<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">
<pre wrap="">
I'm running 1.0.5, I'll test git or 1.0.6 if it come out before I can test a git version.</pre>
<br>
<br>
Il 23/09/2014 16:14, Stéphane Graber ha scritto:<br>
</div>
<blockquote cite="mid:20140923141425.GL19386@dakara" type="cite">
<pre wrap="">That very much looks like the security fix commits we've got a while
back and for which we already have workarounds in git.
Would be great if you could try running the current stable-1.0 branch
and see if that fixes it for you.
On Tue, Sep 23, 2014 at 02:15:08PM +0200, <a class="moz-txt-link-abbreviated" href="mailto:vivo75@gmail.com">vivo75@gmail.com</a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
last long term 3.14.9 has a change that make user lxc fail to start, it
seem the permission problem has been already encountered and fixed
before, in lxc userspace, not in kernel.
=======================
lxc-start --version
1.0.5
=======================
git bisect good | tee -a ${HOME}/bisect.log
9810174c0384f725a31be1dfc64a881695ad465d is the first bad commit
commit 9810174c0384f725a31be1dfc64a881695ad465d
Author: Eric W. Biederman <a class="moz-txt-link-rfc2396E" href="mailto:ebiederm@xmission.com"><ebiederm@xmission.com></a>
Date: Mon Jul 28 17:10:56 2014 -0700
mnt: Move the test for MNT_LOCK_READONLY from change_mount_flags
into do_remount
commit 07b645589dcda8b7a5249e096fece2a67556f0f4 upstream.
There are no races as locked mount flags are guaranteed to never change.
Moving the test into do_remount makes it more visible, and ensures all
filesystem remounts pass the MNT_LOCK_READONLY permission check. This
second case is not an issue today as filesystem remounts are guarded
by capable(CAP_DAC_ADMIN) and thus will always fail in less privileged
mount namespaces, but it could become an issue in the future.
Acked-by: Serge E. Hallyn <a class="moz-txt-link-rfc2396E" href="mailto:serge.hallyn@ubuntu.com"><serge.hallyn@ubuntu.com></a>
Signed-off-by: "Eric W. Biederman" <a class="moz-txt-link-rfc2396E" href="mailto:ebiederm@xmission.com"><ebiederm@xmission.com></a>
Signed-off-by: Greg Kroah-Hartman <a class="moz-txt-link-rfc2396E" href="mailto:gregkh@linuxfoundation.org"><gregkh@linuxfoundation.org></a>
:040000 040000 fdeae1bccd4d8935fe5ff820bb2a08ae9a19c15e
b2a326f9db8e6e34be00b7ad53f0dc8b203b9e93 M fs
=======================
log of the fail start follow
I lxc_start_ui - using rcfile
/srv/lxc/lxc_user/.local/share/lxc/apache2/config
I lxc_confile - read uid map: type u nsid 0 hostid 100000 range 65536
I lxc_confile - read uid map: type g nsid 0 hostid 100000 range 65536
W lxc_log - lxc_log_init called with log already initialized
D lxc_conf - allocated pty '/dev/pts/10' (5/6)
I lxc_conf - tty's configured
D lxc_start - sigchild handler set
D lxc_console - opening /dev/tty for console peer
I lxc_caps - Last supported cap was 34
D lxc_console - using '/dev/tty' as console
D lxc_console - 5072 got SIGWINCH fd 11
D lxc_console - set winsz dstfd:8 cols:80 rows:24
I lxc_start - 'apache2' is initialized
D lxc_start - Not dropping cap_sys_boot or watching utmp
I lxc_start - Cloning a new user namespace
I lxc_cgroup - cgroup driver cgroupfs initing for apache2
N lxc_start - switching to gid/uid 0 in new user namespace
D lxc_conf - mounted '/srv/lxc/lxc_user/.local/share/lxc/apache2/rootfs'
on '/usr/lib/lxc/rootfs'
I lxc_conf - 'apache2' hostname has been setup
D lxc_conf - 'eth0' has been setup
I lxc_conf - network has been setup
I lxc_conf - Mounting /dev under /usr/lib/lxc/rootfs
D lxc_conf - entering mount_check_fs for /dev
D lxc_conf - mount_check_fs returning 1 last devtmpfs
D lxc_conf - Bind mounting /dev/.lxc/apache2.f4369c12c7bf962c to
/usr/lib/lxc/rootfs/dev
I lxc_conf - Mounted /dev under /usr/lib/lxc/rootfs
D lxc_conf - remounting /dev/console on /usr/lib/lxc/rootfs/dev/console
to respect bind or remount options
E lxc_conf - Operation not permitted - failed to mount '/dev/console' on
'/usr/lib/lxc/rootfs/dev/console'
E lxc_conf - failed to setup the mount entries for 'apache2'
E lxc_start - failed to setup the container
E lxc_sync - invalid sequence number 1. expected 2
E lxc_start - failed to spawn 'apache2'
E lxc_start_ui - The container failed to start.
E lxc_start_ui - Additional information can be obtained by setting the
--logfile and --log-priority options.
_______________________________________________
lxc-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:lxc-devel@lists.linuxcontainers.org">lxc-devel@lists.linuxcontainers.org</a>
<a class="moz-txt-link-freetext" href="http://lists.linuxcontainers.org/listinfo/lxc-devel">http://lists.linuxcontainers.org/listinfo/lxc-devel</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
lxc-devel mailing list
<a class="moz-txt-link-abbreviated" href="mailto:lxc-devel@lists.linuxcontainers.org">lxc-devel@lists.linuxcontainers.org</a>
<a class="moz-txt-link-freetext" href="http://lists.linuxcontainers.org/listinfo/lxc-devel">http://lists.linuxcontainers.org/listinfo/lxc-devel</a>
</pre>
</blockquote>
<br>
</body>
</html>