Repository navigation
infra: the CI containers' AppArmor profile allows systemd's credentials mounts - #41
Merged
Merged
Conversation
…ls mounts keel-provision writes the lxc package's nesting profile with two mount rules added: `mount fstype=ramfs,` and `mount options=(ro,remount,bind,nosuid,nodev,noexec,nosymfollow),`. systemd 257 runs sd-mkdcreds for every unit with credentials, journald included: it mounts a ramfs on /run/credentials/<unit> and remounts it read-only. The stock profile allows neither, so in a CI container journald died with status=243/CREDENTIALS, /dev/log was gone, and the first boot hooks that log under bash -e died with it (Keel-Linux/inithooks#38; the published core 19.0-6 booted headless on 2026-10-03). The profile keeps its name, so bin/unprivileged-lxc of keel-linux/.github and the runner's default.conf need no change; the file is the package's conffile, written as /etc/nftables.conf is, and reloaded through /etc/apparmor.d/lxc-containers.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What.
docs/infra/keel-provision.pending, appliance gate section: keel-provision now writes/etc/apparmor.d/lxc/lxc-default-with-nesting, the lxc package's profile (1:6.0.4-4+deb13u4, text unchanged) plus two rules, and reloads it through/etc/apparmor.d/lxc-containers:Why. systemd 257 runs
sd-mkdcredsfor every unit that has credentials, journald included: it mounts a ramfs on/run/credentials/<unit>and remounts it read-only with those options. The stock profile allows neither mount, so in a CI container (keel-lxc-1,lxc.apparmor.profile = lxc-container-default-with-nestingthroughbin/unprivileged-lxcof keel-linux/.github) journald dies withstatus=243/CREDENTIALS,/dev/logis gone, and the first boot hooks that log underbash -edie with it: the published core 19.0-6 booted headless fails its first boot (Keel-Linux/inithooks#38 makes the hooks tolerate it; this PR gives the container its journal back). The denials the host's audit log shows for it are of the shapeapparmor="DENIED" operation="mount" class="mount" profile="lxc-container-default-with-nesting" name="/run/credentials/systemd-journald.service/" fstype="ramfs"and... operation="mount" ... name="/run/credentials/systemd-journald.service/" flags="ro, remount, bind, nosuid, nodev, noexec, nosymfollow". I have no access to the VM, so these are the lines the two rules answer, reconstructed from the unit's status and systemd's mkdcreds, not copied from the host: please confirm them withjournalctl -k | grep DENIEDwhen you apply this.How it is applied. This is not applied by anything automatic:
keel-provisionruns as root on the public services VM by hand (install -m 0755 docs/infra/keel-provision.pending /usr/local/sbin/keel-provision && keel-provision, as docs/releases-host.md says, which also notes the live script is behind this file). The runner has no sudo, so this needs the maintainer. Only the appliance gate section changed; the profile keeps its name, so the runner's~/.config/lxc/default.confand.github/bin/unprivileged-lxcneed no change. The file is the lxc package's conffile, written as/etc/nftables.confalready is: an lxc upgrade that changes it will ask, and rerunning keel-provision is the answer. An alternative is a profile of our own under/etc/apparmor.d/lxc/with.github'sULX_PROFILEanddefault.confrenamed to it; one PR instead of two seemed the better trade.Checked.
sh -n; shellcheck clean but for the pre-existing SC2034 onBUILD_HOST_MIRROR. The profile text is the package's, fetched from sources.debian.org at trixie's version.