lxc-start 告诉我 apparmor_parser 不可用,即使 apparmor 已安装并运行

lxc-start 告诉我 apparmor_parser 不可用,即使 apparmor 已安装并运行

系统:
Debian 测试(Bullseye)

我正在尝试按照以下方式启动并运行 LXC 容器这里但是,当我到达时,lxc-start -n my-container -d我得到以下信息:

$ lxc-start -n test1 -d
lxc-start: test1: lxccontainer.c: wait_on_daemonized_start: 851 No such file or directory - Failed to receive the container state
lxc-start: test1: tools/lxc_start.c: main: 308 The container failed to start
lxc-start: test1: tools/lxc_start.c: main: 311 To get more details, run the container in foreground mode
lxc-start: test1: tools/lxc_start.c: main: 313 Additional information can be obtained by setting the --logfile and --logpriority options

在前台模式下运行它我得到

$ lxc-start -n test1 -F
lxc-start: test1: lsm/apparmor.c: apparmor_prepare: 1051 Cannot use generated profile: apparmor_parser not available
                                        lxc-start: test1: start.c: lxc_init: 832 Failed to initialize LSM
                             lxc-start: test1: start.c: __lxc_start: 1945 Failed to initialize container "test1"
lxc-start: test1: tools/lxc_start.c: main: 308 The container failed to start
lxc-start: test1: tools/lxc_start.c: main: 313 Additional information can be obtained by setting the --logfile and --logpriority options

据我所知,到目前为止,apparmor_parser not available当未安装/启用 apparmor 时,就会发生错误。除了 apparmor 已安装并在我的系统上运行之外。

$ systemctl status apparmor.service
● apparmor.service - Load AppArmor profiles
     Loaded: loaded (/lib/systemd/system/apparmor.service; enabled; vendor >
     Active: active (exited) since Sat 2021-02-06 21:00:28 EST; 1h 37min ago
       Docs: man:apparmor(7)
             https://gitlab.com/apparmor/apparmor/wikis/home/
   Main PID: 524 (code=exited, status=0/SUCCESS)
      Tasks: 0 (limit: 8176)
     Memory: 0B
        CPU: 0
     CGroup: /system.slice/apparmor.service

Warning: some journal files were not opened due to insufficient permissions.

是什么赋予了?

编辑:

以 root (sudo) 身份创建和运行容器按预期工作,但是链接中的说明还提供了以普通用户身份运行它们的说明。

产生systemd-run --unit=myshell --user --scope -p "Delegate=yes" lxc-start -l INFO -o test1.log test1以下日志

