How do I convince apparmor to allow this operation?
[28763.284171] type=1400 audit(1344273461.387:192): apparmor="DENIED" operation="mount" info="failed type match" error=-13 parent=7101 profile="lxc-container-with-nesting" name="/" pid=7112 comm="su" flags="ro, remount, bind"
Basically I'm trying to remount the root filesystem read-only (in a mount namespace nested in an LXC container). The setup is a few bind mounts around the place ending with:
mount --rbind / / mount -o remount,ro /
I tried every combination of:
mount options=(ro, remount, bind) / -> /,
I could think of. Adding the rule
audit mount, shows all the other mounts I do, but not the ones operating on /. The closest I can get is
mount -> /, which IMHO is too loose. Even
mount / -> /, denies the remount (while the first bind mount is allowed).