AppArmor permission denied for Unix proxy device

Hi, I’m having a problem with AppArmor and the Unix proxy device. It is similar to this topic, except I don’t have any symbolic links.

I am trying to get PulseAudio to work in a lxc container using this guide and with inspiration from this.

My host is an Ubuntu Server 20.04 running on a Raspberry Pi 4. I have installed PulseAudio on the host and it can play sound just fine. I’m running lxd version 4.7.

My goal is to get a Plex Media Player running in an lxc container.

These are the commands I run on the host:

lxc profile create x11
cat <<EOF > /tmp/x11.profile
config:
  environment.DISPLAY: :0
  user.user-data: |
    #cloud-config
    packages:
      - x11-apps
      - mesa-utils
description: X11 GUI LXD profile
devices:
  X0:
    bind: container
    connect: unix:@/tmp/.X11-unix/X0
    listen: unix:@/tmp/.X11-unix/X0
    security.gid: "$(id -g $USER)"
    security.uid: "$(id -u $USER)"
    type: proxy
name: x11
used_by: []
EOF
cat /tmp/x11.profile | lxc profile edit x11

lxc profile create pulseaudio_proxy
cat <<EOF > /tmp/pulseaudio_proxy.profile
config:
  #environment.PULSE_SERVER: unix:/home/ubuntu/pulse-native
  raw.idmap: "both 1000 1000"
  user.user-data: |
    #cloud-config
    runcmd:
      - 'sed -i "s/; enable-shm = yes/enable-shm = no/g" /etc/pulse/client.conf'
      - 'sed -i "s/; default-server =/default-server = unix:\/home\/ubuntu\/pulse-native/g" /etc/pulse/client.conf'
    packages:
      - alsa-utils
      - pulseaudio
description: PulseAudio Proxy LXD profile
devices:
  PASocket1:
    bind: container
    connect: unix:/run/user/$(id -u $USER)/pulse/native
    listen: unix:/home/ubuntu/pulse-native
    security.gid: "$(id -g $USER)"
    security.uid: "$(id -u $USER)"
    uid: "1000"
    gid: "1000"
    mode: "0777"
    type: proxy
  PACookie:
    path: "/home/ubuntu/.config/pulse/cookie"
    source: "/home/$USER/.config/pulse/cookie"
    readonly: true
    type: disk
name: pulseaudio_proxy
used_by: []
EOF
cat /tmp/pulseaudio_proxy.profile | lxc profile edit pulseaudio_proxy

lxc launch ubuntu:20.04 pmp -p default -p x11 -p pulseaudio_proxy

lxc exec pmp -- sudo --user ubuntu --login

In the container the following command fails:

pactl info

And this is the log entry in the host:

Nov 09 21:58:03 ubuntu audit[3450]: AVC apparmor="DENIED" operation="connect" profile="lxd_forkproxy-PASocket1_pmp_</var/snap/lxd/common/lxd>" name="/run/user/1000/pulse/native" pid=3450 comm="lxd" requested_mask="w" denied_mask="w" fsuid=1000 ouid=1000

Can anyone see what I’m doing wrong?

What’s in /var/snap/lxd/common/lxd/security/apparmor/profiles/lxd-pmp?

ubuntu@ubuntu:~$ sudo cat /var/snap/lxd/common/lxd/security/apparmor/profiles/lxd-pmp
#include <tunables/global>
profile "lxd-pmp_</var/snap/lxd/common/lxd>" flags=(attach_disconnected,mediate_deleted) {
  ### Base profile
  capability,
  dbus,
  file,
  network,
  umount,

