[lxc-devel] problem with user namespace as root

[Serge Hallyn]

Quoting Michael H. Warfield (mhw at WittsEnd.com):
> On Fri, 2014-02-14 at 09:55 -0600, Serge Hallyn wrote:
> > Quoting Michael H. Warfield (mhw at WittsEnd.com):
> > > On Fri, 2014-02-14 at 11:49 +0100, Stephan Sachse wrote:
> > > > > You didn't say if you had applied my experimental patch or not.  I'm
> > > > > guessing not but I can't be sure.
> > > 
> > > > no, this was only the complete log of my "i lost my brain" mail.
> > > 
> > > K
> > > 
> > > > > 2) Find the lxc-devsetup script (in lxc/config/init/systemd/lxc-devsetup
> > > > > in the source tree) and run that as root to see if we have better luck
> > > > > under devtmpfs.
> > > 
> > > > output attached
> > > 
> > > Ok...
> > > 
> > > lxc-start 1392374433.579 DEBUG    lxc_conf - Bind
> > > mounting /dev/.lxc/user/fedora1.533098688727054a
> > > to /usr/lib64/lxc/rootfs/dev
> > > 
> > > That looks good...
> > > 
> > > lxc-start 1392374433.579 INFO     lxc_conf - Mounted /dev
> > > under /usr/lib64/lxc/rootfs
> > > lxc-start 1392374433.579 INFO     lxc_conf - Creating initial consoles
> > > under /usr/lib64/lxc/rootfs/dev
> > > lxc-start 1392374433.579 INFO     lxc_conf - Populating /dev
> > > under /usr/lib64/lxc/rootfs
> > > lxc-start 1392374433.579 ERROR    lxc_conf - Operation not permitted -
> > > Error creating null
> > > 
> > > That looks bad.  Rats.  That's not going to work for the reason I
> > > suspected to begin with.  We're back to square one and need to get the
> > > operations of mounting devpts on top of tmpfs working.
> > 
> > But it does work.
> 
> I can't get it to work.  This is obviously part of my coming up to speed
> with user namespaces, I guess...
> 
> On Fedora 20...
> 
> [mhw at hyperion tmp]$ uname -a
> Linux hyperion.wittsend.com 3.12.8-300.fc20.x86_64 #1 SMP Thu Jan 16
> 01:07:50 UTC 2014 x86_64 x86_64 x86_64 GNU/Linux
> [mhw at hyperion tmp]$ mkdir mnt
> [mhw at hyperion tmp]$ cat /etc/subuid 
> mhw:1000:1000

This should be a much higher number - i.e.

mhw:100000:1000

Otherwise you are saying that mhw is allowed to own uids 1000,
1001, 1002, etc.

> [mhw at hyperion tmp]$  lxc-usernsexec -m b:0:1000:1 -- chown 0 mnt
> unshare: Invalid argument

Looks like your kernel wasn't compiled with CONFIG_USER_NS=y

-serge