<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 14/10/2016 12:34, Brian Candler
wrote:<br>
</div>
<blockquote
cite="mid:bc35927a-a896-4db9-ae90-dbaaccc400a5@pobox.com"
type="cite">
<p>[root@test ~]# su - admin<br>
<b>su: cannot set groups: Invalid argument</b></p>
So I'm wondering about the best way to deal with this.<br>
<br>
(1) I can try to configure FreeIPA to allocate uids in the "low"
range, say 2000+.<br>
<br>
(2) I can try to do get lxd to map a larger range, for example map
1134400000 upwards to 2134400000 on the host. But are there
problems in that approach? Is there a reason why the default lxd
config only maps 64K worth of uids?<br>
<br>
</blockquote>
<p>or option (3): just run all containers in privileged mode. This
"just works".<br>
</p>
<p>[root@test ~]# id<br>
uid=0(root) gid=0(root) groups=0(root)<br>
[root@test ~]# su - admin<br>
su: warning: cannot change directory to /home/admin: No such file
or directory<br>
-bash-4.2$ id<br>
uid=1134400000(admin) gid=1134400000(admins)
groups=1134400000(admins)<br>
</p>
<p><br>
</p>
<p>Question 1: does security.privileged only affect whether uid
mapping is done, or are there other rights it gives to the
container? I have tried googling for this, I can't haven't been
able to find out *exactly* what security.privileged changes.</p>
Question 2: it seems the uids get fixed automatically. Is lxd simply
chown'ing all the files recursively, or is there some mapping option
set at mount time, or something else?<br>
<br>
$ lxc stop test<br>
$ sudo ls -l /var/lib/lxd/containers/test/rootfs/ | head -3<br>
total 74<br>
lrwxrwxrwx 1 100000 100000 7 Oct 14 03:20 bin -> usr/bin<br>
dr-xr-xr-x 3 100000 100000 3 Oct 14 11:35 boot<br>
$ lxc config set test security.privileged true<br>
$ sudo ls -l /var/lib/lxd/containers/test/rootfs/ | head -3<br>
total 74<br>
lrwxrwxrwx 1 100000 100000 7 Oct 14 03:20 bin -> usr/bin<br>
dr-xr-xr-x 3 100000 100000 3 Oct 14 11:35 boot<br>
$ lxc start test<br>
$ sudo ls -l /var/lib/lxd/containers/test/rootfs/ | head -3<br>
total 74<br>
lrwxrwxrwx 1 root root 7 Oct 14 03:20 bin -> usr/bin<br>
dr-xr-xr-x 3 root root 3 Oct 14 11:35 boot<br>
$<br>
<br>
Thanks,<br>
<br>
Brian.<br>
</body>
</html>