Update shadow for -current please?
 

The shadow in -current is 4.1.5.1. The most recent upstream is 4.2.1 (see: http://pkg-shadow.alioth.debian.org/). Why upgrade? Version 4.2 introduced support for subuid & subgid which are important (mandatory) for running LXC (Linux Containers) as normal user.

Is this important? Well, on my own boxes I can always sudo but in the lab that I run I don't want all users to have sudo privileges. Like, say, VirtualBox, LXC should be able to be run as a normal user. An upgraded shadow package would enable this.

chris

Odd... I've run VirtualBox as a normal user for years before switching to KVM... maybe your users just need to be in proper groups?

What I mean is that, just as you say, VirtualBox can be run as normal user. On the other hand LXC (lxc-start etc.) needs to be run as root or via sudo. A shadow package with subuid & subgid support would enable LXC to be run by normal user, just like VirtualBox.

chris

do you have a Slackware question. ?

Couldn't you upgrade it yourself?
Or does a shadow upgrade breaks a lot of packages?

Isn't his question about Slackware?

===

The OP makes a good case why the new Shadow version should be considered for the next Slackware release. Being able to use
user namespaces with LXC containers is a very important feature. Without that, LXC containment is rather unsafe: uid 0 inside
the container is uid 0 outside meaning an escape from isolation can have catastrophic consequences. It doesn't end there; To
improve the security of your LXC container you need to also be concerned with issues like resource sharing, etc.

Also, if the new Shadow is going to end up in the next Slackware, inclusion in Slackware-current is better sooner than later to
increase the probability bugs/issues/etc. are found and reported before the stable release.

Chris:

Pat visits LQ but I am not sure how regularly. You might want to also send a similar request directly to him via email. In addition
to the Shadow bump you would need to request that Pat: a) upgrade to LXC 1.0+ (as of 20140602, 1.0.3 is the latest), and
b) add user namespace support to the kernel (CONFIG_USER_NS). When doing that I recommend adding memory resource
controllers (CONFIG_MEMCG & CONFIG_MEMCG_KMEM).

--mancha

and, if you like, you can also add to the recipe the new two deps libnih/cgmanager, and also patch slackpkg accordingly (just two small patches I'm testing since some years, one to respect the $ROOT enviroment variable like installpkg does and another that let you specify a custom CONF directory) to use with it a template I've created and have a debootstrap-like tools to create containers. :)

http://ponce.cc/slackware/testing/lxc/

thanks Chris for your work with lxc ;)

That's interesting. LXC 1.0 needed PAM to run as a normal user. Did that change in the mean time?

I guess the question about PAM arose because its listed as a prerequisite at Stephane Graber's https://www.stgraber.org/2014/01/17/...ed-containers/ page. I posted a question there about it but received no reply. Anyway, after lots of testing I can say that the answer is no, PAM is not needed.

For those interested, I set up a VM with slack64-current, modified the config & rebuilt kernel and installed the latest shadow (that includes subuid & subgid support) and lxc-1.0.4, then followed the steps outlined on Stephane's web page. At first I had very limited success until I realized that lxc wasn't able to manipulate /sys/fs/cgroup entries on my behalf. It turned out that I needed the cgmanager daemon/application as well to provide that cgroup access in a neat way. After that I was able download and run Stephane's premade containers as a normal user (its quite strange watching latest Ubuntu run inside Slackware without vbox or kvm). I also made a new Slackware template that I can create and run a container from, although this was initially a bit trickier to do. As explained on Stephane's page, there is a problem with ordinary users running a creation template since it will need to do things like run mknod - thats a no go. Thats the reason Stephane is providing a bunch of premade containers. I therefore first created a "normal" container using sudo, then ran a small application called "uidmapshift" to convert the new container's uids & gids into the range allocated to the ordinary user. Then after moving the container into the ordinary user's designated space ($HOME/.local/share/lxc/), I was able to run the new container as a regular user. Success!

I'll make a web page sometime documenting it all. In the meantime, it works enough that I now feel I can approach Pat about updating the shadow package and adding CONFIG_USER_NS to the kernel config (CONFIG_MEMCG & CONFIG_MEMCG_KMEM are already enabled in the -current kernel). I'm not sure how he'll feel about adding cgmanager and dependent libnih packages to Slackware proper but I already have SlackBuilds which could be submitted to Slackbuilds.org.

chris

thanks a lot, please keep us updated about your documentation efforts. using a normal user as container root is something i really would like to try. usage of CONFIG_USER_NS was discouraged when i tinkered with lxc, maybe that changed. i had to recompile my kernel just because of this, which is annoying.

