LXC on Debian 11 - lxc.mount.fstab etc

I decide to open a new issue although I am still working on the same LXC host running Debian 11 :wink:

I try to mount a host directory into a container, for transporting backups.

lxc.idmap = u 0 325000 75000
lxc.idmap = g 0 325000 75000
lxc.apparmor.profile = lxc-container-default-with-mounting
lxc.mount.entry = /srv/shared/lxc-db1-autopostgresqlbackup /var/lib/autopostgresqlbackup none bind 0 0

I chown-ed the dir with the user running the container, is that correct?

# ls -l /srv/shared/
insgesamt 4
drwxr-xr-x 2 325000 325000 4096  5. Mai 16:54 lxc-db1-autopostgresqlbackup

The container is created and started, but there is no fstab-entry inside and no mount visible.

The host logs:

Mai 06 08:31:51 app1 audit[2560]: AVC apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-mounting" name="/" pid=2560 comm="(d-logind)" flags="rw, rslave"
Mai 06 08:31:51 app1 kernel: audit: type=1400 audit(1620282711.170:39): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-mounting" name="/" pid=2560 comm="(d-logind)" flags="rw, rslave"

That’s why I looked at the apparmor-profile and set it to:

# cat /etc/apparmor.d/lxc/lxc-default-with-mounting 
# Do not load this file.  Rather, load /etc/apparmor.d/lxc-containers, which
# will source all profiles under /etc/apparmor.d/lxc

profile lxc-container-default-with-mounting flags=(attach_disconnected,mediate_deleted) {
  #include <abstractions/lxc/container-base>

# allow standard blockdevtypes.
# The concern here is in-kernel superblock parsers bringing down the
# host with bad data.  However, we continue to disallow proc, sys, securityfs,
# etc to nonstandard locations.
  mount fstype=ext*,
  mount fstype=xfs,
  mount fstype=btrfs,
}

I initially tried with the parameter lxc.mount.fstab, as it is used by debops, same result.
It seems clear that apparmor blocks that attempt, I just don’t know what to adjust.

Thanks for any help here.

Aside from the incorrect flags or whatever: I assume I can also access the files generated within the container by running commands against “lxc-host:/var/lib/lxc/containerX/rootfs/some/dir/fileY”, right?

How great some help would be … I start working on this again and find my posting …

lxc.mount.entry = /srv/shared/lxc-db1-autopostgresqlbackup /var/lib/autopostgresqlbackup none bind 0 0

Likely should be:

lxc.mount.entry = /srv/shared/lxc-db1-autopostgresqlbackup var/lib/autopostgresqlbackup none bind 0 0

Thanks, but it still fails for me:

root@app1:/var/lib/lxc/container1# cat /var/lib/lxc/container1/config 
# Template used to create this container: /usr/share/lxc/templates/lxc-download
# Parameters passed to the template: --dist debian --release bullseye --arch amd64 --keyserver hkp://keyserver.ubuntu.com
# For additional config options, please look at lxc.container.conf(5)

# Uncomment the following line to support nesting containers:
#lxc.include = /usr/share/lxc/config/nesting.conf
# (Be aware this has security implications)


# Distribution configuration
lxc.include = /usr/share/lxc/config/common.conf
lxc.include = /usr/share/lxc/config/userns.conf
lxc.arch = linux64

# Container specific configuration
lxc.idmap = u 0 100000 2250000
lxc.idmap = g 0 100000 2250000
lxc.start.auto = 0
lxc.cap.drop = mknod sys_rawio syslog wake_alarm sys_time
#lxc.cgroup.cpuset.cpus = 0-3
#lxc.cgroup.memory.limit_in_bytes = 4G
#lxc.cgroup.memory.memsw.limit_in_bytes = 5G
lxc.rootfs.path = dir:/var/lib/lxc/container1/rootfs
lxc.uts.name = container1

# Network configuration
lxc.net.0.type = veth
lxc.net.0.hwaddr = f2:c5:02:4b:2d:77
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up

lxc.mount.entry = /srv/shared/lxc-opt opt none bind 0 0

Created by:

# /usr/bin/lxc-create --name container1  --config /etc/lxc/internal-unprivileged.conf --template download --bdev dir -- --dist debian --release bullseye --arch amd64

The start of the container brings:

Jul 12 18:02:23 app1 audit[3338]: AVC apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-mounting" name="/" pid=3338 comm="(d-logind)" flags="rw, rslave"
Jul 12 18:02:23 app1 kernel: audit: type=1400 audit(1626105743.472:101): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-mounting" name="/" pid=3338 comm="(d-logind)" flags="rw, rslave"

Do I use the wrong config? I already tried to set “lxc.apparmor.profile = unconfined” etc, no success so far. Thanks in advance!

As far as I understand and read, these mounts are way harder in unprivileged containers, right?

I have to be able to host files from within a container via nginx on the host.
I think I have solved that, the host is able to access /var/lib/lxc/container1/rootfs … I assume the other way around would be safer? → I think of mapping www-data UID into the container or so?

" Mounts in unprivileged containers" at LXC - Debian Wiki seems to be a way, right?