Inside my container I specify a /etc/my/rsyslog.conf for rsyslog.
It runs RHEL 9.5 (alledgedly based on ubi-minimal:9.5) and no apparmor.
When I run the container on RHEL 9.5 via podman 4.9.4, it just works.
(There is no apparmor on this host, so perhaps this is not a surprise.)
When I run the container on Ubuntu 24 via podman 4.9.3, I get these errors:
rsyslogd: could not open config file ‘/etc/my/rsyslog.conf’: Permission denied [v8.2510.0-2.el9 try https://www.rsyslog.com/e/2104 ]
rsyslogd: run failed with error -2104 (see rsyslog.h or try https://www.rsyslog.com/e/2104 to learn what that number means)
This seems to be the same issue as reported
I tried following this tutorial to update my apparmor profiles but the aa-* commands all fail with ERROR: Operation {'runbindable'} cannot have a source. Source = AARE('/') which I have not found any leads on how to resolve.
The tutorial also seems to imply that I must explicitly tell podman to use apparmor via run parameter --security-opt apparmor=<profile> but I do no such thing.
(I am not the only one working on this container, but as far as I know there is no apparmor configuration / setup / whathaveyou for it yet at all.)
I tried adding the line /etc/my/rsyslog.conf r, to /etc/apparmor.d/usr.sbin.rsyslogd to no effect. This is the rsyslog block after my addition:
# rsyslog configuration
/etc/rsyslog.conf r,
/etc/rsyslog.d/ r,
/etc/rsyslog.d/** r,
/etc/my/rsyslog.conf r,
/{,var/}run/rsyslogd.pid{,.tmp} rwk,
I grep -Firn rsyslog /etc/apparmor.d-ed to check if any other mentions of rsyslog exist, and there are none.
… But what I actually want is that the settings for the host do not bleed through into the container! One of my hosts happens to run Ubuntu (and thus one of my hosts has this issue) – the whole point of using a container is that I need not care about the host!
What good is isolation if it is not isolated!?
How do I separate apparmor between host and container, such that my host profiles do not – cannot – affect the inner workings of my container?
… I would understand and expect this behaviour if, say, I had mounted the file into the container, and apparmor blocked access to the file on the host system – but this is not the case. All rsyslog stuff inside my container is part of the container, installed when building the container, using the RHEL facilities (e.g. dnf, not apt), and ought to be completely undisturbed by whatever rules apply outside.
