[Bug 1418279] Re: Automount NFSv4 doesn't work

[Andreas Hasenack]

You can run this to set a container to privileged mode:

lxc config set <container-name> security.privileged true

And then restart it:

lxc restart <container-name>

After that, the users inside the container are no longer mapped to a higher uid:
root     21301  0.0  0.0 602368  6120 ?        Ss   17:45   0:00 [lxc monitor] /var/lib/lxd/containers bionic-privileged
root     21322  3.2  0.0 159416  6096 ?        Ss   17:45   0:00  \_ /sbin/init
root     21422  0.7  0.0  78304  6320 ?        S<s  17:45   0:00      \_ /lib/systemd/systemd-journald
systemd+ 21692  0.2  0.0  80012  3924 ?        Ss   17:45   0:00      \_ /lib/systemd/systemd-networkd
...


But something I forgot to clarify: are you using lxc or lxd containers? I assumed lxd. And the host is running what, xenial?

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to autofs in Ubuntu.
https://bugs.launchpad.net/bugs/1418279

Title:
  Automount NFSv4 doesn't work

Status in autofs package in Ubuntu:
  Incomplete

Bug description:
  I'm trying to use NFSv4 automount within an lxc container,  however,
  it doesn't work (it works for Solaris zones, so that's not an server
  issue).

  > cd /net/pkg/<TAB>
  /net/pkg/ not found

  > cat /etc/auto.master 
  /net	-hosts
  +dir:/etc/auto.master.d
  +auto.master

  The following log message makes me suspicious (comes 3-4 times):
  [Feb 5 01:51] audit: type=1400 audit(1423099036.365:94): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default" name="/tmp/autoHBYlmU/" pid=27748 comm="mount" srcname="/tmp/autogYuIlN/" flags="rw, bind"

  But AFAICS rw,bind is allowed:
  >cat /etc/apparmor.d/lxc/lxc-default
  profile lxc-container-default flags=(attach_disconnected,mediate_deleted) {
    deny mount fstype=devpts,
  	mount options=(rw, rbind),
  	mount fstype=nfs,
  	mount fstype=nfs4,
  	mount fstype=rpc_pipefs,
  	mount fstype=autofs,
  }
  That's the profile in the global/parent zone used by all our containers. So not sure, whether it is actually a NFSv4 or apparmor bug ...

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/autofs/+bug/1418279/+subscriptions