[SOLVED] Unprivileged Linux containers in Slackware 15.0

grokkingnix · 02-07-2022, 12:22 AM

First of all thank you to the entire Slackware team and community for the latest stable release!

I am trying to setup unprivileged containers but have hit a bit of a roadblock, I'd appreciate any advice.

I have read Chris' excellent guide and have a problem compiling uidmapshift from Step 2 - Remap uids & gids in the second part of the guide.

My environment is a fresh full install of Slackware 15.0:

Code:

root@slack15:~# uname -r
5.15.19

root@slack15:~# slackpkg search lxc

Looking for lxc in package list. Please wait... DONE

The list below shows all packages with name matching "lxc".

[ installed ] - lxc-4.0.11-x86_64-3

You can search specific files using "slackpkg file-search file".

The errors I get seem to be related to syntax, so I'm not sure if I'm missing anything obvious due to my lack of experience with using gcc. Below is part of the output of the suggested command in the guide:

Code:

root@slack15:~# gcc -o uidmapshift uidmapshift.c
uidmapshift.c:1:1: error: expected identifier or ‘(’ before ‘<’ token
    1 | <?xml version="1.0"?>
      | ^
uidmapshift.c:11:19: warning: character constant too long for its type
   11 | var global_path = '/~serge-hallyn/+junk/nsexec/';
      |                   ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
uidmapshift.c:12:1: error: unknown type name ‘var’
   12 | var collapsed_icon_path = '/static/images/treeCollapsed.png';
      | ^~~
uidmapshift.c:12:27: warning: character constant too long for its type
   12 | var collapsed_icon_path = '/static/images/treeCollapsed.png';
      |                           ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
uidmapshift.c:13:1: error: unknown type name ‘var’
   13 | var expanded_icon_path = '/static/images/treeExpanded.png';
      | ^~~
uidmapshift.c:13:26: warning: character constant too long for its type
   13 | var expanded_icon_path = '/static/images/treeExpanded.png';
      |                          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
uidmapshift.c:14:1: error: expected identifier or ‘(’ before ‘<’ token
   14 | </script>
      | ^
uidmapshift.c:28:1: error: stray ‘\342’ in program
   28 | ← Back to branch summary
      | ^

There is mention in Chris' guide of an alternate way of running unprivileged containers.

Quote:

There are now two distinct methods we can use to create an unprivileged container, the classic and the modern.

However the modern method does not seem to be mentioned after that.

I imagine it's by directly creating them via a default.conf file that has entries like what is described in Stéphane Graber's
guide:

Code:

lxc.network.type = veth
lxc.network.link = lxcbr0
lxc.network.flags = up
lxc.network.hwaddr = 00:16:3e:xx:xx:xx
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536

But when trying that approach with my non-privileged user I get the following error:

Code:

lxcuser@slack15:~$ release=15.0 MIRROR=http://mirrors.us.kernel.org/slackware lxc-create -n c1 -t slackware -f ~/.config/lxc/default.conf
getopt: unrecognized option '--mapped-uid'
getopt: unrecognized option '--mapped-gid'
lxc-slackware -h|--help -p|--path=<path> --clean
lxc-create: c1: lxccontainer.c: create_run_template: 1618 Failed to create container from template
lxc-create: c1: tools/lxc_create.c: main: 317 Failed to create container c1

These are the contents of the ~/.config/lxc/default.conf file:

Code:

lxcuser@slack15:~$ cat ~/.config/lxc/default.conf
lxc.net.0.type = veth
lxc.net.0.flags = up
lxc.net.0.link = lxcbr0
lxc.net.0.hwaddr = 00:16:3e:xx:xx:xx
lxc.idmap = u 0 100000 65536
lxc.idmap = g 0 100000 65536

This seems to suggest that the lxc-slackware script in /usr/share/lxc/templates can't handle these additional options for unprivileged containers.

I was not able to find anything related to this specific issue in these threads: 1 2 3

I'd appreciate any input, thank you.

Chuck56 · 02-07-2022, 06:37 AM

Did you update both the host's /etc/subuid & /etc/subgid config files with the appropriate values?

Example:

Code:

root:100000:65536

Also, just in case, are both the host's /etc/rc.d/rc.cgconfig & /etc/rc.d/rc.cgred executable?

Hope that helps.

slackerDude · 02-07-2022, 10:55 AM

I think you used this URL: http://bazaar.launchpad.net/~serge-h.../uidmapshift.c

and did "page source" on it? That gives you a javascript / html version of the webpage. I was able to match up your error lines 1-1 by doing that.

You need to DOWNLOAD the uishiftmap.c file, not look at the html source of a page that lets you view it.

grokkingnix · 02-08-2022, 04:41 AM

Thank you for the replies @Chuck56 and @slackerDude.

As you suggested the issue was with how I was downloading the file, silly mistake on my end.

I was able to successfully create unprivileged containers in Slackware 15!

I created a write up about the required steps over at my blog and a script to automate the process.

I hope they help others trying to use unprivileged containers on Slackware.

Thanks again for the help!

franzen · 02-08-2022, 05:35 AM

Quote:

Originally Posted by slackerDude

You need to DOWNLOAD the uishiftmap.c file, not look at the html source of a page that lets you view it.

To shift UIDs, there's also "lxc-usernsexec" coming already installed with lxc.
man lxc-usernsexec:

Quote:

...
If your user id is 1000, root in a container is mapped to 190000, and
you wish to chown a file you own to root in the container, you can use:

lxc-usernsexec -m b:0:1000:1 -m b:1:190000:1 -- /bin/chown 1:1 $file

This maps your userid to root in the user namespace, and 190000 to uid 1.
Since root in the user namespace is privileged over all userids
mapped into the namespace, you are allowed to change the file owner‐
ship, which you could not do on the host using a simple chown.

...

grokkingnix · 02-10-2022, 12:53 PM

Thank you for the input @franzen.

Quote:

To shift UIDs, there's also "lxc-usernsexec" coming already installed with lxc.

This definitely looks like something worth looking into. I wonder if this could be used instead of uidmapshift as a more "native" solution.

I'll look into this a bit more when I have additional time (might be a while) and report back.

zeebra · 02-10-2022, 04:30 PM

Howdy,

I'd like to put this information in https://docs.slackware.com/ as soon as I have time for that.

Would it be possible for someone here to write down(/sum up) raw minimal reproducible steps in a single post in this thread so I can use that as a basis? (to be reproduced on a clean Slackware 15.0 install on a machine without internet)