=ubuntu-logo

and i created the container with lxc-create and options

  1. Distribution: ubuntu
  2. Release: focal
  3. Architecture: arm64

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Answers

  • My lxc config file at ~/.config/lxc/default.conf has the following set

    1. lxc.apparmor.profile = generated
    2. lxc.apparmor.allow_nesting = 1
  • Posts: 3
    edited November 2024

    interestingly, creating a privileged container as root does work, so with
    sudo lxc-create --template download --name priv-cont, i'm able to then bring up the container and attach to it

  • Hi @cherif.jazra,

    More recent releases of the Ubuntu Linux OS have security mechanisms enabled by default, hence the AppArmor error encountered during the start of the unprivileged container.

    Regards,
    -Chris

  • Posts: 1

    I'm facing same issue. Any workaround?

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Welcome!

It looks like you're new here. Sign in or register to get started.
Sign In

Categories

Upcoming Training