<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
On Wed, 05 Jan 2022 12:34:47 +0000 Pelzi
<a class="moz-txt-link-rfc2396E" href="mailto:pelzi@flying-snail.de"><pelzi@flying-snail.de></a> wrote:<br>
> The following patch seems to fix the problem.<br>
> <br>
> --- /tmp/lxc-default-with-nesting.org 2022-01-05
13:25:18.920809830 +0100<br>
> +++ lxc-default-with-nesting 2022-01-05 13:22:35.019939076
+0100<br>
> @@ -10,6 +10,7 @@<br>
> mount fstype=proc -> /var/cache/lxc/**,<br>
> mount fstype=sysfs -> /var/cache/lxc/**,<br>
> mount options=(rw,bind),<br>
> + mount options=(rw,rbind),<br>
> mount fstype=cgroup -> /sys/fs/cgroup/**,<br>
> mount fstype=cgroup2 -> /sys/fs/cgroup/**,<br>
> }<br>
> <br>
> <br>
<p>Making this change to
/etc/apparmor.d/lxc/lxc-default-with-nesting and reloading
apparmor did not fix it for me. It still failed with this in
dmesg:</p>
<p><span style="font-family:monospace"><span
style="color:#000000;background-color:#ffffff;">[24331487.635679]
audit: type=1400 audit(1656010635.412:13707):
apparmor="DENIED" operation="mount" info="failed flags match"
error=-13 profile="lxc-container-default-w</span>ith-nesting"
name="/run/systemd/unit-root/proc/" pid=30720 comm="(d-logind)"
fstype="proc" srcname="proc" flags="rw, nosuid, nodev, noexec"<br>
<br>
</span><span style="font-family:monospace"></span></p>
<p>My container is unprivileged and I am including
/usr/share/lxc/config/nesting.conf in my container's config file.
My lxc package version is 1:3.1.0+really3.0.3-8.</p>
<p>Instead, I masked the systemd-logind service inside the container
so that it would no longer delay logins. Hopefully there's a
better fix at some point.<br>
</p>
</body>
</html>