lxc-start on default vivid container fails on apparmor violation

[Martin Pitt]

With latest vivid's LXC, starting a vivid container now fails on mounting the cgroups:

$ sudo lxc-create --name=v -t ubuntu -- -r vivid
$ sudo lxc-start -n v -F
Failed to mount cgroup at /sys/fs/cgroup/systemd: Permission denied
systemd 219 running in system mode. (+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT -GNUTLS +ACL +XZ -LZ4 -SECCOMP +BLKID -ELFUTILS +KMOD -IDN)
Detected virtualization lxc.
Detected architecture x86-64.

Welcome to Ubuntu Vivid Vervet (development branch)!

Set hostname to <v>.
Failed to install release agent, ignoring: No such file or directory
Failed to create root cgroup hierarchy: No such file or directory
Failed to allocate manager object: No such file or directory

This is due to an apparmor violation:

$ dmesg
[17921.831035] kvm [26603]: vcpu0 disabled perfctr wrmsr: 0xc1 data 0xffff
[17945.611375] device vethWK88T5 entered promiscuous mode
[17945.611487] IPv6: ADDRCONF(NETDEV_UP): vethWK88T5: link is not ready
[17945.651954] eth0: renamed from vethB6ASGB
[17945.692029] IPv6: ADDRCONF(NETDEV_CHANGE): vethWK88T5: link becomes ready
[17945.692104] lxcbr0: port 1(vethWK88T5) entered forwarding state
[17945.692116] lxcbr0: port 1(vethWK88T5) entered forwarding state
[17945.730478] audit: type=1400 audit(1428400530.895:113): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/systemd/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.730505] audit: type=1400 audit(1428400530.895:114): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/systemd/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.730931] audit: type=1400 audit(1428400530.895:115): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/devices/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.730963] audit: type=1400 audit(1428400530.895:116): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/net_cls,net_prio/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.730993] audit: type=1400 audit(1428400530.895:117): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/perf_event/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.731020] audit: type=1400 audit(1428400530.895:118): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/hugetlb/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.731049] audit: type=1400 audit(1428400530.895:119): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/cpuset/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.731077] audit: type=1400 audit(1428400530.895:120): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/freezer/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.731106] audit: type=1400 audit(1428400530.895:121): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/cpu,cpuacct/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"
[17945.731133] audit: type=1400 audit(1428400530.895:122): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxc-container-default" name="/sys/fs/cgroup/memory/" pid=28447 comm="systemd" fstype="cgroup" srcname="cgroup" flags="rw, nosuid, nodev, noexec"

The workaround is to change the container config to use "lxc.aa_profile = unconfined", but I suppose we actually want the default profile to work.

ProblemType: Bug
DistroRelease: Ubuntu 15.04
Package: lxc 1.1.1-0ubuntu4
ProcVersionSignature: Ubuntu 3.19.0-12.12-generic 3.19.3
Uname: Linux 3.19.0-12-generic x86_64
ApportVersion: 2.17-0ubuntu1
Architecture: amd64
CurrentDesktop: Unity
Date: Tue Apr 7 11:55:09 2015
EcryptfsInUse: Yes
KernLog:

SourcePackage: lxc
UpgradeStatus: No upgrade log present (probably fresh install)
defaults.conf:
 lxc.network.type = veth
 lxc.network.link = lxcbr0
 lxc.network.flags = up
 lxc.network.hwaddr = 00:16:3e:xx:xx:xx
lxc.conf: lxc.lxcpath = /srv/lxc

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Stéphane Graber (stgraber)]

You don't appear to have lxcfs running.

[Martin Pitt (pitti)]

Whatever it was, it's working on current vivid now. Sorry for the noise.