[PVE-User] Bullseye LXC and logrotate...

[PVE-User] Bullseye LXC and logrotate...

[Marco Gaiarin]

Setup a pretty standard LXC container on bullseye, on a PVE7 server.

Every time logrotate run on LXC i got on LXC:

 Oct 28 00:00:59 vbaculaacpn1 systemd[106367]: logrotate.service: Failed to set up mount namespacing: /run/systemd/unit-root/proc: Permission denied
 Oct 28 00:00:59 vbaculaacpn1 systemd[106367]: logrotate.service: Failed at step NAMESPACE spawning /usr/sbin/logrotate: Permission denied
 Oct 28 00:00:59 vbaculaacpn1 systemd[1]: logrotate.service: Main process exited, code=exited, status=226/NAMESPACE
 Oct 28 00:00:59 vbaculaacpn1 systemd[1]: logrotate.service: Failed with result 'exit-code'.
 Oct 28 00:00:59 vbaculaacpn1 systemd[1]: Failed to start Rotate log files.

And on PVE:

 Oct 28 00:00:59 beppe kernel: [280466.359176] audit: type=1400 audit(1635372059.192:31): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-102_</var/lib/lxc>" name="/run/systemd/unit-root/proc/" pid=3059401 comm="(ogrotate)" fstype="proc" srcname="proc" flags="rw, nosuid, nodev, noexec"


?! I've tried to google around a bit, but found nothing.


Thanks.

-- 
  Alla fiera dell'est, per due soldi
  un topolino mio padre compro`				(A. Branduardi)

Re: [PVE-User] Bullseye LXC and logrotate...

[Todor Petkov]

On Thu, 2021-10-28 1:36 PM, Marco Gaiarin wrote:
> 
> Setup a pretty standard LXC container on bullseye, on a PVE7 server.
> 
> Every time logrotate run on LXC i got on LXC:
> 
>   Oct 28 00:00:59 vbaculaacpn1 systemd[106367]: logrotate.service: Failed to set up mount namespacing: /run/systemd/unit-root/proc: Permission denied
>   Oct 28 00:00:59 vbaculaacpn1 systemd[106367]: logrotate.service: Failed at step NAMESPACE spawning /usr/sbin/logrotate: Permission denied
>   Oct 28 00:00:59 vbaculaacpn1 systemd[1]: logrotate.service: Main process exited, code=exited, status=226/NAMESPACE
>   Oct 28 00:00:59 vbaculaacpn1 systemd[1]: logrotate.service: Failed with result 'exit-code'.
>   Oct 28 00:00:59 vbaculaacpn1 systemd[1]: Failed to start Rotate log files.
> 
> And on PVE:
> 
>   Oct 28 00:00:59 beppe kernel: [280466.359176] audit: type=1400 audit(1635372059.192:31): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-102_</var/lib/lxc>" name="/run/systemd/unit-root/proc/" pid=3059401 comm="(ogrotate)" fstype="proc" srcname="proc" flags="rw, nosuid, nodev, noexec"
> 
> 
> ?! I've tried to google around a bit, but found nothing.
> 
> 
> Thanks.
> 


Hello,

check 
https://www.mail-archive.com/debian-bugs-dist@lists.debian.org/msg1713773.html 
and https://forum.proxmox.com/threads/logrotate-issue-in-buster-lxc.56726/

There are other links in Google when you search for Failed at step 
NAMESPACE spawning  pve logrotate

Regards

Re: [PVE-User] Bullseye LXC and logrotate...

[Marco Gaiarin]

Mandi! Stefan Radman via pve-user
  In chel di` si favelave...

> Here is what Google turned up for me.

Ah! Your google works better then mine! ;-)


Thanks, i can confirm that fixed.

It is not clear if it is better to relax CAP on LXC or relax hardening of
logrotate inside the LXC, but i hope PVE team will determine the best
solution.

Considering is a unprivileged container, relaxing logrotate seems
appropriate to me.

Thanks!

-- 
  In mondo non rinuncera` a essere violento fino a quando non accettera`
  di studiare il proprio bisogno di violenza.	(Yolande Mukagasana)

Re: [PVE-User] Bullseye LXC and logrotate...

[Marco Gaiarin]

Mandi! Arjen via pve-user
  In chel di` si favelave...

Only for the sake of google...

>> Thanks, i can confirm that fixed.

It is NOT fixed, changing logrotate systemd unit configuration does nothing.


> According to this forum post[1] by one of the Proxmox staff, enabling nesting is the way forward.
> [1] https://forum.proxmox.com/threads/lxc-container-upgrade-to-bullseye-slow-login-and-apparmor-errors.93064/post-409030

Bingo! This works! ;-)


Thanks.

-- 
  The number of UNIX installations has grown to 10, with more expected.
	(_The UNIX Programmer's Manual_, Second Edition, June 1972)