Learn how to fix “LXC Mount CIFS Permission Denied” errors. Our LXC/LXD Support team is here to help you with your questions and concerns.

Fixing “LXC Mount CIFS Permission Denied” Errors

Mounting CIFS shares in LXC containers can sometimes be a challenging task.

This is where our Experts can help. If you run into errors during this process, there can be multiple underlying reasons.

Let’s explore some common causes and fixes to resolve these issues.

Possible Reasons for Mounting Errors

• First, make sure that the username and password used for the CIFS share are correct and valid.
• The user or group running the mount process within the container may not have the needed permissions on the host system.
• AppArmor, a Linux security framework, may have rules that prevent mounting CIFS shares within the container.
• The permissions on the CIFS share itself may restrict access for the user or group attempting the mount.
• In unprivileged LXC containers, the user and group IDs (UID/GID) inside the container are mapped to different values on the host system, potentially causing permission issues.

Steps to Resolve the Issue

1. Containers need specific capabilities to perform mount operations. So, we have to add `CAP_SYS_ADMIN` to the container.

   We can do this by editing the LXC container configuration file, usually located at `/var/lib/lxc/container-name/config`:

   lxc.cap.drop =
lxc.cap.keep = sys_admin


   Alternatively, we can allow the container to inherit the host’s capabilities. This is less secure:

   lxc.cap.drop =
2. Sometimes, AppArmor blocks the mount operation. To allow CIFS mounts, modify the AppArmor profile used by LXC.

   So, edit the profile, typically found at `/etc/apparmor.d/lxc/lxc-container-name`:

   profile lxc-container-name flags=(attach_disconnected,mediate_deleted) {
# Include base container profile
#include <abstractions/lxc/container-base>
# Allow CIFS mount
mount fstype=cifs -> /mnt/,
# Other profile rules...
}


   Then, reload the AppArmor profile:

   sudo apparmor_parser -r /etc/apparmor.d/lxc/lxc-container-name
3. Also, make sure the user inside the container has the necessary permissions to mount the share. Typically, mount operations need root privileges.

   Run the following command inside the container as root or with sudo:

   sudo mount -t cifs //server/share /mnt --verbose -o user=username,password=password,uid=1000,gid=1000


   Replace `//server/share`, `/mnt`, `username`, and `password` with the real CIFS share details and credentials.
4. Ensure the LXC configuration allows the required mount operations. Add the following lines to the container’s configuration file:

   lxc.mount.entry = //server/share /mnt cifs rw,relatime,uid=1000,gid=1000,user=username,password=password, 0 0

5. If we are using SELinux, we have to adjust its policies to allow the mount operation. This can be more complex and might involve setting specific SELinux contexts.
6. Ensure that the necessary kernel modules for CIFS are loaded on the host:

   sudo modprobe cifs

With the above steps, we will be able to troubleshoot and fix issues related to mounting CIFS shares in LXC containers.

[Need assistance with a different issue? Our team is available 24/7.]

Conclusion

In brief, our Support Experts demonstrated how to fix “LXC Mount CIFS Permission Denied” errors.