/proc mount error

(Michael) #1


I’m trying to run mock in lxd container. It chroots into fs and then at some point tries to mount /proc filesystem which fails. Host shows that the mount is blocked by apparmour:

apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxd-buildserver_</var/snap/lxd/common/lxd>" name="/var/lib/mock/cs7/root/proc/" pid=3825 comm="mount" fstype="proc" srcname="proc"

I tried to add “mount fstype=nfs,” into /etc/apparmor.d/lxc/lxc-default and it did not help (yes, I reloaded apparmour and restarted the container). I tried to add “lxc.aa_profile = lxc-container-default-with-mounting” into container config (lxc config edit container_name, raw.lxc: lxc.aa_profile = …), but this gives me “Config parsing error: Initialize LXC: Failed to load raw.lxc” error.

How can I convince the container to allow /proc mounts?

Best regards,

(Michael) #2

ok, sorted this out myself.lxc config set buildserver raw.apparmor "mount fstype=proc," fixed the issue!

(Stéphane Graber) #3

A possibly cleaner way would be to grant security.nesting=true to that container.