  # Hide common denials
  deny mount options=(ro, remount) -> /,
  deny mount options=(ro, remount, silent) -> /,

  # Allow normal signal handling
  signal (receive),
  signal peer=@{profile_name},

  # Allow normal process handling
  ptrace (readby),
  ptrace (tracedby),
  ptrace peer=@{profile_name},

  # Handle binfmt
  mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
  deny /proc/sys/fs/binfmt_misc/{,**} rwklx,

  # Handle cgroupfs
  mount options=(ro, nosuid, nodev, noexec, remount, strictatime) -> /sys/fs/cgroup/,

  # Handle configfs
  mount fstype=configfs -> /sys/kernel/config/,
  deny /sys/kernel/config/{,**} rwklx,

  # Handle debugfs
  mount fstype=debugfs -> /sys/kernel/debug/,
  deny /sys/kernel/debug/{,**} rwklx,

  # Handle efivarfs
  mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
  deny /sys/firmware/efi/efivars/{,**} rwklx,

  # Handle tracefs
  mount fstype=tracefs -> /sys/kernel/tracing/,
  deny /sys/kernel/tracing/{,**} rwklx,

  # Handle fuse
  mount fstype=fuse,
  mount fstype=fuse.*,
  mount fstype=fusectl -> /sys/fs/fuse/connections/,

  # Handle hugetlbfs
  mount fstype=hugetlbfs,

  # Handle mqueue
  mount fstype=mqueue,

  # Handle proc
  mount fstype=proc -> /proc/,
  deny /proc/bus/** wklx,
  deny /proc/kcore rwklx,
  deny /proc/sysrq-trigger rwklx,
  deny /proc/acpi/** rwklx,
  deny /proc/sys/fs/** wklx,

  # Handle securityfs (access handled separately)
  mount fstype=securityfs -> /sys/kernel/security/,

  # Handle sysfs (access handled below)
  mount fstype=sysfs -> /sys/,
  mount options=(rw, nosuid, nodev, noexec, remount) -> /sys/,

  # Handle tmpfs
  mount fstype=tmpfs,

  # Allow limited modification of mount propagation
  mount options=(rw,slave) -> /,
  mount options=(rw,rslave) -> /,
  mount options=(rw,shared) -> /,
  mount options=(rw,rshared) -> /,
  mount options=(rw,private) -> /,
  mount options=(rw,rprivate) -> /,
  mount options=(rw,unbindable) -> /,
  mount options=(rw,runbindable) -> /,

  # Allow various ro-bind-*re*-mounts
  mount options=(ro,remount,bind) /[^spd]*{,/**},
  mount options=(ro,remount,bind) /d[^e]*{,/**},
  mount options=(ro,remount,bind) /de[^v]*{,/**},
  mount options=(ro,remount,bind) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind) /dev?*{,/**},
  mount options=(ro,remount,bind) /p[^r]*{,/**},
  mount options=(ro,remount,bind) /pr[^o]*{,/**},
  mount options=(ro,remount,bind) /pro[^c]*{,/**},
  mount options=(ro,remount,bind) /proc?*{,/**},
  mount options=(ro,remount,bind) /s[^y]*{,/**},
  mount options=(ro,remount,bind) /sy[^s]*{,/**},
  mount options=(ro,remount,bind) /sys?*{,/**},

  mount options=(ro,remount,bind,nodev) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nodev) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nodev) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nodev) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nodev) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nodev) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nodev) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nodev) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nodev) /dev?*{,/**},
  mount options=(ro,remount,bind,nodev) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nodev) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nodev) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nodev) /proc?*{,/**},
  mount options=(ro,remount,bind,nodev) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nodev) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nodev) /sys?*{,/**},

  mount options=(ro,remount,bind,nodev,nosuid) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /dev?*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /proc?*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nodev,nosuid) /sys?*{,/**},

  mount options=(ro,remount,bind,noexec) /[^spd]*{,/**},
  mount options=(ro,remount,bind,noexec) /d[^e]*{,/**},
  mount options=(ro,remount,bind,noexec) /de[^v]*{,/**},
  mount options=(ro,remount,bind,noexec) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,noexec) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,noexec) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,noexec) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,noexec) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,noexec) /dev?*{,/**},
  mount options=(ro,remount,bind,noexec) /p[^r]*{,/**},
  mount options=(ro,remount,bind,noexec) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,noexec) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,noexec) /proc?*{,/**},
  mount options=(ro,remount,bind,noexec) /s[^y]*{,/**},
  mount options=(ro,remount,bind,noexec) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,noexec) /sys?*{,/**},

