<br><br><div class="gmail_quote">On Tue, Mar 6, 2012 at 1:19 PM, Mauras Olivier <span dir="ltr"><<a href="mailto:oliver.mauras@gmail.com">oliver.mauras@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div class="HOEnZb"><div class="h5"><br><br><div class="gmail_quote">On Tue, Mar 6, 2012 at 12:13 PM, Ramez Hanna <span dir="ltr"><<a href="mailto:rhanna@informatiq.org" target="_blank">rhanna@informatiq.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div><div>On Tue, Mar 6, 2012 at 1:07 PM, Mauras Olivier <<a href="mailto:oliver.mauras@gmail.com" target="_blank">oliver.mauras@gmail.com</a>> wrote:<br>
><br>
><br>
> On Tue, Mar 6, 2012 at 11:12 AM, Ramez Hanna <<a href="mailto:rhanna@informatiq.org" target="_blank">rhanna@informatiq.org</a>> wrote:<br>
>><br>
>> On Tue, Mar 6, 2012 at 12:06 PM, Iliyan Stoyanov <<a href="mailto:ilf@ilf.me" target="_blank">ilf@ilf.me</a>> wrote:<br>
>> > Hi Mauras,<br>
>> ><br>
>> > Do you by any chance have an fstab file in your container's /etc<br>
>> > directory<br>
>> > that is trying to mount devpts fs also. I had this issue a week ago with<br>
>> > some of my SL6.2 containers on a fedora 16 host. After removing<br>
>> > everything<br>
>> > /dev/pts related from the fstab in the /etc directory of the containers,<br>
>> > everything magically worked.<br>
>> ><br>
>> > BR,<br>
>> > --ilf<br>
>> ><br>
>> ><br>
>> > On Tue, 2012-03-06 at 10:54 +0100, Mauras Olivier wrote:<br>
>> ><br>
>> > Hello,<br>
>> ><br>
>> > I've finally successfully migrated my SMACK setup over SElinux to<br>
>> > isolate my<br>
>> > containers - Thanks to the folks on #selinux@freenode - on a Scientific<br>
>> > Linux 6.2 host. (I may share my policy with some details if some of you<br>
>> > are<br>
>> > interested)<br>
>> > So far so good, after loads of hits and misses almost everything works<br>
>> > correctly.<br>
>> ><br>
>> > The only thing that is not, is the multiple devpts instances. It seems<br>
>> > that<br>
>> > when specifying "lxc.pts" option in the container config, ssh stops<br>
>> > working<br>
>> > while /dev/pts is correctly mounted _but_ is still showing pts devices<br>
>> > from<br>
>> > the host.<br>
>> > There's no specific selinux avc denials, and ssh rejects the shell<br>
>> > connection with that kind of errors found when /dev/pts is not correctly<br>
>> > mounted:<br>
>> ><br>
>> > sshd[552]: error: ssh_selinux_setup_pty: security_compute_relabel: No<br>
>> > such<br>
>> > file or directory<br>
>> > sshd[556]: error: ioctl(TIOCSCTTY): Operation not permitted<br>
>> > sshd[556]: error: open /dev/tty failed - could not set controlling tty:<br>
>> > No<br>
>> > such device or address<br>
>> ><br>
>> > As you may guess /dev/tty is present and /dev/pts is correclty mounted<br>
>> > as i<br>
>> > can do: ssh root@container "ls -la /dev/pts"<br>
>> > Only assigning the pts device for the shell doesn't...<br>
>> ><br>
>> ><br>
>> > Have any of you also hit this problem? Did you find a solution?<br>
>> ><br>
>> ><br>
>> > Regards,<br>
>> > Olivier<br>
>> ><br>
>> ><br>
>> > Ps: Using lxc 0.7.5<br>
>> ><br>
>> ><br>
>> > ------------------------------------------------------------------------------<br>
>> > Keep Your Developer Skills Current with LearnDevNow!<br>
>> > The most comprehensive online learning library for Microsoft developers<br>
>> > is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,<br>
>> > Metro Style Apps, more. Free future releases when you subscribe now!<br>
>> > <a href="http://p.sf.net/sfu/learndevnow-d2d" target="_blank">http://p.sf.net/sfu/learndevnow-d2d</a><br>
>> > _______________________________________________ Lxc-users mailing list<br>
>> > <a href="mailto:Lxc-users@lists.sourceforge.net" target="_blank">Lxc-users@lists.sourceforge.net</a><br>
