http://bugzilla.opensuse.org/show_bug.cgi?id=1085996 Bug ID: 1085996 Summary: LXD container network setup fails on OpenSuse with apparmor denials Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.0 Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: AppArmor Assignee: suse-beta@cboltz.de Reporter: bzeller@suse.com QA Contact: qa-bugs@suse.de Found By: --- Blocker: --- Creating and setting up LXD containers did work with openSuse Leap 42.x, however on newer versions (Leap15 and Tumbleweed) this started to fail: https://github.com/lxc/lxd/issues/4340 This seems to point into the direction of a problem with the openSuse kernel or maybe missing patches (see comment https://github.com/lxc/lxd/issues/4340#issuecomment-374273862). Network setup fails even though the container apparmor profiles should allow it: Some of the apparmor failures (more info to be found in the LXD bug): type=AVC msg=audit(1521468900.083:152): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4014 comm="dhclient" family="packet" sock_type="raw" protocol=768 type=AVC msg=audit(1521468900.459:153): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4068 comm="ifconfig" family="inet" sock_type="dgram" protocol=0 type=AVC msg=audit(1521468900.459:154): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4068 comm="ifconfig" family="inet6" sock_type="dgram" protocol=0 type=AVC msg=audit(1521468900.459:155): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4068 comm="ifconfig" family="inet" sock_type="dgram" protocol=0 type=AVC msg=audit(1521468900.459:156): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4068 comm="ifconfig" family="inet6" sock_type="dgram" protocol=0 type=AVC msg=audit(1521468901.219:157): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4096 comm="snapd" family="inet" sock_type="stream" protocol=6 type=AVC msg=audit(1521468901.219:158): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4096 comm="snapd" family="inet6" sock_type="stream" protocol=6 type=AVC msg=audit(1521468901.219:159): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4096 comm="snapd" family="inet6" sock_type="stream" protocol=6 type=AVC msg=audit(1521468901.235:160): apparmor="DENIED" operation="create" namespace="root//lxd-crazy_<var-snap-lxd-common-lxd>" profile="unconfined" pid=4094 comm="rsyslogd" family="inet" sock_type="dgram" protocol=0 -- You are receiving this mail because: You are on the CC list for the bug.