  mount options=(ro,remount,bind,noexec,nodev) /[^spd]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /d[^e]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /de[^v]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /dev?*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /p[^r]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /proc?*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /s[^y]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,noexec,nodev) /sys?*{,/**},

  mount options=(ro,remount,bind,noatime) /[^spd]*{,/**},
  mount options=(ro,remount,bind,noatime) /d[^e]*{,/**},
  mount options=(ro,remount,bind,noatime) /de[^v]*{,/**},
  mount options=(ro,remount,bind,noatime) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,noatime) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,noatime) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,noatime) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,noatime) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,noatime) /dev?*{,/**},
  mount options=(ro,remount,bind,noatime) /p[^r]*{,/**},
  mount options=(ro,remount,bind,noatime) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,noatime) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,noatime) /proc?*{,/**},
  mount options=(ro,remount,bind,noatime) /s[^y]*{,/**},
  mount options=(ro,remount,bind,noatime) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,noatime) /sys?*{,/**},

  mount options=(ro,remount,noatime,bind) /[^spd]*{,/**},
  mount options=(ro,remount,noatime,bind) /d[^e]*{,/**},
  mount options=(ro,remount,noatime,bind) /de[^v]*{,/**},
  mount options=(ro,remount,noatime,bind) /dev/.[^l]*{,/**},
  mount options=(ro,remount,noatime,bind) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,noatime,bind) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,noatime,bind) /dev/.lxc?*{,/**},
  mount options=(ro,remount,noatime,bind) /dev/[^.]*{,/**},
  mount options=(ro,remount,noatime,bind) /dev?*{,/**},
  mount options=(ro,remount,noatime,bind) /p[^r]*{,/**},
  mount options=(ro,remount,noatime,bind) /pr[^o]*{,/**},
  mount options=(ro,remount,noatime,bind) /pro[^c]*{,/**},
  mount options=(ro,remount,noatime,bind) /proc?*{,/**},
  mount options=(ro,remount,noatime,bind) /s[^y]*{,/**},
  mount options=(ro,remount,noatime,bind) /sy[^s]*{,/**},
  mount options=(ro,remount,noatime,bind) /sys?*{,/**},

  mount options=(ro,remount,bind,nosuid) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nosuid) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nosuid) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nosuid) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nosuid) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nosuid) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nosuid) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nosuid) /dev?*{,/**},
  mount options=(ro,remount,bind,nosuid) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nosuid) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nosuid) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid) /proc?*{,/**},
  mount options=(ro,remount,bind,nosuid) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nosuid) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nosuid) /sys?*{,/**},

  mount options=(ro,remount,bind,nosuid,nodev) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /dev?*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /proc?*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nosuid,nodev) /sys?*{,/**},

  mount options=(ro,remount,bind,nosuid,noexec) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /dev?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /proc?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec) /sys?*{,/**},

  mount options=(ro,remount,bind,nosuid,noexec,nodev) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /dev?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /proc?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,nodev) /sys?*{,/**},

  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /[^spd]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /d[^e]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /de[^v]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /dev?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /p[^r]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /pr[^o]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /pro[^c]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /proc?*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /s[^y]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /sy[^s]*{,/**},
  mount options=(ro,remount,bind,nosuid,noexec,strictatime) /sys?*{,/**},

