Learn how to fix AppArmor Denied Operation mount info failed flags match Error 13. Our LXC/LXD Support team is here to help you with your questions and concerns.

AppArmor Denied Operation mount info failed flags match Error 13

If you have had trouble with the following error message, it is due to an issue with mounting a filesystem within an LXC container

“lxc mount apparmor=DENIED operation=mount error=-13”

It is most likely due to AppArmor’s security restrictions. Let’s break down what this error means and explore how to resolve it.

Causes Behind the Error

• The AppArmor profile applied to the LXC container has restrictive rules preventing filesystem mounting.
• Maybe the path we are trying to mount inside the container can be restricted by AppArmor.
• Even if the AppArmor profile allows mounting, the user running the process within the container might not have the needed permissions to access the filesystem we are trying to mount.

How to Fix the Error

Our Experts would like to point out that modifying AppArmor profiles can weaken security, so we must proceed cautiously.

1. First, review the AppArmor profile applied to the LXC container. We can find this information in the container configuration files. We have to look for rules blocking the specific mount operation.
2. If a certain rule is causing the issue, we have to modify the AppArmor profile to allow the mount operation. However, make sure the changes don’t introduce unnecessary security risks.
3. Also, double-check that the user running the process within the container has the required permissions to access the filesystem we are trying to mount.
4. Based on our needs, we can also try alternative ways for better functionality within the container. This may include copying specific files or using bind mounts for essential directories.

Example 1

Here is an example that one of our Experts handled recently.

A customer ran into the following message while an LXC container was attempting to mount a directory, and the mount operation is denied by AppArmor:

Jan 1 12:00:00 hostname kernel: [123456.789012] audit: type=1400 audit(8129657340.133:787): apparmor=”DENIED” operation=”mount” info=”failed flags match” error=-13 profile=”lxc-container-name” name=”/mnt/my-mount-point/” pid=7876 comm=”mount” flags=”rw, nosuid, nodev, noexec”

1. First, review the flags used in the mount operation. Make sure the flags are permitted by the AppArmor profile.
2. Then, edit the AppArmor profile associated with the LXC container or process. We can find this file in `/etc/apparmor.d/`.
3. We can add or adjust the mount rules to allow the necessary operations.

   For example:

   
profile lxc-container-name flags=(attach_disconnected,mediate_deleted) {
# Include base container profile
#include <abstractions/lxc/container-base>
# Allow mounting a specific directory with the required flags
mount options=(rw, nosuid, nodev, noexec) -> /mnt/my-mount-point/,
# Other profile rules...
}

4. After modifying the profile, reload it to apply the changes:

   sudo apparmor_parser -r /etc/apparmor.d/lxc/lxc-container-name
5. Next, restart the container or the process to ensure the new AppArmor profile is in effect:

   sudo lxc-stop -n container-name
sudo lxc-start -n container-name
6. Then, check if the mount operation now succeeds without generating a denied error.

Example 2

Suppose the LXC container configuration is located in `/var/lib/lxc/my-container/config` and the AppArmor profile is `/etc/apparmor.d/lxc/my-container`.

And we want to allow the container to mount `/mnt/data` with `rw, nosuid, nodev, noexec` options.

1. First, edit the AppArmor profile:

   profile lxc-my-container flags=(attach_disconnected,mediate_deleted) {
# Include base container profile
#include <abstractions/lxc/container-base>
# Allow mounting /mnt/data with specific options
mount options=(rw, nosuid, nodev, noexec) -> /mnt/data/,
# Other profile rules...
}

2. Then, reload the profile:

   sudo apparmor_parser -r /etc/apparmor.d/lxc/my-container
3. Next, make sure the container uses the correct AppArmor profile by updating `/var/lib/lxc/my-container/config`:

   lxc.apparmor.profile = lxc-my-container
4. Now, restart the container:

   sudo lxc-stop -n my-container
sudo lxc-start -n my-container
5. Then, try the mount operation within the container and check if it succeeds.

After the above steps, we will be able to address and resolve the `”lxc mount apparmor=DENIED operation=mount error=-13″` error.

Let us know in the comments if you need further help with this error.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

In brief, our Support Experts demonstrated how to fix the AppArmor “Denied Operation” Error (-13).