Subject: bug#45069: closed (Re: bug#45066: guix environment --container is borken)

From: [email-masked] (GNU bug Tracking System)
Date: Sun, 06 Dec 2020 21:03:02 +0000

Your bug report

#45066: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
45066: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=45066
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#45066: guix environment --container is borken
From: Marius Bakke <[email-masked]>
To: zimoun <[email-masked]>, luhux <[email-masked]>, [email-masked]
Date: Sun, 06 Dec 2020 22:02:14 +0100
List-Id: <debbugs-submit.debbugs.gnu.org>

zimoun <[email-masked]> skriver:

> Hi,
>
> On Sun, 06 Dec 2020 at 16:59, luhux <[email-masked]> wrote:
>> In the new guix `guix environment --container` is borken.
>
> It is not broken.

It was broken.  :-)

> Have you tried the recommendation?
>
> --8<---------------cut here---------------start------------->8---
> $ su -
> Password: 
> # echo 1 > /proc/sys/kernel/unprivileged_userns_clone 
> # logout
>
> $ guix environment -C --ad-hoc hello -- hello 
> Hello, world!
> --8<---------------cut here---------------end--------------->8---

...because this only works on the Debian kernel.

We need to find a more robust test for user namespaces, but for now I
reverted the commit.

Closing!  Thanks for the report luhux.  :-)

Subject: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces
From: yasu <[email-masked]>
To: [email-masked], [email-masked], Pjotr Prins <[email-masked]>, zimoun <[email-masked]>
Cc: Guix Devel <[email-masked]>
Date: Sun, 06 Dec 2020 21:41:00 +0900
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi,

I really don't know much about Linux but it looks like the problem I
reported has something to do with Debian?

https://unix.stackexchange.com/questions/303213/how-to-enable-user-namespaces-in-the-kernel-for-unprivileged-unshare

Now, I don't use Debian at all (I use Guix System) and do you think
this is a Bug in Guix (in that this Debian specific word should never
even be mentioned in Guix?)

To summarize this bug again:

The Bug:
The container command no longer works,  after the commit
8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
guix environment -C

Additional Information:
	Instead of working as it did until the commit, the command now
dies with the following error mesage:
		guix environment: error: cannot create container:
unprivileged user cannot create user namespaces
		guix environment: error: please set
/proc/sys/kernel/unprivileged_userns_clone to "1"

	The message "please set
/proc/sys/kernel/unprivileged_userns_clone to "1",
	seems irrelevant to Guix System users as it may only relate to
Debian users.
	I don't know why this Debian specific message is here in the
first place...	

Disclaimer :-):
	I am assuming this is indeed Debian specific (I tried to
install LinuxLinux (the Guix default) but failed - my AMD graphics card
won't allow me to even boot, unless I use regular Linux.	)

	I scanned for the phrase in LinuxLibre source code but there
was no mention of it:
~/Downloads$ tar -xf linux-libre-5.9.12-gnu.tar.xz
~/Downloads$ cd linux-5.9.12/
~/Downloads/linux-5.9.12$ rg -i unprivileged_userns_clone

	Just FYI: the problem phrase is indeed found in the Debian
Kernel Patch:
~/co/debian$ rg -i unprivileged_userns_clone

	linux/debian/patches/debian/add-sysctl-to-disallow-
unprivileged-CLONE_NEWUSER-by-default.patch
	25:+extern int unprivileged_userns_clone;
	27:+#define unprivileged_userns_clone 0
	36:+    if ((clone_flags & CLONE_NEWUSER) &&
!unprivileged_userns_clone)
	47:+    if ((unshare_flags & CLONE_NEWUSER) &&
!unprivileged_userns_clone) {
	65:+extern int unprivileged_userns_clone;
	77:+            .procname       = "unprivileged_userns_clone",
	78:+            .data           = &unprivileged_userns_clone,
	96:+int unprivileged_userns_clone;

Cheers,
Yasu

commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33eAuthor: Paul Garlick <
[email-masked]>Date:   Thu Dec 3 16:00:18 2020
+0000
    linux-container: Correct test for unprivileged user namespace
support.
    Fixes <https://bugs.gnu.org/31977>;.    Reported by Paul Garlick
<[email-masked]>.
    * gnu/build/linux-container.scm (unprivileged-user-namespace-
supported?):    Return #f when the 'userns-file' does not exist.
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-
container.scmindex 4a8bed5a9a..3870b50907 100644--- a/gnu/build/linux-
container.scm+++ b/gnu/build/linux-container.scm@@ -44,7 +44,7
@@   (let ((userns-file
"/proc/sys/kernel/unprivileged_userns_clone"))     (if (file-exists?
userns-file)         (eqv? #\1 (call-with-input-file userns-file read-
char))-        #t)))+        #f)))

On Sat, 2020-12-05 at 09:20 +0900, yasu wrote:
> Hi Pj,
> Thank you for you reply (and your wonderful Hacking Guide 
> https://gitlab.com/pjotrp/guix-notes/blob/master/HACKING.org)!
> I tried the command and it didn't work...
> I use Guix System (not  a foreign distribution) as described at the
> bottom 
> -Yasu
> 
> On Fri, 2020-12-04 at 19:55 +0100, Pjotr Prins wrote:
> > On Fri, Dec 04, 2020 at 05:32:08PM +0100, zimoun wrote:
> > > Have you tried to do the recommandation?
> > > 
> > >      please set /proc/sys/kernel/unprivileged_userns_clone to "1"
> > 
> > As root:
> > 
> > echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> > 
> > Yes, it is common on Debian and such.
> > 
> > Pj.
> 
> root@guix ~# echo 1 > /proc/sys/kernel/unprivileged_userns_clone-
> bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or
> directory
> root@guix ~# guix system describeGeneration 5631	Dec 05 2020
> 09:09:16	(current)  file name: /var/guix/profiles/system-5631-
> link  canonical file name:
> /gnu/store/qqzk4kvrhxjcia3hcq3xqrcdi36azzz9-system  label: GNU with
> Linux 5.9.12  bootloader: grub-efi  root device: label: "my-root" 
> kernel: /gnu/store/9a93vpq4aa1c3adiaaa3blwc18r9r7zz-linux-
> 5.9.12/bzImage  channels:    guix:      repository URL: 
> https://git.savannah.gnu.org/git/guix.git      branch:
> master      commit:
> 86d635b85035086d21c319f31f628761df5c82e5    nonguix:      repository
> URL: https://gitlab.com/nonguix/nonguix      branch:
> master      commit: b08ea529d4d36468b20ef4aff6dc87b3de0eff70    guix-
> chromium:      repository URL: 
> https://gitlab.com/mbakke/guix-chromium.git      branch:
> master      commit: 2de450b92e5f2624d4f964407686934e22239f7b 
> configuration file: /gnu/store/hlma107m2004g6qq00ihm190am5mh9z0-
> configuration.scm