  # Allow bind-mounts of anything except /proc, /sys and /dev/.lxc
  mount options=(rw,bind) /[^spd]*{,/**},
  mount options=(rw,bind) /d[^e]*{,/**},
  mount options=(rw,bind) /de[^v]*{,/**},
  mount options=(rw,bind) /dev/.[^l]*{,/**},
  mount options=(rw,bind) /dev/.l[^x]*{,/**},
  mount options=(rw,bind) /dev/.lx[^c]*{,/**},
  mount options=(rw,bind) /dev/.lxc?*{,/**},
  mount options=(rw,bind) /dev/[^.]*{,/**},
  mount options=(rw,bind) /dev?*{,/**},
  mount options=(rw,bind) /p[^r]*{,/**},
  mount options=(rw,bind) /pr[^o]*{,/**},
  mount options=(rw,bind) /pro[^c]*{,/**},
  mount options=(rw,bind) /proc?*{,/**},
  mount options=(rw,bind) /s[^y]*{,/**},
  mount options=(rw,bind) /sy[^s]*{,/**},
  mount options=(rw,bind) /sys?*{,/**},

  # Allow rbind-mounts of anything except /, /dev, /proc and /sys
  mount options=(rw,rbind) /[^spd]*{,/**},
  mount options=(rw,rbind) /d[^e]*{,/**},
  mount options=(rw,rbind) /de[^v]*{,/**},
  mount options=(rw,rbind) /dev?*{,/**},
  mount options=(rw,rbind) /p[^r]*{,/**},
  mount options=(rw,rbind) /pr[^o]*{,/**},
  mount options=(rw,rbind) /pro[^c]*{,/**},
  mount options=(rw,rbind) /proc?*{,/**},
  mount options=(rw,rbind) /s[^y]*{,/**},
  mount options=(rw,rbind) /sy[^s]*{,/**},
  mount options=(rw,rbind) /sys?*{,/**},

  # Allow read-only bind-mounts of anything except /proc, /sys and /dev/.lxc
  mount options=(ro,remount,bind) /[^spd]*{,/**},
  mount options=(ro,remount,bind) /d[^e]*{,/**},
  mount options=(ro,remount,bind) /de[^v]*{,/**},
  mount options=(ro,remount,bind) /dev/.[^l]*{,/**},
  mount options=(ro,remount,bind) /dev/.l[^x]*{,/**},
  mount options=(ro,remount,bind) /dev/.lx[^c]*{,/**},
  mount options=(ro,remount,bind) /dev/.lxc?*{,/**},
  mount options=(ro,remount,bind) /dev/[^.]*{,/**},
  mount options=(ro,remount,bind) /dev?*{,/**},
  mount options=(ro,remount,bind) /p[^r]*{,/**},
  mount options=(ro,remount,bind) /pr[^o]*{,/**},
  mount options=(ro,remount,bind) /pro[^c]*{,/**},
  mount options=(ro,remount,bind) /proc?*{,/**},
  mount options=(ro,remount,bind) /s[^y]*{,/**},
  mount options=(ro,remount,bind) /sy[^s]*{,/**},
  mount options=(ro,remount,bind) /sys?*{,/**},

  # Allow moving mounts except for /proc, /sys and /dev/.lxc
  mount options=(rw,move) /[^spd]*{,/**},
  mount options=(rw,move) /d[^e]*{,/**},
  mount options=(rw,move) /de[^v]*{,/**},
  mount options=(rw,move) /dev/.[^l]*{,/**},
  mount options=(rw,move) /dev/.l[^x]*{,/**},
  mount options=(rw,move) /dev/.lx[^c]*{,/**},
  mount options=(rw,move) /dev/.lxc?*{,/**},
  mount options=(rw,move) /dev/[^.]*{,/**},
  mount options=(rw,move) /dev?*{,/**},
  mount options=(rw,move) /p[^r]*{,/**},
  mount options=(rw,move) /pr[^o]*{,/**},
  mount options=(rw,move) /pro[^c]*{,/**},
  mount options=(rw,move) /proc?*{,/**},
  mount options=(rw,move) /s[^y]*{,/**},
  mount options=(rw,move) /sy[^s]*{,/**},
  mount options=(rw,move) /sys?*{,/**},

