GNU bug report logs -
#45066
guix environment --container is borken
Previous Next
Reported by: luhux <luhux <at> outlook.com>
Date: Sun, 6 Dec 2020 09:15:01 UTC
Severity: normal
Merged with 45069
Done: Marius Bakke <marius <at> gnu.org>
Bug is archived. No further changes may be made.
Full log
View this message in rfc822 format
[Message part 1 (text/plain, inline)]
Your bug report
#45066: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces
which was filed against the guix package, has been closed.
The explanation is attached below, along with your original report.
If you require more details, please reply to 45069 <at> debbugs.gnu.org.
--
45066: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=45066
GNU Bug Tracking System
Contact help-debbugs <at> gnu.org with problems
[Message part 2 (message/rfc822, inline)]
[Message part 3 (text/plain, inline)]
zimoun <zimon.toutoune <at> gmail.com> skriver:
> Hi,
>
> On Sun, 06 Dec 2020 at 16:59, luhux <luhux <at> outlook.com> wrote:
>> In the new guix `guix environment --container` is borken.
>
> It is not broken.
It was broken. :-)
> Have you tried the recommendation?
>
> --8<---------------cut here---------------start------------->8---
> $ su -
> Password:
> # echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> # logout
>
> $ guix environment -C --ad-hoc hello -- hello
> Hello, world!
> --8<---------------cut here---------------end--------------->8---
...because this only works on the Debian kernel.
We need to find a more robust test for user namespaces, but for now I
reverted the commit.
Closing! Thanks for the report luhux. :-)
[signature.asc (application/pgp-signature, inline)]
[Message part 5 (message/rfc822, inline)]
[Message part 6 (text/plain, inline)]
Hi,
I really don't know much about Linux but it looks like the problem I
reported has something to do with Debian?
https://unix.stackexchange.com/questions/303213/how-to-enable-user-namespaces-in-the-kernel-for-unprivileged-unshare
Now, I don't use Debian at all (I use Guix System) and do you think
this is a Bug in Guix (in that this Debian specific word should never
even be mentioned in Guix?)
To summarize this bug again:
The Bug:
The container command no longer works, after the commit
8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
guix environment -C
Additional Information:
Instead of working as it did until the commit, the command now
dies with the following error mesage:
guix environment: error: cannot create container:
unprivileged user cannot create user namespaces
guix environment: error: please set
/proc/sys/kernel/unprivileged_userns_clone to "1"
The message "please set
/proc/sys/kernel/unprivileged_userns_clone to "1",
seems irrelevant to Guix System users as it may only relate to
Debian users.
I don't know why this Debian specific message is here in the
first place...
Disclaimer :-):
I am assuming this is indeed Debian specific (I tried to
install LinuxLinux (the Guix default) but failed - my AMD graphics card
won't allow me to even boot, unless I use regular Linux. )
I scanned for the phrase in LinuxLibre source code but there
was no mention of it:
~/Downloads$ tar -xf linux-libre-5.9.12-gnu.tar.xz
~/Downloads$ cd linux-5.9.12/
~/Downloads/linux-5.9.12$ rg -i unprivileged_userns_clone
Just FYI: the problem phrase is indeed found in the Debian
Kernel Patch:
~/co/debian$ rg -i unprivileged_userns_clone
linux/debian/patches/debian/add-sysctl-to-disallow-
unprivileged-CLONE_NEWUSER-by-default.patch
25:+extern int unprivileged_userns_clone;
27:+#define unprivileged_userns_clone 0
36:+ if ((clone_flags & CLONE_NEWUSER) &&
!unprivileged_userns_clone)
47:+ if ((unshare_flags & CLONE_NEWUSER) &&
!unprivileged_userns_clone) {
65:+extern int unprivileged_userns_clone;
77:+ .procname = "unprivileged_userns_clone",
78:+ .data = &unprivileged_userns_clone,
96:+int unprivileged_userns_clone;
Cheers,
Yasu
commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33eAuthor: Paul Garlick <
pgarlick <at> tourbillion-technology.com>Date: Thu Dec 3 16:00:18 2020
+0000
linux-container: Correct test for unprivileged user namespace
support.
Fixes <https://bugs.gnu.org/31977>;. Reported by Paul Garlick
<pgarlick <at> tourbillion-technology.com>.
* gnu/build/linux-container.scm (unprivileged-user-namespace-
supported?): Return #f when the 'userns-file' does not exist.
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-
container.scmindex 4a8bed5a9a..3870b50907 100644--- a/gnu/build/linux-
container.scm+++ b/gnu/build/linux-container.scm@@ -44,7 +44,7
@@ (let ((userns-file
"/proc/sys/kernel/unprivileged_userns_clone")) (if (file-exists?
userns-file) (eqv? #\1 (call-with-input-file userns-file read-
char))- #t)))+ #f)))
On Sat, 2020-12-05 at 09:20 +0900, yasu wrote:
> Hi Pj,
> Thank you for you reply (and your wonderful Hacking Guide
> https://gitlab.com/pjotrp/guix-notes/blob/master/HACKING.org)!
> I tried the command and it didn't work...
> I use Guix System (not a foreign distribution) as described at the
> bottom
> -Yasu
>
> On Fri, 2020-12-04 at 19:55 +0100, Pjotr Prins wrote:
> > On Fri, Dec 04, 2020 at 05:32:08PM +0100, zimoun wrote:
> > > Have you tried to do the recommandation?
> > >
> > > please set /proc/sys/kernel/unprivileged_userns_clone to "1"
> >
> > As root:
> >
> > echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> >
> > Yes, it is common on Debian and such.
> >
> > Pj.
>
> root <at> guix ~# echo 1 > /proc/sys/kernel/unprivileged_userns_clone-
> bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or
> directory
> root <at> guix ~# guix system describeGeneration 5631 Dec 05 2020
> 09:09:16 (current) file name: /var/guix/profiles/system-5631-
> link canonical file name:
> /gnu/store/qqzk4kvrhxjcia3hcq3xqrcdi36azzz9-system label: GNU with
> Linux 5.9.12 bootloader: grub-efi root device: label: "my-root"
> kernel: /gnu/store/9a93vpq4aa1c3adiaaa3blwc18r9r7zz-linux-
> 5.9.12/bzImage channels: guix: repository URL:
> https://git.savannah.gnu.org/git/guix.git branch:
> master commit:
> 86d635b85035086d21c319f31f628761df5c82e5 nonguix: repository
> URL: https://gitlab.com/nonguix/nonguix branch:
> master commit: b08ea529d4d36468b20ef4aff6dc87b3de0eff70 guix-
> chromium: repository URL:
> https://gitlab.com/mbakke/guix-chromium.git branch:
> master commit: 2de450b92e5f2624d4f964407686934e22239f7b
> configuration file: /gnu/store/hlma107m2004g6qq00ihm190am5mh9z0-
> configuration.scm
[Message part 7 (text/html, inline)]
[face-smile.png (image/png, inline)]
This bug report was last modified 4 years and 133 days ago.
Previous Next
GNU bug tracking system
Copyright (C) 1999 Darren O. Benham,
1997,2003 nCipher Corporation Ltd,
1994-97 Ian Jackson.