Can't deploy nested focal LXDs on an impish host

[Barry Price]

Using the lxd/localhost provider on an impish amd64 host, running the latest Juju snap:

https://paste.ubuntu.com/p/tPxpyv4jrZ/

I've only tested focal guests on impish, but can test other series if that's helpful.

Syslog is full of repeated apparmor DENIED messages like these, seems to be the same targets each time (netstat and snmp):

Oct 22 14:53:50 x1c9 kernel: [100445.847161] audit: type=1400 audit(1634889229.997:201586): apparmor="DENIED" operation="open" namespace="root//lxd-juju-b43d75-0_<var-snap-lxd-common-lxd>" profile="snap.juju-db.daemon" name="/proc/709/net/netstat" pid=6088 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000
Oct 22 14:53:50 x1c9 kernel: [100445.847170] audit: type=1400 audit(1634889229.997:201587): apparmor="DENIED" operation="open" namespace="root//lxd-juju-b43d75-0_<var-snap-lxd-common-lxd>" profile="snap.juju-db.daemon" name="/proc/709/net/snmp" pid=6088 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000

[Barry Price (barryprice)]

Decided to work around this by starting up a multipass VM, manually adding that to my model as machine 0, then deploying LXDs onto that, but I see the same issue:

0 started 10.214.6.65 manual:10.214.6.65 focal Manually provisioned machine
0/lxd/0 pending juju-789e09-0-lxd-0 focal Container started
0/lxd/1 pending juju-789e09-0-lxd-1 focal Container started

So this isn't necessarily LXD-specific on the provider side after all - updated bug title.

[Juan Jimenez (juan.jimenez)]

When I run LXD my kernel ring buffer gets 2 messages per second like the following:

audit: type=1400 audit(1639672400.005:56710): apparmor="DENIED" operation="open" namespace="root//lxd-juju-25e091-0_<var-snap-lxd-common-lxd>" profile="snap.juju-db.daemon" name="/proc/911/net/snmp" pid=217059 comm="ftdc" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=1000000

And in syslog I have some like these:

audit: type=1400 audit(1639639794.117:278): apparmor="DENIED" operation="open" namespace="root//lxd-juju-25e091-0_<var-snap-lxd-common-lxd>" profile="snap.juju-db.daemon" name="/sys/block/" pid=12096 comm="mongod" requested_mask="r" denied_mask="r" fsuid=1000000 ouid=0

[Canonical Juju QA Bot (juju-qa-bot)]

This Medium-priority bug has not been updated in 60 days, so we're marking it Low importance. If you believe this is incorrect, please update the importance.