  # Block dangerous paths under /proc/sys
  deny /proc/sys/[^kn]*{,/**} wklx,
  deny /proc/sys/k[^e]*{,/**} wklx,
  deny /proc/sys/ke[^r]*{,/**} wklx,
  deny /proc/sys/ker[^n]*{,/**} wklx,
  deny /proc/sys/kern[^e]*{,/**} wklx,
  deny /proc/sys/kerne[^l]*{,/**} wklx,
  deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
  deny /proc/sys/kernel/d[^o]*{,/**} wklx,
  deny /proc/sys/kernel/do[^m]*{,/**} wklx,
  deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
  deny /proc/sys/kernel/doma[^i]*{,/**} wklx,
  deny /proc/sys/kernel/domai[^n]*{,/**} wklx,
  deny /proc/sys/kernel/domain[^n]*{,/**} wklx,
  deny /proc/sys/kernel/domainn[^a]*{,/**} wklx,
  deny /proc/sys/kernel/domainna[^m]*{,/**} wklx,
  deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx,
  deny /proc/sys/kernel/domainname?*{,/**} wklx,
  deny /proc/sys/kernel/h[^o]*{,/**} wklx,
  deny /proc/sys/kernel/ho[^s]*{,/**} wklx,
  deny /proc/sys/kernel/hos[^t]*{,/**} wklx,
  deny /proc/sys/kernel/host[^n]*{,/**} wklx,
  deny /proc/sys/kernel/hostn[^a]*{,/**} wklx,
  deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
  deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
  deny /proc/sys/kernel/hostname?*{,/**} wklx,
  deny /proc/sys/kernel/m[^s]*{,/**} wklx,
  deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
  deny /proc/sys/kernel/msg*/** wklx,
  deny /proc/sys/kernel/s[^he]*{,/**} wklx,
  deny /proc/sys/kernel/se[^m]*{,/**} wklx,
  deny /proc/sys/kernel/sem*/** wklx,
  deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
  deny /proc/sys/kernel/shm*/** wklx,
  deny /proc/sys/kernel?*{,/**} wklx,
  deny /proc/sys/n[^e]*{,/**} wklx,
  deny /proc/sys/ne[^t]*{,/**} wklx,
  deny /proc/sys/net?*{,/**} wklx,

  # Block dangerous paths under /sys
  deny /sys/[^fdck]*{,/**} wklx,
  deny /sys/c[^l]*{,/**} wklx,
  deny /sys/cl[^a]*{,/**} wklx,
  deny /sys/cla[^s]*{,/**} wklx,
  deny /sys/clas[^s]*{,/**} wklx,
  deny /sys/class/[^n]*{,/**} wklx,
  deny /sys/class/n[^e]*{,/**} wklx,
  deny /sys/class/ne[^t]*{,/**} wklx,
  deny /sys/class/net?*{,/**} wklx,
  deny /sys/class?*{,/**} wklx,
  deny /sys/d[^e]*{,/**} wklx,
  deny /sys/de[^v]*{,/**} wklx,
  deny /sys/dev[^i]*{,/**} wklx,
  deny /sys/devi[^c]*{,/**} wklx,
  deny /sys/devic[^e]*{,/**} wklx,
  deny /sys/device[^s]*{,/**} wklx,
  deny /sys/devices/[^v]*{,/**} wklx,
  deny /sys/devices/v[^i]*{,/**} wklx,
  deny /sys/devices/vi[^r]*{,/**} wklx,
  deny /sys/devices/vir[^t]*{,/**} wklx,
  deny /sys/devices/virt[^u]*{,/**} wklx,
  deny /sys/devices/virtu[^a]*{,/**} wklx,
  deny /sys/devices/virtua[^l]*{,/**} wklx,
  deny /sys/devices/virtual/[^n]*{,/**} wklx,
  deny /sys/devices/virtual/n[^e]*{,/**} wklx,
  deny /sys/devices/virtual/ne[^t]*{,/**} wklx,
  deny /sys/devices/virtual/net?*{,/**} wklx,
  deny /sys/devices/virtual?*{,/**} wklx,
  deny /sys/devices?*{,/**} wklx,
  deny /sys/f[^s]*{,/**} wklx,
  deny /sys/fs/[^c]*{,/**} wklx,
  deny /sys/fs/c[^g]*{,/**} wklx,
  deny /sys/fs/cg[^r]*{,/**} wklx,
  deny /sys/fs/cgr[^o]*{,/**} wklx,
  deny /sys/fs/cgro[^u]*{,/**} wklx,
  deny /sys/fs/cgrou[^p]*{,/**} wklx,
  deny /sys/fs/cgroup?*{,/**} wklx,
  deny /sys/fs?*{,/**} wklx,

