GNU bug report logs - #45069
BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

Previous Next

Full log

Message #52 received at 45069 <at> debbugs.gnu.org (full text, mbox):

From: zimoun <zimon.toutoune <at> gmail.com>
To: Vagrant Cascadian <vagrant <at> debian.org>, Ludovic Courtès
 <ludo <at> gnu.org>, Marius Bakke <marius <at> gnu.org>
Cc: Guix Devel <guix-devel <at> gnu.org>, 45069 <at> debbugs.gnu.org,
 Paul Garlick <pgarlick <at> tourbillion-technology.com>,
 Jesse Dowell <jesse.dowell <at> gmail.com>
Subject: Re: bug#45069: Guix System: unprivileged user cannot create user
 namespaces?
Date: Mon, 07 Dec 2020 21:03:58 +0100

Hi Vagrant,

Sorry if I am naive, I am trying to understand and it appears that
pieces are missing in my bag. :-)


On Mon, 07 Dec 2020 at 09:55, Vagrant Cascadian <vagrant <at> debian.org> wrote:

> The /proc/sys/kernel_unprivileged_userns_clone file is specific to
> Debian and Ubuntu packaged linux kernel; it is a patchset not applied
> upstream, as far as I am aware. I'm not sure if other distros support
> disabling and enabling this feature using this mechanism.

Thanks.  I still do not understand the message from Guix System:

--8<---------------cut here---------------start------------->8---
~/co/guix (master)$ guix environment -C guix
guix environment: error: cannot create container: unprivileged user cannot create user namespaces
guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1"
--8<---------------cut here---------------end--------------->8---

(see
<https://yhetil.org/guix/e5c86d238ca5174b745b8ea6cb0cb6ad6b20aa5e.camel <at> yasuaki.com>)

Why does this appear if «set /proc/sys/kernel/unprivileged_userns_clone to "1"» 
does not make sense on Guix System?


Then Tobias answered: (see <https://yhetil.org/guix/87k0tux63a.fsf <at> nckx>)

        yasu 写道：
        > Now, I don't use Debian at all (I use Guix System) and do you 
        > think
        > this is a Bug in Guix (in that this Debian specific word should 
        > never
        > even be mentioned in Guix?)

        It's not Debian-specific.  It is a bug in Guix.

        It should try to create a namespace and properly report an error 
        iff that fails, not prematurely abort after farting about in 
        /proc.

        A separate unprivileged-user-namespace-supported? is broken by 
        design.  Reverting commit 8bc5ca5 works around this but it wasn't 
        to blame.

so I miss why does a similar patch as,

>   https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch

is not applied to Guix System?  Is it because a technical or else reason
behind?  Or is it simply because no one takes the time to fix the
problem?



All the best,
simon

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.