Subject: Re: bug#45069: Guix System: unprivileged user cannot create user namespaces?

From: zimoun <[email-masked]>
Date: Mon, 07 Dec 2020 21:03:58 +0100

Hi Vagrant,

Sorry if I am naive, I am trying to understand and it appears that
pieces are missing in my bag. :-)

On Mon, 07 Dec 2020 at 09:55, Vagrant Cascadian <[email-masked]> wrote:

> The /proc/sys/kernel_unprivileged_userns_clone file is specific to
> Debian and Ubuntu packaged linux kernel; it is a patchset not applied
> upstream, as far as I am aware. I'm not sure if other distros support
> disabling and enabling this feature using this mechanism.

Thanks.  I still do not understand the message from Guix System:

--8<---------------cut here---------------start------------->8---
~/co/guix (master)$ guix environment -C guix
guix environment: error: cannot create container: unprivileged user cannot create user namespaces
guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1"
--8<---------------cut here---------------end--------------->8---

(see
<https://yhetil.org/guix/[email-masked]>)

Why does this appear if «set /proc/sys/kernel/unprivileged_userns_clone to "1"» 
does not make sense on Guix System?

Then Tobias answered: (see <https://yhetil.org/guix/87k0tux63a.fsf@nckx>)

        yasu 写道：
        > Now, I don't use Debian at all (I use Guix System) and do you 
        > think
        > this is a Bug in Guix (in that this Debian specific word should 
        > never
        > even be mentioned in Guix?)

        It's not Debian-specific.  It is a bug in Guix.

        It should try to create a namespace and properly report an error 
        iff that fails, not prematurely abort after farting about in 
        /proc.

        A separate unprivileged-user-namespace-supported? is broken by 
        design.  Reverting commit 8bc5ca5 works around this but it wasn't 
        to blame.

so I miss why does a similar patch as,

>   https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch

is not applied to Guix System?  Is it because a technical or else reason
behind?  Or is it simply because no one takes the time to fix the
problem?

All the best,
simon