Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

How do I convince apparmor to allow this operation?

[28763.284171] type=1400 audit(1344273461.387:192): apparmor="DENIED"
operation="mount" info="failed type match" error=-13 parent=7101
profile="lxc-container-with-nesting" name="/" pid=7112 comm="su"
flags="ro, remount, bind"

Basically I'm trying to remount the root filesystem read-only (in a mount namespace nested in an LXC container). The setup is a few bind mounts around the place ending with:

mount --rbind / /
mount -o remount,ro /

I tried every combination of:

mount options=(ro, remount, bind) / -> /,

I could think of. Adding the rule audit mount, shows all the other mounts I do, but not the ones operating on /. The closest I can get is mount -> /, which IMHO is too loose. Even mount / -> /, denies the remount (while the first bind mount is allowed).

share|improve this question
    
You may get help here: lists.ubuntu.com/mailman/listinfo/apparmor –  user25656 Jan 13 '13 at 15:45
add comment

1 Answer

As per: http://lwn.net/Articles/281157/

Bind's have the same options as the original, so you can only bind mount a rw copy of /.. unless you remount your entire / to ro.. which I'm guessing you don't want to do.

Needs to be in two steps.

mount --bind /vital_data /untrusted_container/vital_data

mount -o remount,ro /untrusted_container/vital_data

share|improve this answer
    
Actually, that is exactly what I want to do. All the directories that need to be writable (surprisingly few, btw) are on another filesystem. The only issue is I cannot convince AppArmor to allow this specific operation. –  Grzegorz Nosek Feb 26 '13 at 18:13
    
Hmm, maybe you can just disable apparmor –  Grizly Feb 26 '13 at 21:55
    
Yeah, I can either disable AppArmor, or allow mounting anything on /, as I mentioned in the question. Still, that doesn't help me if I actually want to benefit from AppArmor. –  Grzegorz Nosek Feb 27 '13 at 18:02
    
You could try NFS sourceforge.net/mailarchive/… –  Grizly Feb 27 '13 at 21:57
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.