When I create a container using "lxc launch ubuntu", apparmor logs the following denial:
Jan 25 17:05:58 xxxxx kernel: [32910.202500] audit: type=1400 audit(1453763158.495:185): apparmor="DENIED" operation="mount" info="failed type match" error=-13 profile="lxd-louche-ettie_</var/lib/lxd>" name="/sys/" pid=7619 comm="mount" flags="rw, nosuid, nodev, noexec, remount"
ProblemType: Bug
DistroRelease: Ubuntu 15.10
Package: apparmor 2.10-0ubuntu6
ProcVersionSignature: Ubuntu 4.2.0-25.30-generic 4.2.6
Uname: Linux 4.2.0-25-generic x86_64
ApportVersion: 2.19.1-0ubuntu5
Architecture: amd64
CurrentDesktop: Unity
Date: Mon Jan 25 17:07:32 2016
EcryptfsInUse: Yes
InstallationDate: Installed on 2015-11-13 (73 days ago)
InstallationMedia: Ubuntu 15.10 "Wily Werewolf" - Release amd64 (20151021)
ProcKernelCmdline: BOOT_IMAGE=/vmlinuz-4.2.0-25-generic root=/dev/mapper/ubuntu--vg-root ro quiet splash vt.handoff=7
SourcePackage: apparmor
Syslog:
UpgradeStatus: No upgrade log present (probably fresh install)
Looks like systemd is unhappy with the way /sys is mounted and is remounting it. Those flags don't seem harmful so we probably can allow them.