apparmor="DENIED" operation="mount"

@stgraber

I am bumping this post as the error is pervasive in logs on three different physical machines running lxd v 3.03. It’s not mission-critical, but it is a uisance factor.

sysog is absolutely rammed full of line after line of these types of errors. In this case, it’s an openvpn container, but I get the same for our Nextcloud instances too. There are no operational side effects other than making syslog impossible to easily read. But I have to wonder what resources are being wasted? Here’s a single log entry:

Jul 18 14:34:55 vader kernel: [1681065.556456] audit: type=1400 audit(1563474895.857:119431): apparmor=“DENIED” operation=“mount” info=“failed flags match” error=-13 profile=“lxd-openvpn_</v
ar/lib/lxd>” name="/home/" pid=7483 comm="(openvpn)" flags=“ro, nosuid, nodev, remount, bind”

It’s always a mount error, regardless of container flavor.

Is this soemthing that can be fixed in 3.03 or do we need to upgrade? We run production servers so we don’t want to introduce instability with a development lxd.

If I can help track down to root cause, please let me know what you need (I may need help extracting it, so please be specific). We still love lxd!! The fact that we see this in at least two very different containers on very different machines mkes us think this is not a dumb user mistake. Thank you.