<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">I am still faced with the situation where
if I run sh inside my container then any command I try to execute such as /bin/ls returns permission denied.</span><br>
</div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Any clue as to what I need to adjust to enable
me to get inside my container as to inspect and try stuff out?</span></div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">--</span></div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">Yannick Koehler</span></div>
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);"><br>
</span></div>
<div id="appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;" data-ogsc=""><b>From:</b> lxc-users <lxc-users-bounces@lists.linuxcontainers.org> on behalf of Saint Michael <venefax@gmail.com><br>
<b>Sent:</b> June 15, 2020 8:58 AM<br>
<b>To:</b> LXC users mailing-list <lxc-users@lists.linuxcontainers.org><br>
<b>Subject:</b> Re: [lxc-users] Running unprotected system container</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="x_gmail_default" style="font-size:small">I have the same issue with plain LXC. Can somebody please post a container config that would have the same rights as the host?</div>
<div class="x_gmail_default" style="font-size:small">I actually move around my app in a container, the host is immaterial. It used to work fine until I upgraded Ubuntu to 20.04, since then I get permission denied on a fifo located in /tmp.</div>
<div class="x_gmail_default" style="font-size:small">I need to load kernel modules, etc. It has to be on equal footing with the host</div>
<div class="x_gmail_default" style="font-size:small">..</div>
<div class="x_gmail_default" style="font-size:small"><br>
</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Mon, Jun 15, 2020 at 8:41 AM Koehler, Yannick <<a href="mailto:yannick.koehler@hpe.com">yannick.koehler@hpe.com</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
First, thanks for the detailed and fast response, very appreciated.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
As indicated, the code that will run inside that container is our previous OS and if it does bad things, well, that means it was doing so previously so not a "bigger" issue than it was before. Since if that works, we will move more towards snap we will then
have a better security system (AppArmor, SecComp, better app separation, etc) in place to remove trust for each app and get rid eventually of that container which purpose as indicated is to ease the transition and get some of the features we want from Ubuntu
Core in an early release, if we do get this to work.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
--</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
Yannick Koehler</div>
<div id="x_gmail-m_-4814326737003727143appendonsend"></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_-4814326737003727143divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size: 11pt;" data-ogsc=""><b>From:</b> lxc-users <<a href="mailto:lxc-users-bounces@lists.linuxcontainers.org" target="_blank">lxc-users-bounces@lists.linuxcontainers.org</a>>
on behalf of Fajar A. Nugraha <<a href="mailto:list@fajar.net" target="_blank">list@fajar.net</a>><br>
<b>Sent:</b> June 13, 2020 12:53 AM<br>
<b>To:</b> LXC users mailing-list <<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a>><br>
<b>Subject:</b> Re: [lxc-users] Running unprotected system container</font>
<div> </div>
</div>
<div><font size="2"><span style="font-size:11pt">
<div>On Sat, Jun 13, 2020 at 9:41 AM Koehler, Yannick<br>
<<a href="mailto:yannick.koehler@hpe.com" target="_blank">yannick.koehler@hpe.com</a>> wrote:<br>
><br>
> Hi,<br>
><br>
> I am in a situation where we desire to run our old OS environment inside Ubuntu Core. So far we have identified LXD as being a candidate to enable us to run our past Linux OS environment within the new one.<br>
><br>
> At this time our goal is to apply the least amount of modification to our existing OS in order to test and validate such an approach.<br>
><br>
> I, therefore, need to run an LXC container with pretty much zero security, as to allow the old OS to loads kernel modules, access /proc, /sys, etc.<br>
<br>
<br>
> Yet, when I tried to disable seccomp using lxc.seccomp.profile = none, I obtained an error as the profile 'none' was not found by the seccomp profile reader. I am wondering if this is a problem with lxc itself or with UbuntuCore not providing a definition
of what a seccomp "none" profile would be.<br>
<br>
Start from <a href="https://discuss.linuxcontainers.org/t/lxd-raw-lxc-lxc-net-i-script-up/1131/4" target="_blank">
https://urldefense.proofpoint.com/v2/url?u=https-3A__discuss.linuxcontainers.org_t_lxd-2Draw-2Dlxc-2Dlxc-2Dnet-2Di-2Dscript-2Dup_1131_4&d=DwIGaQ&c=C5b8zRQO1miGmBeVZ2LFWg&r=FOkYh2A8dNYYVi_BKN0oqYGgcvyiDQG4YX4Znrq6J3Q&m=DxXj36z9AKg0EUHoeBUL1lNES4ucPwMA592Spcehchc&s=zuqn99Y_QD8MjiGI1_Jq3wdGJKaLW0Bj4BOm_zLjWoM&e=</a>
<br>
<br>
Then create something like<br>
<br>
/var/snap/lxd/common/lxd/extra/unrestricted.conf<br>
------------------------------------------------<br>
lxc.cap.drop =<br>
lxc.apparmor.profile = unconfined<br>
lxc.mount.auto = proc:rw sys:rw cgroup-full:rw<br>
lxc.cgroup.devices.allow = c *:* rwm<br>
lxc.cgroup.devices.allow = b *:* rwm<br>
lxc.seccomp.profile = /var/snap/lxd/common/lxd/extra/unrestricted-seccomp.conf<br>
<br>
<br>
/var/snap/lxd/common/lxd/extra/unrestricted-seccomp.conf<br>
--------------------------------------------------------<br>
2<br>
blacklist<br>
# v2 allows comments after the second line, with '#' in first column,<br>
# blacklist will allow syscalls by default<br>
<br>
<br>
Then put it on your lxd config<br>
config:<br>
raw.lxc: lxc.include=/var/snap/lxd/common/lxd/extra/unrestricted.conf<br>
<br>
<br>
Totally unsupported, you're on your own if something bad happens, etc.<br>
I was able to run mknod, "losetup -a", mount, and modprobe from my<br>
container, running lxd from snap under ubuntu 20.04 host (might be<br>
relevant for you since ubuntu core also uses lxd from snap)<br>
<br>
-- <br>
Fajar<br>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a>
<br>
</div>
</span></font></div>
</div>
_______________________________________________<br>
lxc-users mailing list<br>
<a href="mailto:lxc-users@lists.linuxcontainers.org" target="_blank">lxc-users@lists.linuxcontainers.org</a><br>
<a href="http://lists.linuxcontainers.org/listinfo/lxc-users" rel="noreferrer" target="_blank">http://lists.linuxcontainers.org/listinfo/lxc-users</a><br>
</blockquote>
</div>
</div>
</body>
</html>