Yes, I see that Arch doesn't enable CONFIG_USER_NS yet after concerns about elevating normal user to root privileges. They were going to reconsider "later" but its still unset in the current version I just checked. I also checked the latest Debian (7.5), Ubuntu (14.04) and Fedora (20) and CONFIG_USER_NS is enabled in all of those. Not to say we should be strictly following the pack; just that CONFIG_USER_NS=yes has been out there in the wild for a while now and I haven't seen any reports of problems attributable to it.

The big thing about CONFIG_USER_NS is "user namespace" - the granting of any (including root) privilege is confined to a restricted environment (the user's name space) not system wide. Any such privilege has to be specifically granted - its not there by default (just able to be given). Of course we should be cautious about the possibility of escaping the restricted environment but, as above, its been around for a while now and so far looking pretty safe.

chris

Hi Chris.

Many thanks for your ongoing testing of the new Shadow, LXC, etc. Regarding your above comment, a flaw was recently found in user
namespaces that can be exploited under certain conditions to escalate privileges (CVE-2014-4014). This obviously is relevant within the
context of secure containment.

Fixes were introduced in: 3.10.44, 3.12.23, 3.14.8, and 3.16rc1.

--mancha

Thanks for finding that mancha - its good to have all such problems (and fixes) out in the open so that any new features can be introduced with confidence. Hopefully the next -current updates will have kernel >= 3.14.8 then, its not much of a bump.

chris

Agreed. I wanted to let you know because it seems you're preparing a set of requests for Pat to consider. This way you can let him
know about the issue and which 3.14.x introduced a fix.

Also, I wanted to let other slackers know in case they decide to use user namespaces with their LXC containers on their own kernels
(say 14.1 users sticking to 3.10.x).

--mancha

About CONFIG_USER_NS enabled per default

Since this recommendation in the kernel config,
it may be an issue in a system with several concurrent users

Hi mancha,

I already sent the request to Pat earlier today - before you brought up the CVE - but I gave him a link to this discussion so hopefully he will see it.


Hi ml4711,

The CONFIG_MEMCG & CONFIG_MEMCG_KMEM options are already turned on in the 3.4.15 kernel in -current. In the stock 3.10.17 kernels of 14.1, CONFIG_MEMCG is not set and CONFIG_MEMCG_KMEM doesn't seem to exist. In fact I don't see CONFIG_USER_NS in 3.10.17 either. I guess it must have been introduced some time later in the 3.10 series, since mancha has mentioned that a related vulnerability was fixed by 3.10.44.

chris

ok thanks

Latest -current has all the required stuff in it now. From the ChangeLog:

a/shadow-4.2.1-x86_64-1.txz: Upgraded.
This adds support for subuid and subgid needed for unprivileged containers.
ap/cgmanager-20140710_986cd44-x86_64-1.txz: Added.
ap/lxc-1.0.3-x86_64-1.txz: Upgraded.
This adds a template for for lxc-create to create a minimal Slackware container using slackpkg.
k/kernel-source-3.14.12-noarch-1.txz: Upgraded.
Added back CONFIG_USER_NS=y now that it no longer conflicts with XFS.
l/libnih-1.0.3-x86_64-1.txz: Added.

The MEMCG and MEMCG_KMEM options were already set in the -current kernel.


Thanks to Matteo for the cgmanager & libnih packages which have been included (also for slackpkg based template included with lxc-1.0.3 update - although 1.0.4 has been available for about a month now, see: https://linuxcontainers.org/news/ for changes).

Thanks Pat for considering & including the new & updated packages.

chris

1.0.5 has just been released: will test it very soon :)

Thanks for the tip off about lxc-1.0.5 Matteo. I was trying to reproduce the unprivileged container stuff that had worked previously using the latest -current. I spent all day yesterday on it but couldn't make it work. It turns out that the -current kernel version went from 3.14.5 (which I was previously using with a patch to enable user namespace) to 3.14.12 which had some other updates which prevented lxc-1.0.{3,4} from working correctly for unprivileged containers. The fixes went into 1.0.5 which I downloaded & built when you mentioned it was available.

So, its all working again now but definitely needs lxc-1.0.5 for the unprivileged containers to work.

