Hi mancha,
I already sent the request to Pat earlier today - before you brought up the CVE - but I gave him a link to this discussion so hopefully he will see it. Hi ml4711, The CONFIG_MEMCG & CONFIG_MEMCG_KMEM options are already turned on in the 3.4.15 kernel in -current. In the stock 3.10.17 kernels of 14.1, CONFIG_MEMCG is not set and CONFIG_MEMCG_KMEM doesn't seem to exist. In fact I don't see CONFIG_USER_NS in 3.10.17 either. I guess it must have been introduced some time later in the 3.10 series, since mancha has mentioned that a related vulnerability was fixed by 3.10.44. chris |
Quote:
|
Latest -current has all the required stuff in it now. From the ChangeLog:
a/shadow-4.2.1-x86_64-1.txz: Upgraded. This adds support for subuid and subgid needed for unprivileged containers. ap/cgmanager-20140710_986cd44-x86_64-1.txz: Added. ap/lxc-1.0.3-x86_64-1.txz: Upgraded. This adds a template for for lxc-create to create a minimal Slackware container using slackpkg. k/kernel-source-3.14.12-noarch-1.txz: Upgraded. Added back CONFIG_USER_NS=y now that it no longer conflicts with XFS. l/libnih-1.0.3-x86_64-1.txz: Added. The MEMCG and MEMCG_KMEM options were already set in the -current kernel. Thanks to Matteo for the cgmanager & libnih packages which have been included (also for slackpkg based template included with lxc-1.0.3 update - although 1.0.4 has been available for about a month now, see: https://linuxcontainers.org/news/ for changes). Thanks Pat for considering & including the new & updated packages. chris |
Quote:
|
Thanks for the tip off about lxc-1.0.5 Matteo. I was trying to reproduce the unprivileged container stuff that had worked previously using the latest -current. I spent all day yesterday on it but couldn't make it work. It turns out that the -current kernel version went from 3.14.5 (which I was previously using with a patch to enable user namespace) to 3.14.12 which had some other updates which prevented lxc-1.0.{3,4} from working correctly for unprivileged containers. The fixes went into 1.0.5 which I downloaded & built when you mentioned it was available.
So, its all working again now but definitely needs lxc-1.0.5 for the unprivileged containers to work. BTW, one thing I noticed in unprivileged mode is that starting klogd (from rc.syslog) makes the container appear to hang at startup (it actually starts again after a minute or so but I've given up by then). The solution is to change the rc.syslog in the container so that it does: /usr/sbin/klogd -c 3 -x -s (instead of /usr/sbin/klogd -c 3 -x) Also, a minor suggestion for the template; could you add something like PATH=/sbin:/usr/sbin:$PATH near the beginning please? I tend to run as normal user and invoke with sudo e.g. sudo lxc-create -n current -t slackware but since /sbin isn't in my PATH, calling installpkg in the template fails. Then I have to do sudo PATH=/sbin:/usr/sbin:$PATH lxc-create -n current -t slackware to make it work. chris |
One other thing Matteo, with regard to your cgmanager package that Pat has accepted, it would be really useful if it would include an rc.cgmanager script to start the cgmanager daemon at boot time. I made my own very simple one - in the start function it just does:
/usr/sbin/cgmanager --daemonand in the stop function: /usr/bin/pkill cgmanagerI call mine from rc.local but eventually it may be better to start it from rc.M, or even rc.S where the cgroup initialisation is done. chris |
thanks Chris for the hints!
Quote:
Quote:
here is the modified build script Quote:
Code:
#!/bin/sh Code:
--- rc.S.orig 2014-07-15 15:13:16.383429282 +0200 I'll have a look in packaging Serge's nsexec stuff (for uidmapshift), as I haven't tested userns yet... I've read your related posts in the lxc-users ML, so I'll hope they can help me to try them :) |
ponce, restart should be quoted i think
|
All those changes work great, thanks Matteo.
I see Pat has already update to lxc-1.0.5 in today's updates - it would have been good to include the updated template at the same time. Oh well .. Some more on the template though - we don't need an explicit lxc.rootfs = $rootfs (from the .in file) because lxc-create now adds it to the final config file already. Similarly, if you add the line: lxc.mount.auto = proc sys cgroupto the /etc/lxc/default.conf file, then lxc-create adds those systems to the container config file so that they don't need to be set in the container fstab. Therefore I was able to remove the lines none $rootfs/proc proc 0 0from the template. After lxc-create, the container config file has automatically added lxc.mount.auto proc:mixed sys:ro cgroupand those virtual file systems exist and work as normal in the running container. I'm not sure what the lxcpts $rootfs/dev/pts devpts 0 0 (also in the container fstab) will do. I removed it to test and everything still seems normal without it. The uidmapshift is at http://bazaar.launchpad.net/~serge-h...k/nsexec/files. Maybe all the stuff there is useful to perhaps make some sort of lxc-tools package but I've used only the container-userns-convert script and uidmapshift.c which compiled locally without any of the other .c files there. chris |
Hey Matteo,
I had better idea about how to arrange proc, sys, cgroup mounts in the container template. Rather than adding "lxc.mount.auto = proc sys cgroup" into /etc/lxc/default.conf (from which lxc-create would add "lxc.mount.auto = proc:mixed sys:ro cgroup" into the container config file), you could add the line "lxc.mount.auto = proc:mixed sys:ro cgroup" into the template (in the copy_configuration() function just before "lxc.mount = $rootfs/etc/fstab") and remove the lines "none $rootfs/proc proc defaults 0 0" and "none $rootfs/sys sysfs defaults 0 0" (where the container fstab is set up). I just tried that this morning and it works fine for both ordinary and unprivileged containers. Here's a diff against the the lxc-slackware.in from your earlier update Code:
diff -urN lxc-slackware.in.orig lxc-slackware.in BTW I've started on a howto at http://www.darlo.tv/lxc/unpriv-slackware.html. I thought I'd do it in two parts - 1st one there now about setting up; then a part 2 about creating ordinary container and converting to unprivileged. chris |
All times are GMT -5. The time now is 04:16 PM. |