Dear Maintainer,

After upgrading an unprivileged container from bullseye to bookworm, LXC's
AppArmor profiles are no longer sufficient for the guest's systemd-logind.

This manifests as a 25 second hang when running certain commands (notably
sudo -i and su -) in the container. It also produces a lot of errors in the
host & guest logs.

Before the upgrade to bookworm, the hangs did not occur, and systemd-logind
started without trouble.

Forest <forestix@sonic.net> wrote on 03/04/2023 at 23:18:10+0200:
bullseye.

I guess it is plausible that /etc/lxc/default.conf has been updated in
your upgrade, resetting the lxc-apparmor-profile to something that won't
work for unprivileged containers.

The issue is "normal": the apparmor profile needed to allow
systemd-logind to work properly would allow a user in a privileged
container to escalate and become root on the host. As one can't be
certain what profile will be used, the solution lies either within LXD
(which generates custom profiles for each containers), or with creating
a dedicated apparmor profile that you use only on unprivileged
containers.

The missing lines in apparmor rules have been added in
lxc-default-with-nesting rules of apparmor for lxc 5.

See the patch below: v

From: =?utf-8?q?Pierre-Elliott_B=C3=A9cue?= <peb@debian.org>
Date: Mon, 1 Aug 2022 22:35:10 +0200
Subject: [nesting] Extend mount permissions in apparmor to allow systemd
 services' restrictions to work

These options allow systemd security features to work. In particular
cases, it helps with systemd-logind and program like this

It's only added in nesting profile as it could pose security risks on
privileged containers.

mount options=(rw,rbind) -> /run/systemd/unit-root/,
mount options=(rw,rbind) -> /run/systemd/unit-root/**,
mount options=(rw,rshared) -> /,
mount options=(rw,nosuid,nodev,noexec) proc -> /run/systemd/unit-root/proc/,
---                                                                                                           
 config/apparmor/profiles/lxc-default-with-nesting | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/config/apparmor/profiles/lxc-default-with-nesting b/config/apparmor/profiles/lxc-default-with-nesting
index cd198be..01562a9 100644
--- a/config/apparmor/profiles/lxc-default-with-nesting                                                       
+++ b/config/apparmor/profiles/lxc-default-with-nesting
@@ -10,6 +10,10 @@ profile lxc-container-default-with-nesting flags=(attach_disconnected,mediate_de
   mount fstype=proc -> /var/cache/lxc/**,
   mount fstype=sysfs -> /var/cache/lxc/**,
   mount options=(rw,bind),
+  mount options=(rw,rbind) -> /run/systemd/unit-root/,
+  mount options=(rw,rbind) -> /run/systemd/unit-root/**,
+  mount options=(rw,rshared) -> /,
+  mount options=(rw,nosuid,nodev,noexec) proc -> /run/systemd/unit-root/proc/,
   mount fstype=cgroup -> /sys/fs/cgroup/**,
   mount fstype=cgroup2 -> /sys/fs/cgroup/**,
 }

guest and a freshly installed one) does not exhibit the 25 second hang.  A
freshly installed Buster guest doesn't, either.  Not even with the default
config instead of nesting.conf.

To be precise:  Although Bullseye and Buster do generate apparmor mount
errors in the host's syslog, the 25 second hang is new with Bookworm guests.
Maybe multiple problems are in play here?

Nope. I haven't upgraded the Bullseye host machine on which I discovered the
hang, and it occurs on both that host and a newly installed Bookworm host.
Also, I checked default.conf on both hosts just now, and it matches the one
in lxc_5.0.2-1_amd64.deb.

My fresh Bookworm VM has lxc 5, and those four additional lines are present
in /etc/apparmor.d/lxc/lxc-default-with-nesting.  The contents of
/usr/share/lxc/config/nesting.conf are also identical.  Even when including
it in my container config, the 25 second hang persists.

I tried LXD as a workaround.  Turns out it is not a suitable replacement in
my case.

I would be happy to try a modified apparmor profile.  Ideally even get it
added into Bookworm's lxc package, or accepted upstream, so Bookworm doesn't
arrive in this broken state for lxc users.

I tried modifying the apparmor profile based on the host's syslog messages.
Despite using exactly the same mount options that appeared in the logs, the
errors and the 25 second hang persisted.  (And I did remember to reload the
profile with apparmor_parser -r.)  I wonder if the info="failed flags match"
in those syslog messages is supposed to hint that something more is needed.

It seems like we're missing some information here.