lxc-start test1 20210611133631.168 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133631.195 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1051 - Cannot use generated profile: apparmor_parser not available
lxc-start test1 20210611133631.195 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133631.195 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133631.712 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133631.712 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133631.712 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133631.712 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133722.933 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133722.933 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133722.934 INFO     lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133722.934 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133722.934 INFO     lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133722.935 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133722.942 NOTICE   utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133722.942 NOTICE   utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133722.942 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133722.943 INFO     seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133722.945 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1051 - Cannot use generated profile: apparmor_parser not available
lxc-start test1 20210611133722.945 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133722.945 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133722.951 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133722.951 INFO     conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133723.454 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133723.454 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133723.454 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133723.454 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133821.478 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133821.478 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133821.478 INFO     lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133821.479 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133821.479 INFO     lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133821.480 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133821.487 NOTICE   utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133821.487 NOTICE   utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133821.487 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133821.488 INFO     seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133821.568 ERROR    apparmor - lsm/apparmor.c:make_apparmor_namespace:840 - Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-test1_<-home-bobby-.local-share-lxc>
lxc-start test1 20210611133821.568 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1057 - Failed to load generated AppArmor profile
lxc-start test1 20210611133821.568 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133821.568 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133821.575 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133821.576 INFO     conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133822.796 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133822.798 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133822.801 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133822.802 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options
lxc-start test1 20210611133926.195 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type u nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133926.195 INFO     confile - confile.c:set_config_idmaps:1942 - Read uid map: type g nsid 0 hostid 100000 range 65536
lxc-start test1 20210611133926.196 INFO     lxccontainer - lxccontainer.c:do_lxcapi_start:979 - Set process title to [lxc monitor] /home/bobby/.local/share/lxc test1
lxc-start test1 20210611133926.196 WARN     apparmor - lsm/apparmor.c:lsm_apparmor_ops_init:1269 - Per-container AppArmor profiles are disabled because the mac_admin capability is missing
lxc-start test1 20210611133926.196 INFO     lsm - lsm/lsm.c:lsm_init:40 - Initialized LSM security driver AppArmor
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 0 hostid 100000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type u nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 0 hostid 100000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 1000 hostid 1000 range 1
lxc-start test1 20210611133926.196 INFO     conf - conf.c:add_idmap_entry:4462 - Adding id map: type g nsid 5 hostid 100005 range 1
lxc-start test1 20210611133926.199 NOTICE   utils - utils.c:lxc_switch_uid_gid:1398 - Switched to gid 0
lxc-start test1 20210611133926.199 NOTICE   utils - utils.c:lxc_switch_uid_gid:1407 - Switched to uid 0
lxc-start test1 20210611133926.200 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "reject_force_umount  # comment this to allow umount -f;  not recommended"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:524 - Set seccomp rule to reject force umounts
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "[all]"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "kexec_load errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[246:kexec_load] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[246:kexec_load] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "open_by_handle_at errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[304:open_by_handle_at] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[304:open_by_handle_at] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "init_module errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[175:init_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[175:init_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "finit_module errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[313:finit_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[313:finit_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:807 - Processing "delete_module errno 1"
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding native rule for syscall[176:delete_module] action[327681:errno] arch[0]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741827]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:do_resolve_add_rule:564 - Adding compat rule for syscall[176:delete_module] action[327681:errno] arch[1073741886]
lxc-start test1 20210611133926.200 INFO     seccomp - seccomp.c:parse_config_v2:1017 - Merging compat seccomp contexts into main context
lxc-start test1 20210611133926.201 ERROR    apparmor - lsm/apparmor.c:make_apparmor_namespace:840 - Permission denied - Error creating AppArmor namespace: /sys/kernel/security/apparmor/policy/namespaces/lxc-test1_<-home-bobby-.local-share-lxc>
lxc-start test1 20210611133926.201 ERROR    apparmor - lsm/apparmor.c:apparmor_prepare:1057 - Failed to load generated AppArmor profile
lxc-start test1 20210611133926.201 ERROR    start - start.c:lxc_init:832 - Failed to initialize LSM
lxc-start test1 20210611133926.201 ERROR    start - start.c:__lxc_start:1945 - Failed to initialize container "test1"
lxc-start test1 20210611133926.204 NOTICE   utils - utils.c:lxc_setgroups:1420 - Dropped additional groups
lxc-start test1 20210611133926.204 INFO     conf - conf.c:run_script_argv:330 - Executing script "/usr/share/lxcfs/lxc.reboot.hook" for container "test1", config section "lxc"
lxc-start test1 20210611133926.706 ERROR    lxccontainer - lxccontainer.c:wait_on_daemonized_start:851 - No such file or directory - Failed to receive the container state
lxc-start test1 20210611133926.707 ERROR    lxc_start - tools/lxc_start.c:main:308 - The container failed to start
lxc-start test1 20210611133926.707 ERROR    lxc_start - tools/lxc_start.c:main:311 - To get more details, run the container in foreground mode
lxc-start test1 20210611133926.707 ERROR    lxc_start - tools/lxc_start.c:main:313 - Additional information can be obtained by setting the --logfile and --logpriority options

答案1

我在 Debian Buster 上遇到了完全相同的问题,我的解决方案是将 or /usr/sbin/sbin因为apparmor_*留在那里)就像$PATH我在这个链接中看到的那样:

https://github.com/lxc/lxc/issues/3049

~/.bashrc将以下命令放在当前用户或所有用户的最后一行/etc/profile(谢谢,Thomas N!):

export PATH=/sbin:/usr/sbin:$PATH

之后更新您的终端source ~/.bashrcsource /etc/profile.

答案2

非特权用户无法创建 apparmor命名空间。使用lxc.apparmor.profile = unconfined。这也是Debian Wiki 建议什么。您也可以尝试lxc.apparmor.profile = lxc-container-default-cgns,但在这种情况下,网络在容器中不起作用。

答案3

这是一条评论,我只是想附上我的配置,它可能对你有帮助。 Debian 上的 LXC 稳定版 - Buster,没有 apparmor,我在开始使用 lxc 之前已经卸载了它;所以我无法对 lxc + apparmor 提出建议。但没有 apparmor 的 lxc 也是可能的。

/etc/lxc/default.conf

lxc.apparmor.profile = unconfined
lxc.apparmor.allow_nesting = 0
lxc.mount.auto = proc:mixed sys:ro cgroup:mixed
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:FF:xx:xx:xx:xx

相关内容