search

canonical / lxd

Powerful system container and virtual machine manager
https://canonical.com/lxd
GNU Affero General Public License v3.0
4.35k stars 930 forks source link

Unknown configuration key "lxc.aa_profile" #4396

Closed sajoupa closed 6 years ago

sajoupa commented 6 years ago

Required information

Issue description

I'm using nested containers. Physical machine: ubuntu 17.10, running lxd 3.0.0 (stable snap). Within a nested container (security.nesting=true), I run several lxds created with conjure-up. They've been running fine until today:

ubuntu@conjure-up-full:~$ lxc start juju-61f4fa-0
Error: Failed to load raw.lxc
Try `lxc info --show-log juju-61f4fa-0` for more info
ubuntu@conjure-up-full:~$ lxc info --show-log juju-61f4fa-0
Name: juju-61f4fa-0
Remote: unix://
Architecture: x86_64
Created: 2018/03/27 19:14 UTC
Status: Stopped
Type: persistent
Profiles: default, juju-conjure-openstack-novalx-91b

Log:

            lxc 20180403092910.637 WARN     lxc_monitor - monitor.c:lxc_monitor_fifo_send:111 - Failed to open fifo to send message: No such file or directory.
            lxc 20180403092910.637 WARN     lxc_monitor - monitor.c:lxc_monitor_fifo_send:111 - Failed to open fifo to send message: No such file or directory.
            lxc 20180403092911.492 WARN     lxc_monitor - monitor.c:lxc_monitor_fifo_send:111 - Failed to open fifo to send message: No such file or directory.
            lxc 20180403092911.492 WARN     lxc_monitor - monitor.c:lxc_monitor_fifo_send:111 - Failed to open fifo to send message: No such file or directory.
lxc 20180403100455.470 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403100455.471 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403100626.398 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403100626.398 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403100626.439 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403100626.440 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403100724.336 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403100724.337 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403100957.259 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403100957.264 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403150512.856 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403150512.856 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403151725.548 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403151725.548 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403155828.171 ERROR    lxc_confile - confile.c:parse_line:2340 - Unknown configuration key "lxc.aa_profile"
lxc 20180403155828.171 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403160106.716 ERROR    lxc_confile - confile.c:parse_line:2354 - Unknown configuration key "lxc.aa_profile"
lxc 20180403160106.717 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined
lxc 20180403160114.695 ERROR    lxc_confile - confile.c:parse_line:2354 - Unknown configuration key "lxc.aa_profile"
lxc 20180403160114.695 ERROR    lxc_parse - parse.c:lxc_file_for_each_line_mmap:102 - Failed to parse config: lxc.aa_profile=unconfined

Here is the profile used by this containers:

ubuntu@conjure-up-full:~$ lxc profile show juju-conjure-openstack-novalx-91b
config:
  boot.autostart: "true"
  linux.kernel_modules: openvswitch,nbd,ip_tables,ip6_tables,netlink_diag
  raw.lxc: |
    lxc.aa_profile=unconfined
    lxc.mount.auto=sys:rw
  security.nesting: "true"
  security.privileged: "true"
description: ""
devices:
  eth0:
    nictype: bridged
    parent: lxdbr0
    type: nic
  eth1:
    nictype: bridged
    parent: conjureup0
    type: nic
  root:
    path: /
    pool: default
    type: disk
name: juju-conjure-openstack-novalx-91b
used_by:
- /1.0/containers/juju-61f4fa-0
- /1.0/containers/juju-61f4fa-1
- /1.0/containers/juju-61f4fa-10
- /1.0/containers/juju-61f4fa-11
- /1.0/containers/juju-61f4fa-12
- /1.0/containers/juju-61f4fa-13
- /1.0/containers/juju-61f4fa-14
- /1.0/containers/juju-61f4fa-15
- /1.0/containers/juju-61f4fa-2
- /1.0/containers/juju-61f4fa-3
- /1.0/containers/juju-61f4fa-4
- /1.0/containers/juju-61f4fa-5
- /1.0/containers/juju-61f4fa-6
- /1.0/containers/juju-61f4fa-7
- /1.0/containers/juju-61f4fa-8
- /1.0/containers/juju-61f4fa-9
ubuntu@conjure-up-full:~$

I tested with the --edge lxd snap, and got the same result.

Steps to reproduce

$ lxc profile create test
$ lxc profile set test raw.lxc lxc.aa_profile=unconfined
$ lxc launch -p test ubuntu:xenial test
Creating test
Error: Failed container creation:
 - https://cloud-images.ubuntu.com/releases: Failed to load raw.lxc

According to http://manpages.ubuntu.com/manpages/xenial/en/man5/lxc.container.conf.5.html, the above setting should work ?