BTW, one thing I noticed in unprivileged mode is that starting klogd (from rc.syslog) makes the container appear to hang at startup (it actually starts again after a minute or so but I've given up by then). The solution is to change the rc.syslog in the container so that it does:
/usr/sbin/klogd -c 3 -x -s
(instead of /usr/sbin/klogd -c 3 -x)

Also, a minor suggestion for the template; could you add something like PATH=/sbin:/usr/sbin:$PATH near the beginning please? I tend to run as normal user and invoke with sudo e.g.
sudo lxc-create -n current -t slackware
but since /sbin isn't in my PATH, calling installpkg in the template fails. Then I have to do
sudo PATH=/sbin:/usr/sbin:$PATH lxc-create -n current -t slackware
to make it work.

chris

One other thing Matteo, with regard to your cgmanager package that Pat has accepted, it would be really useful if it would include an rc.cgmanager script to start the cgmanager daemon at boot time. I made my own very simple one - in the start function it just does:

/usr/sbin/cgmanager --daemon

and in the stop function:

/usr/bin/pkill cgmanager

I call mine from rc.local but eventually it may be better to start it from rc.M, or even rc.S where the cgroup initialisation is done.

chris

thanks Chris for the hints!
done.

done.
here is the modified build script

I added this /etc/rc.d/rc.cgmanager file locally (modified build script)
and this block to /etc/rc.d/rc.S (trying to follow also the advices in the README)
can you please check if it's ok?

I'll have a look in packaging Serge's nsexec stuff (for uidmapshift), as I haven't tested userns yet...
I've read your related posts in the lxc-users ML, so I'll hope they can help me to try them :)

ponce, restart should be quoted i think

All those changes work great, thanks Matteo.

I see Pat has already update to lxc-1.0.5 in today's updates - it would have been good to include the updated template at the same time. Oh well ..

Some more on the template though - we don't need an explicit lxc.rootfs = $rootfs (from the .in file) because lxc-create now adds it to the final config file already.
Similarly, if you add the line:

lxc.mount.auto = proc sys cgroup

to the /etc/lxc/default.conf file, then lxc-create adds those systems to the container config file so that they don't need to be set in the container fstab. Therefore I was able to remove the lines

none $rootfs/proc proc 0 0
none $rootfs/sys sysfs 0 0

from the template. After lxc-create, the container config file has automatically added

lxc.mount.auto proc:mixed sys:ro cgroup

and those virtual file systems exist and work as normal in the running container.

I'm not sure what the lxcpts $rootfs/dev/pts devpts 0 0 (also in the container fstab) will do. I removed it to test and everything still seems normal without it.

The uidmapshift is at http://bazaar.launchpad.net/~serge-h...k/nsexec/files. Maybe all the stuff there is useful to perhaps make some sort of lxc-tools package but I've used only the container-userns-convert script and uidmapshift.c which compiled locally without any of the other .c files there.

chris

Hey Matteo,

I had better idea about how to arrange proc, sys, cgroup mounts in the container template. Rather than adding "lxc.mount.auto = proc sys cgroup" into /etc/lxc/default.conf (from which lxc-create would add "lxc.mount.auto = proc:mixed sys:ro cgroup" into the container config file), you could add the line "lxc.mount.auto = proc:mixed sys:ro cgroup" into the template (in the copy_configuration() function just before "lxc.mount = $rootfs/etc/fstab") and remove the lines "none $rootfs/proc proc defaults 0 0" and "none $rootfs/sys sysfs defaults 0 0" (where the container fstab is set up). I just tried that this morning and it works fine for both ordinary and unprivileged containers.

Here's a diff against the the lxc-slackware.in from your earlier update
The big benefit is being able to remove any path based entry in the container fstab. This is important when changing an ordinary container into an unprivileged container. In that situation, after doing the uidmapshift, you would copy the whole container named (for instance) test1 from /var/lib/lxc/test1 to ~/.local/share/lxc/test1. In the new location, you have to edit any paths in the container using its old location and naturally this is error prone so its good to minimize the number to do. Typically there are two such paths in test1/config - hopefully that would be all. However with current template there are still paths in test1/rootfs/etc/fstab which presume the old /var/lib/lxc/test1 location for mounting /proc and /sys - they can be avoided by having "lxc.mount.auto = proc:mixed sys:ro cgroup" in the template instead.

BTW I've started on a howto at http://www.darlo.tv/lxc/unpriv-slackware.html. I thought I'd do it in two parts - 1st one there now about setting up; then a part 2 about creating ordinary container and converting to unprivileged.


chris