GNU bug report logs - #61156
‘guix container exec’ does not actually change PID namespaces

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 61156 in the body.
You can then email your comments to 61156 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: bug-guix <at> gnu.org
Subject: ‘guix container exec’ does
 not actually change PID namespaces
Date: Sun, 29 Jan 2023 22:58:54 +0100

Currently, when a Guix program runs in separate user, mount, and PID
namespaces (for example via (guix least-authority)), ‘guix container
exec’ fails badly:

  guix container exec 10652 /gnu/store/720rj90bch716isd8z7lcwrnvz28ap4y-bash-static-5.1.8/bin/sh
  guix container: error: process terminated with signal 11

or, similarly:

  nsenter --preserve-credentials -U -m  -t 10652 -m -U -p -F /gnu/store/720rj90bch716isd8z7lcwrnvz28ap4y-bash-static-5.1.8/bin/sh
  Segmentation fault

Stracing reveals that the child process segfaults immediately after
attempting to read /proc/self/exe:

  14111 readlink("/proc/self/exe", 0x7ffccefa29c0, 4096) = -1 ENOENT (No such file or directory)
  14111 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xffffffffffffffff} ---

The segfault is due to <https://issues.guix.gnu.org/52671>.

But why isn’t /proc visible in the first place?  It *is* definitely
mounted within that process’s namespace, as confirmed here:

  $ ls -ld /proc/10652/root/proc
  dr-xr-xr-x 326 root root 0 Jan 29 21:55 /proc/10652/root/proc/

The reason is that calling setns(2) on a PID namespace “changes only the
PID namespace that subsequently created child processes of the caller
will be placed in; it does not change the PID namespace of the caller
itself.”

This is why removing ‘-F’ in the ‘nsenter’ command line above solves the
problem.

Conclusion: ’container-excursion’ should fork so that the PID namespace
change takes effect.

Ludo’.

Message #10 received at 61156-done <at> debbugs.gnu.org (full text, mbox):

From: Ludovic Courtès <ludo <at> gnu.org>
To: 61156-done <at> debbugs.gnu.org
Subject: Re: bug#61156: ‘guix container exec’ does not actually change PID namespaces
Date: Mon, 30 Jan 2023 23:51:52 +0100

Ludovic Courtès <ludo <at> gnu.org> skribis:

> The reason is that calling setns(2) on a PID namespace “changes only the
> PID namespace that subsequently created child processes of the caller
> will be placed in; it does not change the PID namespace of the caller
> itself.”

Fixed in 0ef8fe22ed8985c9656835fc25ab3463d55b6669.

Ludo’.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.