  ### Feature: unix
  # Allow receive via unix sockets from anywhere
  unix (receive),

  # Allow all unix in the container
  unix peer=(label=@{profile_name}),

  ### Feature: cgroup namespace
  mount fstype=cgroup -> /sys/fs/cgroup/**,
  mount fstype=cgroup2 -> /sys/fs/cgroup/**,

  ### Feature: apparmor stacking
  deny /sys/k[^e]*{,/**} wklx,
  deny /sys/ke[^r]*{,/**} wklx,
  deny /sys/ker[^n]*{,/**} wklx,
  deny /sys/kern[^e]*{,/**} wklx,
  deny /sys/kerne[^l]*{,/**} wklx,
  deny /sys/kernel/[^s]*{,/**} wklx,
  deny /sys/kernel/s[^e]*{,/**} wklx,
  deny /sys/kernel/se[^c]*{,/**} wklx,
  deny /sys/kernel/sec[^u]*{,/**} wklx,
  deny /sys/kernel/secu[^r]*{,/**} wklx,
  deny /sys/kernel/secur[^i]*{,/**} wklx,
  deny /sys/kernel/securi[^t]*{,/**} wklx,
  deny /sys/kernel/securit[^y]*{,/**} wklx,
  deny /sys/kernel/security/[^a]*{,/**} wklx,
  deny /sys/kernel/security/a[^p]*{,/**} wklx,
  deny /sys/kernel/security/ap[^p]*{,/**} wklx,
  deny /sys/kernel/security/app[^a]*{,/**} wklx,
  deny /sys/kernel/security/appa[^r]*{,/**} wklx,
  deny /sys/kernel/security/appar[^m]*{,/**} wklx,
  deny /sys/kernel/security/apparm[^o]*{,/**} wklx,
  deny /sys/kernel/security/apparmo[^r]*{,/**} wklx,
  deny /sys/kernel/security/apparmor?*{,/**} wklx,
  deny /sys/kernel/security?*{,/**} wklx,
  deny /sys/kernel?*{,/**} wklx,

  change_profile -> ":lxd-pmp_<var-snap-lxd-common-lxd>:*",
  change_profile -> ":lxd-pmp_<var-snap-lxd-common-lxd>://*",

  ### Configuration: unprivileged containers
  pivot_root,

  # Allow modifying mount propagation
  mount options=(rw,slave) -> **,
  mount options=(rw,rslave) -> **,
  mount options=(rw,shared) -> **,
  mount options=(rw,rshared) -> **,
  mount options=(rw,private) -> **,
  mount options=(rw,rprivate) -> **,
  mount options=(rw,unbindable) -> **,
  mount options=(rw,runbindable) -> **,

  # Allow all bind-mounts
  mount options=(rw,bind) / -> /**,
  mount options=(rw,bind) /** -> /**,
  mount options=(rw,rbind) / -> /**,
  mount options=(rw,rbind) /** -> /**,

  # Allow common combinations of bind/remount
  # NOTE: AppArmor bug effectively turns those into wildcards mount allow
  mount options=(ro,remount,bind),
  mount options=(ro,remount,bind,nodev),
  mount options=(ro,remount,bind,nodev,nosuid),
  mount options=(ro,remount,bind,noexec),
  mount options=(ro,remount,bind,noexec,nodev),
  mount options=(ro,remount,bind,nosuid),
  mount options=(ro,remount,bind,nosuid,nodev),
  mount options=(ro,remount,bind,nosuid,noexec),
  mount options=(ro,remount,bind,nosuid,noexec,nodev),
  mount options=(ro,remount,bind,nosuid,noexec,strictatime),

