Don't require use of mediate_deleted with LXC (was: apparmor prevents dpkg-divert and localedef from working in a container)

Reason for critical is that it's making random commands in container fail.
We've already got a few bug reports against udev, postgresql, ... all caused by that issue.

Interestingly when I ser the lxc-container-default profile to complain:

sudo aa-complain /etc/apparmor.d/lxc/lxc-default

I no longer get the issue in the lxc instance - however neither do I get any complaints.

Status changed to 'Confirmed' because the bug affects multiple users.

While I haven't tried this yet, my initial thought when seeing it works in complain mode, but there are no messages is that this is something that is being specifically denied in the profile.

to confirm this we need to disable quieting of explicitly denied messages, we can do this as root with

echo -n "noquiet" > /sys/module/apparmor/parameters/audit

Friend of mine solved this, asked me if I can post it, so here goes:

/etc/apparmor.d/lxc/lxc-default profile needs 'flags=(mediate_deleted)' appended to it, and the problem should go away. Documentation reference for this is at http://wiki.apparmor.net/index.php/FAQ#Failed_name_lookup_-_deleted_entry and attached also find find a modified lxc-default entry.

This does indeed seem to be the problem. The current labeling done by apparmor is not enough to avoid needing the mediate_deleted flag on the lxc profiles. Adding the flag will force apparmor to do a name lookup for entries that have been deleted (the name can be reliably be reconstructed), instead of using the default of the cached file label.

I have opened Bug #970647 for the failure to log rejects due to the deleted entry logic.

@JP

great! Thanks for that. I'll add that for now as a workaround.

This bug was fixed in the package lxc - 0.7.5-3ubuntu49

---------------
lxc (0.7.5-3ubuntu49) precise; urgency=low

  * debian/lxc-default.apparmor: add mediate_deleted flag (LP: #969299)
 -- Serge Hallyn <email address hidden> Mon, 02 Apr 2012 09:38:21 -0500

Marking the apparmor task as Won't Fix since the lxc work around is in place. If we pursue this in SRU, it will be through bug #970647.

Based on the duplicates, I'm not sure the workaround is working as well as we'd hoped.

John, what are the prospects of bug 970647? How complicated is the fix for it?

I'm sorry if this is not the place to report this, but running localedef into a lxc ubuntu container it's affecting quantal right now.

The log line is

[26775.302073] type=1400 audit(1353478924.553:73): apparmor="DENIED" operation="chmod" info="Failed name lookup - deleted entry" error=-2 parent=14028 profile="/usr/bin/lxc-start" name="/usr/lib/locale/locale-archive.fyr1kX" pid=14336 comm="localedef" requested_mask="w" denied_mask="w" fsuid=0 ouid=0

I just fixed adding mediate_deleted into /etc/apparmor.d/usr.bin.lxc-start, but i don't know it this is the right fix.

Francesco,

The mediate_deleted flag should fix the rejection shown in comment #12

Serge,

see comments on bug 970647, there is some progress but I have not found a specific bug affecting logging of this case. The larger fix which is the extended labeling, is in progress and will enter into the apparmor-dev ppa soon for testing.

Francesco,

The DENIED message doesn't look right. It says your containern is running in the lxc-start pfofile? it should have transitioned to a container profile when /sbin/init was executed.

I think it is worth opening a new bug about your issue, so we can make sure there isn't more going on.

I get this (newly?) when trying to update within sbuild within lxc

[ 1927.282880] type=1400 audit(1383816970.374:86): apparmor="DENIED" operation="getattr" info="Failed name lookup - deleted entry" error=-2 parent=11717 profile="/usr/bin/lxc-start" name="/var/lib/schroot/mount/trusty-amd64-c7aa6e25-c1a2-401f-864d-d0b82f4002b5/var/lib/dpkg/diversions" pid=12244 comm="dpkg" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

Quoting Iain Lane (<email address hidden>):
> I get this (newly?) when trying to update within sbuild within lxc
>
> [ 1927.282880] type=1400 audit(1383816970.374:86): apparmor="DENIED"
> operation="getattr" info="Failed name lookup - deleted entry" error=-2
> parent=11717 profile="/usr/bin/lxc-start" name="/var/lib/schroot/mount

lxc-start -> that is not the profile you should be under.

Is this by chance a 3.12 kernel?

On Thu, Nov 07, 2013 at 03:20:29PM -0000, Serge Hallyn wrote:
> Quoting Iain Lane (<email address hidden>):
> > I get this (newly?) when trying to update within sbuild within lxc
> >
> > [ 1927.282880] type=1400 audit(1383816970.374:86): apparmor="DENIED"
> > operation="getattr" info="Failed name lookup - deleted entry" error=-2
> > parent=11717 profile="/usr/bin/lxc-start" name="/var/lib/schroot/mount
>
> lxc-start -> that is not the profile you should be under.
>
> Is this by chance a 3.12 kernel?

Sure is. 3.12.0-1-generic

--
Iain Lane [ <email address hidden> ]
Debian Developer [ <email address hidden> ]
Ubuntu Developer [ <email address hidden> ]

Quoting Iain Lane (<email address hidden>):
> On Thu, Nov 07, 2013 at 03:20:29PM -0000, Serge Hallyn wrote:
> > Quoting Iain Lane (<email address hidden>):
> > > I get this (newly?) when trying to update within sbuild within lxc
> > >
> > > [ 1927.282880] type=1400 audit(1383816970.374:86): apparmor="DENIED"
> > > operation="getattr" info="Failed name lookup - deleted entry" error=-2
> > > parent=11717 profile="/usr/bin/lxc-start" name="/var/lib/schroot/mount
> >
> > lxc-start -> that is not the profile you should be under.
> >
> > Is this by chance a 3.12 kernel?
>
> Sure is. 3.12.0-1-generic

The fix for that should be in the trusty kernel I believe mid-next week.

Would you mind opening a new bug against lxc saying that if the
container is in profile lxc-start, and apparmor support is lacking,
it must run unconfined or refuse to run?

Confirmed fixed in 3.13.0-2-generic, where in 3.13.0-1-generic it was still failing.

Any chance this will be fixed in saucy?