I decide to open a new issue although I am still working on the same LXC host running Debian 11 
I try to mount a host directory into a container, for transporting backups.
lxc.idmap = u 0 325000 75000
lxc.idmap = g 0 325000 75000
lxc.apparmor.profile = lxc-container-default-with-mounting
lxc.mount.entry = /srv/shared/lxc-db1-autopostgresqlbackup /var/lib/autopostgresqlbackup none bind 0 0
I chown-ed the dir with the user running the container, is that correct?
# ls -l /srv/shared/
insgesamt 4
drwxr-xr-x 2 325000 325000 4096 5. Mai 16:54 lxc-db1-autopostgresqlbackup
The container is created and started, but there is no fstab-entry inside and no mount visible.
The host logs:
Mai 06 08:31:51 app1 audit[2560]: AVC apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-mounting" name="/" pid=2560 comm="(d-logind)" flags="rw, rslave"
Mai 06 08:31:51 app1 kernel: audit: type=1400 audit(1620282711.170:39): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-mounting" name="/" pid=2560 comm="(d-logind)" flags="rw, rslave"
Thatâs why I looked at the apparmor-profile and set it to:
# cat /etc/apparmor.d/lxc/lxc-default-with-mounting
# Do not load this file. Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc
profile lxc-container-default-with-mounting flags=(attach_disconnected,mediate_deleted) {
#include <abstractions/lxc/container-base>
# allow standard blockdevtypes.
# The concern here is in-kernel superblock parsers bringing down the
# host with bad data. However, we continue to disallow proc, sys, securityfs,
# etc to nonstandard locations.
mount fstype=ext*,
mount fstype=xfs,
mount fstype=btrfs,
}
I initially tried with the parameter lxc.mount.fstab, as it is used by debops, same result.
It seems clear that apparmor blocks that attempt, I just donât know what to adjust.
Thanks for any help here.