Information to attach

brauner commented 6 years ago

Starting with the release of LXC 2.1 we have renamed a bunch of configuration keys and marked their old versions as deprecated. LXC 3.0 has removed support for the legacy configuration keys that's why your config is failing. The list of new and old counterparts is:

    Legacy Key                           | New Key                       | Comments
    -------------------------------------|-------------------------------|---------
    lxc.aa_profile                       | lxc.apparmor.profile          |
    lxc.aa_allow_incomplete              | lxc.apparmor.allow_incomplete |
    lxc.console                          | lxc.console.path              |
    lxc.devttydir                        | lxc.tty.dir                   |
    lxc.haltsignal                       | lxc.signal.halt               |
    lxc.id_map                           | lxc.idmap                     |
    lxc.init_cmd                         | lxc.init.cmd                  |
    lxc.init_gid                         | lxc.init.gid                  |
    lxc.init_uid                         | lxc.init.uid                  |
    lxc.kmsg                             | -                             | removed
    lxc.limit                            | lxc.prlimit                   |
    lxc.logfile                          | lxc.log.file                  |
    lxc.loglevel                         | lxc.log.level                 |
    lxc.mount                            | lxc.mount.fstab               |
    lxc.network                          | lxc.net                       |
    lxc.network.                         | lxc.net.[i].                  |
    lxc.network.flags                    | lxc.net.[i].flags             |
    lxc.network.hwaddr                   | lxc.net.[i].hwaddr            |
    lxc.network.ipv4                     | lxc.net.[i].ipv4.address      |
    lxc.network.ipv4.gateway             | lxc.net.[i].ipv4.gateway      |
    lxc.network.ipv6                     | lxc.net.[i].ipv6.address      |
    lxc.network.ipv6.gateway             | lxc.net.[i].ipv6.gateway      |
    lxc.network.link                     | lxc.net.[i].link              |
    lxc.network.macvlan.mode             | lxc.net.[i].macvlan.mode      |
    lxc.network.mtu                      | lxc.net.[i].mtu               |
    lxc.network.name                     | lxc.net.[i].name              |
    lxc.network.script.down              | lxc.net.[i].script.down       |
    lxc.network.script.up                | lxc.net.[i].script.up         |
    lxc.network.type                     | lxc.net.[i].type              |
    lxc.network.veth.pair                | lxc.net.[i].veth.pair         |
    lxc.network.vlan.id                  | lxc.net.[i].vlan.id           |
    lxc.pivotdir                         | -                             | removed
    lxc.pts                              | lxc.pty.max                   |
    lxc.rebootsignal                     | lxc.signal.reboot             |
    lxc.rootfs                           | lxc.rootfs.path               |
    lxc.se_context                       | lxc.selinux.context           |
    lxc.seccomp                          | lxc.seccomp.profile           |
    lxc.stopsignal                       | lxc.signal.stop               |
    lxc.syslog                           | lxc.log.syslog                |
    lxc.tty                              | lxc.tty.max                   |
    lxc.utsname                          | lxc.uts.name                  |
adamxchen commented 6 years ago

Hi there, may I ask how to fix this "issue"? It seems I have the same problem. Of course, your post explained this issue clearly "config is failing" but I cannot figure it out how to fix this? My config is set by default. Since current LXC is 3.0, do I have to manually re-config manually? If so, how to do that? I'm sorry to ask such these naive questions. I'm a college student who just starts learning OpenStack. If you can point it out with any hints(like where I should go), it will be appreciated a lot! Thank you!

--update-- I searched old news for LXC 2.1, and found that I might use "lxc-update-config", but it said "lxc-update-config: command not found"

-----More background info ------ OS: Ubuntu 16.04LTS. How/Where I start: basically, follow the link here: https://www.ubuntu.com/download/cloud/try-openstack. Past progress: Install OpenStack without configuring anything a half month ago.

sajoupa commented 6 years ago

@zetelight You can change the config of a container with: lxc config set $container_name raw.lxc "lxc.apparmor.profile=unconfined'" or for a profile: lxc profile set $profile_name raw.lxc lxc.apparmor.profile=unconfined

I don't have a conjure-up novalxd deployment to test right now, but ISTR that I updated the profile, not each container individually.

adamxchen commented 6 years ago

@sajoupa Thank you so much! It works for me now. Since I am not sure that I have set up any "profile", I update them for each container individually, Again, thanks for your help!