search

lxc / incus

Powerful system container and virtual machine manager
https://linuxcontainers.org/incus
Apache License 2.0
2.51k stars 204 forks source link

Error when trying to modify a proxy device after last update: "Couldn't identify AppArmor cache directory" #1205

Closed tarruda closed 2 weeks ago

tarruda commented 2 weeks ago

Required information

Issue description

After the last update (IIRC I was on 0.7, now on 6.5, also updated a lot of other packages including kernel), I'm unable to make changes to the proxy devices due to "Couldn't identify AppArmor cache directory" . For example, I have a container called "dante-socks5-proxy ". This is what happens when I try to modify it

$ incus config edit dante-socks5-proxy  # make any change to one of the proxy devices, in this case I tried to modify listen port from "pac-server"
Config parsing error: Failed to remove device "pac-server": Couldn't identify AppArmor cache directory
Press enter to open the editor again or ctrl+c to abort change

Steps to reproduce

Not sure how to reproduce, except that all containers I had in Incus 0.7 were affected by this after upgrading to 6.5. Apparently I can modify the configuration as long as I don't touch the proxy devices.

Information to attach

Log:

lxc dante-socks5-proxy 20240909000749.312 WARN idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:165 - newuidmap binary is missing lxc dante-socks5-proxy 20240909000749.313 WARN idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:171 - newgidmap binary is missing lxc dante-socks5-proxy 20240909000749.326 WARN idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:165 - newuidmap binary is missing lxc dante-socks5-proxy 20240909000749.327 WARN idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:171 - newgidmap binary is missing lxc dante-socks5-proxy 20240909000749.331 WARN cgfsng - ../src/lxc/cgroups/cgfsng.c:fchowmodat:1897 - No such file or directory - Failed to fchownat(16, memory.oom.group, 1000000000, 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW ) lxc dante-socks5-proxy 20240909000749.331 WARN cgfsng - ../src/lxc/cgroups/cgfsng.c:fchowmodat:1897 - No such file or directory - Failed to fchownat(16, memory.reclaim, 1000000000, 0, AT_EMPTY_PATH | AT_SYMLINK_NOFOLLOW ) lxc dante-socks5-proxy 20240909000757.953 WARN attach - ../src/lxc/attach.c:get_attach_context:478 - No security context received lxc dante-socks5-proxy 20240909000757.955 WARN idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:165 - newuidmap binary is missing lxc dante-socks5-proxy 20240909000757.955 WARN idmap_utils - ../src/lxc/idmap_utils.c:lxc_map_ids:171 - newgidmap binary is missing

 - [x] Container configuration (`incus config show NAME --expanded`)

 ```yaml
 architecture: aarch64
config:
  boot.autostart: "true"
  image.architecture: arm64
  image.description: Debian bookworm arm64 (20240906_05:24)
  image.os: Debian
  image.release: bookworm
  image.serial: "20240906_05:24"
  image.type: squashfs
  image.variant: default
  volatile.base_image: ec865857d048deea3488c2c16f401e93eca764234f9ba98d2be2a3426d87020f
  volatile.cloud-init.instance-id: 5d2b376a-c112-44bf-a6d8-f1cd89dbce9c
  volatile.eth0.hwaddr: 00:16:3e:2b:66:fe
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":1000000000}]'
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: STOPPED
  volatile.uuid: f6bf763f-e711-477e-8b74-1f0478321e65
  volatile.uuid.generation: f6bf763f-e711-477e-8b74-1f0478321e65
devices:
  eth0:
    name: eth0
    network: incusbr0
    type: nic
  pac-server:
    connect: tcp:12.12.12.210:80
    listen: tcp:192.168.1.254:8080
    nat: "true"
    type: proxy
  root:
    path: /
    pool: default
    type: disk
  socks5:
    connect: tcp:12.12.12.210:1080
    listen: tcp:192.168.1.254:1080
    type: proxy
ephemeral: false
profiles:
- default
stateful: false
description: ""

Let me know if you need any more information that might be relevant to this error.

jalbstmeijer commented 2 weeks ago

I assume this will be fixed in 6.6?

Is there an older version to go back to that will work till than?

incus network delete natbr0
Error: Couldn't identify AppArmor cache directory
tarruda commented 2 weeks ago

@jalbstmeijer the fix was merged but not released yet.

Until a fix is released, the only way to bypass the error is to activate apparmor. If you are using raspbian, it is possible to activate by appending apparmor=1 security=apparmor to /boot/firmware/cmdline.txt and then rebooting

acidvegas commented 1 day ago

@stgraber got a temporary fix? I am on void linux and they take forever to upstream shit with incus...

stgraber commented 1 day ago

Nope, the main options are: