AppArmor 4 playing havoc with nested containers

Incus
1

I’ve been really struggling the past few months with a bunch of issues with running nested containers (Docker in Incus), which have all eventually come back to AppArmor 4 being the cause. It seems to have adopted much stricter policies that are getting in the way of activities that were previously fine.

I’ve encountered:

  • blocking of Wine sockets being created: Wine socket permission issues in docker with box64
  • blocking of bwrap namespaces being created when running SteamRT3 sniper (this happens both in and out of Docker)
  • most recently, unix-chkpwd preventing root in a Docker container from su-ing to another user

I’ve seen some other issues posted over the last few months, but solutions there don’t either resolve the issue or cause other issues (such as making AppArmor unconfined stopping the Docker daemon from starting).

Experimenting with a different approach of just placing certain profiles in complain mode, I’ve now encountered another issue that is closer to being an Incus/LXC issue:

$ aa-complain docker-default

ERROR: Conflicting profiles for /usr/bin/lxc-start defined in two files:
- /etc/apparmor.d/usr.bin.lxc-start
- /etc/apparmor.d/usr.bin.lxc-copy

Any idea why there are conflicting profiles, and how to resolve?

$ cat /etc/apparmor.d/usr.bin.lxc-start
abi <abi/4.0>,
#include <tunables/global>

/usr/bin/lxc-start flags=(attach_disconnected) {
  #include <abstractions/lxc/start-container>
}

$ cat /etc/apparmor.d/usr.bin.lxc-copy
abi <abi/4.0>,
#include <tunables/global>

/usr/bin/lxc-start flags=(attach_disconnected) {
  #include <abstractions/lxc/start-container>
}

Incus 6.16.

2

That’s odd, the lxc-copy profile should definitely point to /usr/bin/lxc-copy, that’s what we have in the source repo on Github…

@amikhalitsyn any ideas?

3

Just to check the obvious:

ls -li /etc/apparmor.d/usr.bin.lxc-start /etc/apparmor.d/usr.bin.lxc-copy

They’re not links to the same file?

4

They are not:

ls -li /etc/apparmor.d/usr.bin.lxc-start /etc/apparmor.d/usr.bin.lxc-copy
131882 -rw-r--r-- 1 root root 140 Apr 18  2024 /etc/apparmor.d/usr.bin.lxc-copy
131884 -rw-r--r-- 1 root root 140 Apr 18  2024 /etc/apparmor.d/usr.bin.lxc-start

Regardless, the presence of both makes AppArmor error.

5

Regarding bwrap, you can try downloading apparmor profile for it inside container:

sudo apt install apparmor-profiles
sudo ln -s /usr/share/apparmor/extra-profiles/bwrap-userns-restrict /etc/apparmor.d/
sudo apparmor_parser /etc/apparmor.d/bwrap-userns-restrict

Setting ⁣security.nesting=true could also help.

6

Already have all the recommended nesting flags: Wine socket permission issues in docker with box64

(Sorry, didn’t want to repeat all the environment info from the other post, which is consistent so far as Incus is concerned)

7

What’s the underlying host OS? If it’s Ubuntu/Debian then:

dpkg -V liblxc-common

will tell you if those files don’t match the ones in the package. And if they do (no output), then it’s a packaging error, so

dpkg-query -l liblxc-common

to show the exact version.

8

Ubuntu 24.04.

No output from dpkg -V liblxc-common.

So:

dpkg-query -l liblxc-common
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name           Version            Architecture Description
+++-==============-==================-============-==========================================
rc  liblxc-common  1:5.0.3-2ubuntu7.1 amd64        Linux Containers userspace tools (library)

Hmmm

9

Check which package they came from?

dpkg-query -S /etc/apparmor.d/usr.bin.lxc-start
dpkg-query -S /etc/apparmor.d/usr.bin.lxc-copy

I have to say that those two files don’t exist on my incus systems, so I think you can use incus without them. I found them inside a container where liblxc-common is installed (I’m not sure why):

$ dpkg-query -L liblxc-common | grep apparmor.d
/etc/apparmor.d
/etc/apparmor.d/abstractions
/etc/apparmor.d/abstractions/lxc
/etc/apparmor.d/abstractions/lxc/container-base
/etc/apparmor.d/abstractions/lxc/start-container
/etc/apparmor.d/lxc
/etc/apparmor.d/lxc/lxc-default
/etc/apparmor.d/lxc/lxc-default-cgns
/etc/apparmor.d/lxc/lxc-default-with-mounting
/etc/apparmor.d/lxc/lxc-default-with-nesting
/etc/apparmor.d/lxc-containers
/etc/apparmor.d/usr.bin.lxc-copy
/etc/apparmor.d/usr.bin.lxc-start

If those files did come from liblxc-common, and are treated as “configuration” files so they hang around after uninstalling the package, then you can purge the package to get rid of them:

apt-get remove --purge liblxc-common
10

Thanks, yes, both belonged to liblxc-common. I have purged it. Appreciate the input.

Now onto the real AppArmor 4 issues… Lol