<div dir="ltr"><div class="gmail_quote">Hello,<br>
<br>I run unprivileged containers and I want them to have access to video and sound devices. Hence, I the following in my ~/.config/lxc/default.conf as suggested on Stéphane's blog:<br>
<br>
# Container specific configuration<br>
lxc.id_map = u 1001 101001 64535<br>
lxc.id_map = g 1001 101001 64535<br>
# uid and gid 1000 isn’t translated so that the container can access the<br>
# X socket and dri and snd and video0 devices<br>
lxc.id_map = u 0 100000 1000<br>
lxc.id_map = g 0 100000 1000<br>
lxc.id_map = u 1000 1000 1<br>
lxc.id_map = g 1000 1000 1<br>
<br>
I was wondering compared to an unprivileged container where I simply<br>
map:<br>
<br>
lxc.id_map=u 0 100000 65536<br>
lxc.id_map=g 0 100000 65536<br>
<br>
1) Am I significantly more vulnerable when I preserve the uid/gid of my<br>
unprivileged user on the host for my user in the container?<br>
<br>
2) And is there a different solution which would allow me to grant<br>
access to the sound and video devices in /dev/snd and /dev/dri to the<br>
user in my unprivileged container while still preserving the standard<br>
mapping:<br>
<br>
lxc.id_map=u 0 100000 65536<br>
lxc.id_map=g 0 100000 65536</div><div class="gmail_quote"><br></div><div class="gmail_quote">3) During container bootup of e.g. Debian Wheezy/Stable is constantly complaining in the following manner (log output below) and I would like to now if this can be avoided:<br><br><br><div class="gmail_quote"><br></div><div class="gmail_quote">INIT: version 2.88 booting</div><div class="gmail_quote">Using makefile-style concurrent boot in runlevel S.</div><div class="gmail_quote">Cleaning up temporary files... /tmp.</div><div class="gmail_quote">mount: permission denied</div><div class="gmail_quote">mount: permission denied</div><div class="gmail_quote">mount: permission denied</div><div class="gmail_quote">mount: permission denied</div><div class="gmail_quote">mount: permission denied</div><div class="gmail_quote">Mount point '/dev/console' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/full' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/null' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/random' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/tty' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/urandom' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/zero' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/video0' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/fb0' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/console' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/tty1' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/tty2' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/tty3' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">Mount point '/dev/tty4' does not exist. Skipping mount. ... (warning).</div><div class="gmail_quote">udev requires hotplug support, not started ... failed!</div><div class="gmail_quote"> failed!</div><div class="gmail_quote">Activating lvm and md swap...done.</div><div class="gmail_quote">Checking file systems...fsck from util-linux 2.20.1</div><div class="gmail_quote">done.</div><div class="gmail_quote">Mounting local filesystems...done.</div><div class="gmail_quote">/etc/init.d/mountall.sh: 59: kill: Illegal number: 4 1</div><div class="gmail_quote">Activating swapfile swap...done.</div><div class="gmail_quote">Cleaning up temporary files....</div><div class="gmail_quote">Setting kernel variables ...done.</div><div class="gmail_quote">Configuring network interfaces...done.</div><div class="gmail_quote">Cleaning up temporary files....</div><div class="gmail_quote">Setting up ALSA...Invalid card number.</div><div class="gmail_quote">Usage: amixer <options> [command]</div><div class="gmail_quote">Available options:</div><div class="gmail_quote"> -h,--help this help</div><div class="gmail_quote"> -c,--card N select the card</div><div class="gmail_quote"> -D,--device N select the device, default 'default'</div><div class="gmail_quote"> -d,--debug debug mode</div><div class="gmail_quote"> -n,--nocheck do not perform range checking</div><div class="gmail_quote"> -v,--version print version of this program</div><div class="gmail_quote"> -q,--quiet be quiet</div><div class="gmail_quote"> -i,--inactive show also inactive controls</div><div class="gmail_quote"> -a,--abstract L select abstraction level (none or basic)</div><div class="gmail_quote"> -s,--stdin Read and execute commands from stdin sequentially</div><div class="gmail_quote">Available commands:</div><div class="gmail_quote"> scontrols show all mixer simple controls</div><div class="gmail_quote"> scontents<span class="" style="white-space:pre"> </span> show contents of all mixer simple controls (default command)</div><div class="gmail_quote"> sset sID P set contents for one mixer simple control</div><div class="gmail_quote"> sget sID get contents for one mixer simple control</div><div class="gmail_quote"> controls show all controls for given card</div><div class="gmail_quote"> contents show contents of all controls for given card</div><div class="gmail_quote"> cset cID P set control contents for one control</div><div class="gmail_quote"> cget cID get control contents for one control</div><div><br></div>
<br>
Best,<br>
Christian<br><br>System Information:<br><br>Arch Linux with user namespace supported kernel.<br>lxc 1.0.7<br><br>this script:</div><div class="gmail_quote"><br>cgroups are created with printf '\n\033[42mCreating cgroup hierarchy\033[m\n\n' &&</div><div class="gmail_quote">for d in /sys/fs/cgroup/*; do</div><div class="gmail_quote"> f=$(basename $d)</div><div class="gmail_quote"> echo "looking at $f"</div><div class="gmail_quote"> if [ "$f" = "cpuset" ]; then</div><div class="gmail_quote"> echo 1 | sudo tee -a $d/cgroup.clone_children;</div><div class="gmail_quote"> elif [ "$f" = "memory" ]; then</div><div class="gmail_quote"> echo 1 | sudo tee -a $d/memory.use_hierarchy;</div><div class="gmail_quote"> fi</div><div class="gmail_quote"> sudo mkdir -p $d/$USER</div><div class="gmail_quote"> sudo chown -R $USER $d/$USER</div><div class="gmail_quote"> # add current process to cgroup</div><div class="gmail_quote"> echo $$ > $d/$USER/tasks</div><div class="gmail_quote">done</div></div>