  # Allow remounting things read-only
  mount options=(ro,remount) /,
  mount options=(ro,remount) /**,
}

In the same directory as that file, can you find the profile for your proxy device?

ubuntu@ubuntu:~$ sudo cat /var/snap/lxd/common/lxd/security/apparmor/profiles/lxd_forkproxy-PASocket1_pmp
#include <tunables/global>
profile "lxd_forkproxy-PASocket1_pmp_</var/snap/lxd/common/lxd>" flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/base>

  # Capabilities
  capability chown,
  capability dac_read_search,
  capability dac_override,
  capability fowner,
  capability fsetid,
  capability kill,
  capability net_bind_service,
  capability setgid,
  capability setuid,
  capability sys_admin,
  capability sys_chroot,
  capability sys_ptrace,

  # Network access
  network inet dgram,
  network inet6 dgram,
  network inet stream,
  network inet6 stream,
  network unix stream,

  # Forkproxy operation
  /var/snap/lxd/common/lxd/logs/pmp/** rw,
  @{PROC}/** rw,
  / rw,
  ptrace (read),
  ptrace (trace),

  # Needed for lxd fork commands
  /snap/lxd/current/bin/lxd mr,
  @{PROC}/@{pid}/cmdline r,
  /var/lib/snapd/hostfs/{etc,lib,usr/lib}/os-release r,

  /home/ubuntu/pulse-native rw,
  /var/lib/snapd/hostfs/run/user/1000/pulse/native rw,
  /var/lib/snapd/hostfs/run/user/1000/pulse/native rw,

  # Things that we definitely don't need
  deny @{PROC}/@{pid}/cgroup r,
  deny /sys/module/apparmor/parameters/enabled r,
  deny /sys/kernel/mm/transparent_hugepage/hpage_pmd_size r,
  # The binary itself (for nesting)
  /var/snap/lxd/common/lxd.debug      mr,
  /snap/lxd/*/bin/lxd                 mr,

  # Snap-specific libraries
  /snap/lxd/*/lib/**.so*              mr,

# Entries from LD_LIBRARY_PATH

  /snap/lxd/current/zfs-0.8/lib//** mr,
  /var/lib/snapd/lib/gl/** mr,
  /var/lib/snapd/lib/gl32/** mr,
  /var/lib/snapd/void/** mr,
  /snap/lxd/18140/lib/** mr,
  /snap/lxd/18140/lib/aarch64-linux-gnu/** mr,
  /snap/lxd/18140/lib/aarch64-linux-gnu/ceph/** mr,
  /snap/lxd/18140/zfs-0.6/lib/** mr,
  /** mr,
  /snap/lxd/18140/lib/** mr,
  /snap/lxd/18140/lib/aarch64-linux-gnu/** mr,
  /snap/lxd/current/lib/** mr,
  /snap/lxd/current/lib/aarch64-linux-gnu/** mr,
  /snap/lxd/current/lib/aarch64-linux-gnu/ceph/** mr,
}
  /home/ubuntu/pulse-native rw,
  /var/lib/snapd/hostfs/run/user/1000/pulse/native rw,
  /var/lib/snapd/hostfs/run/user/1000/pulse/native rw,

When it should instead be:

  /home/ubuntu/pulse-native rw,
  /var/lib/snapd/hostfs/run/user/1000/pulse/native rw,
  /run/user/1000/pulse/native rw,

Let’s see if I can’t figure out what’s happened there.

I tried editing the file manually, but it does not take effect if the container is started.
I tried restarting the container, but then the file is reverted to the erroneous version.

However, I power-cycled the host and file was created by lxd correctly…

Thanks for your help!