<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 01/02/2018 08:47 PM, <a class="moz-txt-link-abbreviated" href="mailto:lxc@brak.space">lxc@brak.space</a>
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:bef4bea0-98fb-29e7-244e-c035d92b3f20@brak.space">Hi all,
<br>
<br>
Using plain lxc, not lxd, I got my Buster/Sid machine to start a
Buster container. However, it seems that systemd cannot start any
services. journalctl -xe reveals "failed to change ownership of
session keyring". If it matters I tried redis-server and
boinc-client systemd services and both produced this result, but
work fine on a physical install.
<br>
<br>
Limited research shows solutions involving seccomp to blacklist
syscall keyctl, which I tried, and produced the same result.
<br>
<br>
I did create a thread yesterday, which I resolved today simply by
installing the newest version of lxc available to me 2.0.9-5. I
think the problems I was seeing were related to apparmor, which I
am afraid is causing these issues too.
<br>
<br>
Any help would be appreciated.
<br>
<br>
Paul
<br>
_______________________________________________
<br>
lxc-users mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:lxc-users@lists.linuxcontainers.org">lxc-users@lists.linuxcontainers.org</a>
<br>
<a class="moz-txt-link-freetext" href="http://lists.linuxcontainers.org/listinfo/lxc-users">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote>
<p>I was able to search around and find an existing issue.<br>
<br>
<a class="moz-txt-link-freetext"
href="https://github.com/systemd/systemd/pull/6876">https://github.com/systemd/systemd/pull/6876</a><br>
<br>
The keyctl syscalls are not setup to handle namespaces which is a
requirement of unprivileged containers. I eventually figured out
the right seccomp syntax to disable keyctl syscalls:<br>
</p>
<pre><code class="hljs apache"><span class="hljs-attribute">2</span>
<span class="hljs-attribute">blacklist</span><span class="hljs-meta"></span>
<span class="hljs-attribute">keyctl_chown</span> errno 38
<span class="hljs-attribute">keyctl</span> errno 38</code></pre>
<br>
What I don't understand is how was this not a problem before, and
why isn't this in the default lxc config files for debian. And if
this is worth reporting to the debian packaging team.<br>
<br>
I still have a problem starting the boinc service related to keyctl,
but the problem is resolved if I modify the systemd unit file to not
switch to the boinc user and remain as root instead.
</body>
</html>