[lxc-devel] problem with user namespace as root

[Michael H. Warfield]

On Fri, 2014-02-14 at 09:55 -0600, Serge Hallyn wrote:
> Quoting Michael H. Warfield (mhw at WittsEnd.com):
> > On Fri, 2014-02-14 at 11:49 +0100, Stephan Sachse wrote:
> > > > You didn't say if you had applied my experimental patch or not.  I'm
> > > > guessing not but I can't be sure.
> > 
> > > no, this was only the complete log of my "i lost my brain" mail.
> > 
> > K
> > 
> > > > 2) Find the lxc-devsetup script (in lxc/config/init/systemd/lxc-devsetup
> > > > in the source tree) and run that as root to see if we have better luck
> > > > under devtmpfs.
> > 
> > > output attached
> > 
> > Ok...
> > 
> > lxc-start 1392374433.579 DEBUG    lxc_conf - Bind
> > mounting /dev/.lxc/user/fedora1.533098688727054a
> > to /usr/lib64/lxc/rootfs/dev
> > 
> > That looks good...
> > 
> > lxc-start 1392374433.579 INFO     lxc_conf - Mounted /dev
> > under /usr/lib64/lxc/rootfs
> > lxc-start 1392374433.579 INFO     lxc_conf - Creating initial consoles
> > under /usr/lib64/lxc/rootfs/dev
> > lxc-start 1392374433.579 INFO     lxc_conf - Populating /dev
> > under /usr/lib64/lxc/rootfs
> > lxc-start 1392374433.579 ERROR    lxc_conf - Operation not permitted -
> > Error creating null
> > 
> > That looks bad.  Rats.  That's not going to work for the reason I
> > suspected to begin with.  We're back to square one and need to get the
> > operations of mounting devpts on top of tmpfs working.
> 
> But it does work.

I can't get it to work.  This is obviously part of my coming up to speed
with user namespaces, I guess...

On Fedora 20...

[mhw at hyperion tmp]$ uname -a
Linux hyperion.wittsend.com 3.12.8-300.fc20.x86_64 #1 SMP Thu Jan 16
01:07:50 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
[mhw at hyperion tmp]$ mkdir mnt
[mhw at hyperion tmp]$ cat /etc/subuid 
mhw:1000:1000
[mhw at hyperion tmp]$  lxc-usernsexec -m b:0:1000:1 -- chown 0 mnt
unshare: Invalid argument
read pipe: No such file or directory
[mhw at hyperion tmp]$ ls -lad mnt
drwxrwxr-x 2 mhw mhw 40 Feb 14 13:44 mnt

Obviously, I don't have something set up right on that host and I don't
know what I'm missing.  He's on CentOS on a "handcrafted rpm".  A lot of
variables in play here...

Regards
Mike

> serge at sergelap:~$ cd /tmp
> serge at sergelap:/tmp$ mkdir mnt
> serge at sergelap:/tmp$ grep serge /etc/subuid
> serge:100000:100000
> serge at sergelap:/tmp$ lxc-usernsexec -m b:0:100000:1 -m b:1:1000:1 -- chown 0 mnt
> serge at sergelap:/tmp$ ls -ld mnt
> drwxrwxr-x 2 100000 serge 4096 Feb 14 09:45 mnt
> serge at sergelap:/tmp$ lxc-usernsexec /bin/bash
> root at sergelap:/tmp# mount -t tmpfs tmpfs mnt
> root at sergelap:/tmp# cd mnt
> root at sergelap:/tmp/mnt# ls
> root at sergelap:/tmp/mnt# mkdir tmp
> root at sergelap:/tmp/mnt# mkdir devpts
> root at sergelap:/tmp/mnt# mount -t devpts -o newinstance devpts devpts
> root at sergelap:/tmp/mnt# ls devpts/
> ptmx
> 
> And actually it's 'creating null' that failed.  Don't know why.
> 
> Stephan, do you have a github account?  Would it be possible for you to
> put up a branch containing your changes?
> 
> Now actually, the error message is
> 
> 	"Error creating null"
> 
> but in YOUR code you are doing
> 
> 	SYSERROR("error creating %s\n", path)
> 
> So you're actually going through the !in_userns() case in your new
> setup_autodev().
> 
> -serge
> _______________________________________________
> lxc-devel mailing list
> lxc-devel at lists.linuxcontainers.org
> http://lists.linuxcontainers.org/listinfo/lxc-devel
> 

-- 
Michael H. Warfield (AI4NB) | (770) 978-7061 |  mhw at WittsEnd.com
   /\/\|=mhw=|\/\/          | (678) 463-0932 |  http://www.wittsend.com/mhw/
   NIC whois: MHW9          | An optimist believes we live in the best of all
 PGP Key: 0x674627FF        | possible worlds.  A pessimist is sure of it!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 465 bytes
Desc: This is a digitally signed message part
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20140214/2a1eda1f/attachment.pgp>