Yesterday i updated the packages on my Proxmox 5.1 node. Everything appeared to run fine, but this morning i noticed my Owncloud client wouldn’t connect. So i logged in and found my Ubuntu 16.04 container that runs Owncloud was off. Looking through the logs it showed that the Owncloud container turned off and backed up to the NFS share normally, but could not restart after the backup. I tried to start it via the GUI and via lxc-start -n 103 -F but nada. So i rebooted the node. Now all of my containers cannot start because rebooting shut them all off (of course).
The output when trying to start container 103 is:
sudo lxc-start -n 103 -F lxc-start: 103: lxccontainer.c: do_lxcapi_start: 984 Permission denied - Failed to make / rslave at start up lxc-start: 103: tools/lxc_start.c: main: 371 container failed to start. lxc-start: 103: tools/lxc_start.c: main: 375 Additional information can be obtained by setting the --logfile and --logpriority options
i ran “lxe-checkconfig 103” and the output of it came back all green, no apparent errors.
So next i used journalctl -xe and found this little nugget in the logs:
node1 audit: AVC apparmor="DENIED" operation="mount" info-"failed mntpnt match" error=-13 profile="/usr/bin/lxc-start" name="/" pid=5540 comm="lxc-start" flags="rw, rslave"
So it seems apparmor is not letting the container mount it’s filesystems because of permissions. So i pull the update logs using
awk '$1=="2018-03-15" && $3=="upgrade"' /var/log/dpkg.log
and i confirmed that yes AppArmor update to 2.11.0-3+deb9u2 when i did the package update
(i pulled that command from: https://superuser.com/questions/38717/how-can-i-undo-or-rollback-an-apt-get-upgrade-command-on-ubuntu )
So i try to pull the previous version of the AppArmor package from the local cache of packages on the node but it’s already gone.
So now is the point where i’m at a brickwall. I don’t know how to manipulate profiles or permissions regarding apparmor, and i can’t find any resources on how to roll back the service to a previous version.