Running needrestart within an lxc container that allows nesting

[mphilipps]

hi,
I just tried running needrestart in an lxc container with

lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 1

Apparently lxc mounts proc multiple times:

$ mount | grep proc
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
proc on /proc/sys/net type proc (rw,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
lxcfs on /proc/cpuinfo type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/diskstats type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/meminfo type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/stat type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/swaps type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
lxcfs on /proc/uptime type fuse.lxcfs (rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other)
proc on /dev/.lxc/proc type proc (rw,relatime)

to allow nesting. When running needrestart the proc in /dev/.lxc throws plenty of Can't opendir Permission denied, other than that needrestart appears to work just fine.
Is there anyway to blacklist /dev/.lxc?

[liske]

Can you please post the output of needrestart -v?

[mphilipps]

Sure:

needrestart_v.txt

[liske]

This is an issue in the external Proc::ProcessTable library. Could you give the following patch a try? It should suppress those logging messages by overriding the warning handler in Proc::ProcessTable (I'm not able to test it for myself at the moment):

diff --git a/perl/lib/NeedRestart/Utils.pm b/perl/lib/NeedRestart/Utils.pm
index ba45ba6..29b6fe4 100644
--- a/perl/lib/NeedRestart/Utils.pm
+++ b/perl/lib/NeedRestart/Utils.pm
@@ -45,7 +45,11 @@ our @EXPORT = qw(
     nr_fork_pipe2
 );
 
-my %ptable = map {$_->pid => $_} @{ new Proc::ProcessTable(enable_ttys => 1)->table };
+my %ptable;
+{
+    local $SIG{__WARN__} = sub {};
+    %ptable = map {$_->pid => $_} @{ new Proc::ProcessTable(enable_ttys => 1)->table };
+}
 
 sub nr_ptable() {
     return \%ptable;

[mphilipps]

Tested, it does hide the messages.

[liske]

Thanks!