Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I convince apparmor to allow this operation?

[28763.284171] type=1400 audit(1344273461.387:192): apparmor="DENIED"
operation="mount" info="failed type match" error=-13 parent=7101
profile="lxc-container-with-nesting" name="/" pid=7112 comm="su"
flags="ro, remount, bind"

Basically I'm trying to remount the root filesystem read-only (in a mount namespace nested in an LXC container). The setup is a few bind mounts around the place ending with:

mount --rbind / /
mount -o remount,ro /

I tried every combination of:

mount options=(ro, remount, bind) / -> /,

I could think of. Adding the rule audit mount, shows all the other mounts I do, but not the ones operating on /. The closest I can get is mount -> /, which IMHO is too loose. Even mount / -> /, denies the remount (while the first bind mount is allowed).

share|improve this question
You may get help here: – user25656 Jan 13 '13 at 15:45

As per:

Bind's have the same options as the original, so you can only bind mount a rw copy of /.. unless you remount your entire / to ro.. which I'm guessing you don't want to do.

Needs to be in two steps.

mount --bind /vital_data /untrusted_container/vital_data

mount -o remount,ro /untrusted_container/vital_data

share|improve this answer
Actually, that is exactly what I want to do. All the directories that need to be writable (surprisingly few, btw) are on another filesystem. The only issue is I cannot convince AppArmor to allow this specific operation. – Grzegorz Nosek Feb 26 '13 at 18:13
Hmm, maybe you can just disable apparmor – Grizly Feb 26 '13 at 21:55
Yeah, I can either disable AppArmor, or allow mounting anything on /, as I mentioned in the question. Still, that doesn't help me if I actually want to benefit from AppArmor. – Grzegorz Nosek Feb 27 '13 at 18:02
You could try NFS… – Grizly Feb 27 '13 at 21:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.