Steps to reproduce:
-
Create a new unprivileged xenial lxc container. Make sure it’s up-to-date and has squashfuse installed
-
Install the hello-world snap:
snap install hello-world
-
Run
hello-world
. Note that it works -
Now create a new PRIVILEGED xenial lxc container (e.g.
lxc launch ubuntu:xenial -e -c security.privileged=true
). Make sure it’s up-to-date and has squashfuse installed -
Install the hello-world snap:
snap install hello-world
-
Run
hello-world
. Note that it does NOT work, failing with the message “cannot perform operation: mount --rbind /snap /snap: Permission denied”. Also note a denial like the following in your syslog:Jul 20 19:56:23 still-chigger kernel: [ 8872.278527] audit: type=1400 audit(1500580583.874:335): apparmor=“DENIED” operation=“mount” info=“failed flags match” error=-13 profile=“lxd-still-chigger_</var/lib/lxd>” name="/snap/" pid=8595 comm=“snap-confine” srcname="/snap/" flags=“rw, rbind”