it's interesting that apparmor appears to work ok in the first-level
container, but fails in the nested container, e.g.:
$ lxc shell lp1905493-f
root@lp1905493-f:~# systemctl status apparmor
● apparmor.service - Load AppArmor profiles
Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor
preset: enabled)
Active: active (exited) since Wed 2021-03-17 18:17:44 UTC; 2h 53min ago
Docs: man:apparmor(7)
https://gitlab.com/apparmor/apparmor/wikis/home/
Process: 118 ExecStart=/lib/apparmor/apparmor.systemd reload (code=exited,
status=0/SUCCESS)
Main PID: 118 (code=exited, status=0/SUCCESS)
Mar 17 18:17:44 lp1905493-f systemd[1]: Starting Load AppArmor profiles...
Mar 17 18:17:44 lp1905493-f apparmor.systemd[118]: Restarting AppArmor
Mar 17 18:17:44 lp1905493-f apparmor.systemd[118]: Reloading AppArmor profiles
Mar 17 18:17:44 lp1905493-f apparmor.systemd[129]: Skipping profile in
/etc/apparmor.d/disable: usr.sbin.rsyslogd
Mar 17 18:17:44 lp1905493-f systemd[1]: Finished Load AppArmor profiles.
root@lp1905493-f:~# lxc shell layer2
root@layer2:~# systemctl status apparmor
● apparmor.service - Load AppArmor profiles
Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor
preset: enabled)
Active: failed (Result: exit-code) since Wed 2021-03-17 18:40:16 UTC; 2h
31min ago
Docs: man:apparmor(7)
https://gitlab.com/apparmor/apparmor/wikis/home/
Main PID: 105 (code=exited, status=1/FAILURE)
Mar 17 18:40:15 layer2 apparmor.systemd[147]: /sbin/apparmor_parser: Unable to
replace "nvidia_modprobe". Permission denied; attempted to load a profile
while confined?
Mar 17 18:40:15 layer2 apparmor.systemd[157]: /sbin/apparmor_parser: Unable to
replace "/usr/bin/man". Permission denied; attempted to load a profile while
confined?
Mar 17 18:40:15 layer2 apparmor.systemd[164]: /sbin/apparmor_parser: Unable to
replace "/usr/sbin/tcpdump". Permission denied; attempted to load a profile
while confined?
Mar 17 18:40:16 layer2 apparmor.systemd[150]: /sbin/apparmor_parser: Unable to
replace "/usr/lib/NetworkManager/nm-dhcp-client.action". Permission denied;
attempted to load a profile while confined?
Mar 17 18:40:16 layer2 apparmor.systemd[161]: /sbin/apparmor_parser: Unable to
replace "mount-namespace-capture-helper". Permission denied; attempted to load
a profile while confined?
Mar 17 18:40:16 layer2 apparmor.systemd[161]: /sbin/apparmor_parser: Unable to
replace "/usr/lib/snapd/snap-confine". Permission denied; attempted to load a
profile while confined?
Mar 17 18:40:16 layer2 apparmor.systemd[105]: Error: At least one profile
failed to load
Mar 17 18:40:16 layer2 systemd[1]: apparmor.service: Main process exited,
code=exited, status=1/FAILURE
Mar 17 18:40:16 layer2 systemd[1]: apparmor.service: Failed with result
'exit-code'.
Mar 17 18:40:16 layer2 systemd[1]: Failed to start Load AppArmor profiles.
** Also affects: apparmor
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to cloud-init.
https://bugs.launchpad.net/bugs/1905493
Title:
cloud-init status --wait hangs indefinitely in a nested lxd container
Status in AppArmor:
New
Status in cloud-init:
Invalid
Status in snapd:
Confirmed
Status in dbus package in Ubuntu:
New
Status in systemd package in Ubuntu:
Invalid
Bug description:
When booting a nested lxd container inside another lxd container (just
a normal container, not a VM) (i.e. just L2), using cloud-init -status
--wait, the "." is just printed off infinitely and never returns.
To manage notifications about this bug go to:
https://bugs.launchpad.net/apparmor/+bug/1905493/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : [email protected]
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
