We got the same output, so it does not look like a
You can get a shell as the
lxd snap, then go and run
snap run --shell lxd
With that command, I get my list of the containers. You probably get that error on
Here is the code that invokes
aa-exec (in /snap/lxd/current/commands/lxc):
# Re-exec outside of apparmor confinement
if [ -d /sys/kernel/security/apparmor ] && [ "$(cat /proc/self/attr/current)" != "unconfined" ]; then
exec aa-exec -p unconfined -- "$0" "$@"
Let’s run directly
aa-exec, the one from the
core image of
bash: /snap/core/current/usr/sbin/aa-exec: Permission denied
Weird. I also get Permission denied on the
aa-exec of the Ubuntu Core.
aa-exec as is. It works for me. Weirdly, it says that it’s in
USAGE: aa-exec [OPTIONS] <prog> <args>
Confine <prog> with the specified PROFILE.
-p PROFILE, --profile=PROFILE PROFILE to confine <prog> with
-n NAMESPACE, --namespace=NAMESPACE NAMESPACE to confine <prog> in
-d, --debug show messages with debugging information
-i, --immediate change profile immediately instead of at exec
-v, --verbose show messages with stats
-h, --help display this help
bash-4.3$ which aa-exec
But, earlier, I run (as root, in a different terminal) the command
sudo mv /usr/sbin/aa-exec /usr/sbin/aa-exec.stashed-away. What gives?
Let’s compare the two
Strange, it can still find the
aa-exec even if I renamed it. Perhaps it has somewhat opened it or something?
But it cannot find the
bash-4.3$ ls -l /usr/sbin/aa-exec
-rwxr-xr-x 1 0 0 22696 Feb 21 13:36 /usr/sbin/aa-exec
bash-4.3$ ls -l /usr/sbin/aa-exec.stashed-away
ls: cannot access '/usr/sbin/aa-exec.stashed-away': No such file or directory
Okay, so the
/usr/sbin/aa-exec we are seeing as a
lxd snap user, is not the system’s
/usr/sbin/aa-exec. It is likely the one in the
bash-4.3$ ls -l /snap/core/current/usr/sbin/aa-exec
-rwxr-xr-x 1 0 0 22696 Feb 21 13:36 /snap/core/current/usr/sbin/aa-exec
It looks like there is some
chroot-style magic when you do the
snap run --shell lxd, which makes
/snap/core/current/ the new root directory.
Something is not working properly in your case, hence the issue.
Which distro are you running?