invalid mount rules according to the specification (no leading '/' with mountpoint)

[jdstrand]

Hi,

I came across https://bugs.launchpad.net/lxc/+bug/2064144 which states that rules like this:

mount options=(rw, make-slave) -> **,

are non-compliant with the apparmor specification due to the mountpoint not having a leading /: "man 5 apparmor.d ==> [mountpoint] must start with ’/’ (after variable expansion).".

While this is talking about logprof (which won't interact with incus rules since there are no rules on disk (though it does impact the LXC project)), the response in the bug says "this restriction is only enforced in AppArmor since version 4.0" (referring to the parser) so incus likely is affected when run on systems with AppArmor 4.0 (note, there are still open questions to John on what to do; I just wanted you to be aware of the discussion).

Example of location of problematic AppArmor rule in incus: https://github.com/lxc/incus/blob/main/internal/server/apparmor/instance_lxc.go#L512

[jdstrand]

Fyi, John responded and said that the current syntax should continue to be supported: https://bugs.launchpad.net/lxc/+bug/2064144/comments/4.