>> > <a href="https://lists.sourceforge.net/lists/listinfo/lxc-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/lxc-users</a><br>
>> ><br>
>> ><br>
>> ><br>
>> > ------------------------------------------------------------------------------<br>
>> > Keep Your Developer Skills Current with LearnDevNow!<br>
>> > The most comprehensive online learning library for Microsoft developers<br>
>> > is just $99.99! Visual Studio, SharePoint, SQL - plus HTML5, CSS3, MVC3,<br>
>> > Metro Style Apps, more. Free future releases when you subscribe now!<br>
>> > <a href="http://p.sf.net/sfu/learndevnow-d2d" target="_blank">http://p.sf.net/sfu/learndevnow-d2d</a><br>
>> > _______________________________________________<br>
>> > Lxc-users mailing list<br>
>> > <a href="mailto:Lxc-users@lists.sourceforge.net" target="_blank">Lxc-users@lists.sourceforge.net</a><br>
>> > <a href="https://lists.sourceforge.net/lists/listinfo/lxc-users" target="_blank">https://lists.sourceforge.net/lists/listinfo/lxc-users</a><br>
>> ><br>
>><br>
>> see my patch regarding f16 and my lxc-start-fedora script should give<br>
>> you an idea<br>
>><br>
>> --<br>
>> BR<br>
>> RH<br>
>> <a href="http://informatiq.org" target="_blank">http://informatiq.org</a><br>
><br>
><br>
> Hi,<br>
><br>
> Thanks for your reply, i actually looked at your patch, but i don't think<br>
> it's relevant to my problem as i don't start any getty in the container at<br>
> all. Now i may be missing something, if so please enlighten me.<br>
><br>
><br>
> Regards,<br>
> Olivier<br>
<br>
</div></div>in f16 systemd mounts /ev to devtmpfs no matter what you specify in your fstab<br>
the only case where it won't do that is when you have /dev already<br>
mounted on a separate block device (that's what my script does to<br>
avoid mounting /dev by systemd)<br>
if systemd mounts /dev then it has access to your host's devices<br>
and is sharing the ttys<br>
so for example if running lxc-start -n f16 it will not get you shell<br>
or any output from the container because the container is trying to<br>
access tty0 which is already in use by the host<br>
if you use the -d option then you don't get any access inside the<br>
container because lxc-console won't work<br>
again because getty will not start on tty1 or any other tty<br>
i am not sure if you can start the container or no<br>
could be sefull if you post full log of your lxc-start<br>
<div><div><br>
<br>
<br>
--<br>
BR<br>
RH<br>
<a href="http://informatiq.org" target="_blank">http://informatiq.org</a><br>
</div></div></blockquote></div><br></div></div>Ok i get it now. This is what you do here:<br><br>mount none /tmp/lxc/$name -t tmpfs<br>
rsync -a /var/lib/lxc/$name/rootfs/dev/ /tmp/lxc/$name<br>
mount /tmp/lxc/$name f16/rootfs/dev/ -obind<br>
lxc-start $* -n $name<br><br>Thing is i don't think i would change anything for my case as it's upstart used and it actually works like a charm on a non enforced selinux system or on a smack isolated container...<br>
I really feel like selinux is at fault here but can't find why ...<br><br><br>BTW shouldn't hurt to try that even if that means to modify my selinux policy.<span class="HOEnZb"><font color="#888888"><br><br><br>Olivier<br>
</font></span></blockquote></div><br>Ok apparently i had the host devpts mounted with newinstances - meh didn't remember setting that ... - and it may definitely be the culprit as removing it and rebooting did actually solve the problem!<br>
Now my container is isolated by selinux without sharing the devpts.<br>[root@curse ~]# ll -Z /dev/pts/ <br>crw--w----. root tty unconfined_u:object_r:curse_file_t:s0 0 <br>
crw-rw-rw-. root root unconfined_u:object_r:initrc_devpts_t:s0 ptmx<br><br>Sounds good to me sorry for the bother :)<br><br><br>Olivier<br><br>Ps: Now i can take some time to share my selinux policy. <br>