AppArmor denying a mount operation

Question

How do I convince apparmor to allow this operation?

[28763.284171] type=1400 audit(1344273461.387:192): apparmor="DENIED"
operation="mount" info="failed type match" error=-13 parent=7101
profile="lxc-container-with-nesting" name="/" pid=7112 comm="su"
flags="ro, remount, bind"

Basically I'm trying to remount the root filesystem read-only (in a mount namespace nested in an LXC container). The setup is a few bind mounts around the place ending with:

mount --rbind / /
mount -o remount,ro /

I tried every combination of:

mount options=(ro, remount, bind) / -> /,

I could think of. Adding the rule audit mount, shows all the other mounts I do, but not the ones operating on /. The closest I can get is mount -> /, which IMHO is too loose. Even mount / -> /, denies the remount (while the first bind mount is allowed).

Answer 1

As per: http://lwn.net/Articles/281157/

Bind's have the same options as the original, so you can only bind mount a rw copy of /.. unless you remount your entire / to ro.. which I'm guessing you don't want to do.

Needs to be in two steps.

mount --bind /vital_data /untrusted_container/vital_data

mount -o remount,ro /untrusted_container/vital_data