|
From: | yasu |
Subject: | bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces |
Date: | Sun, 06 Dec 2020 21:41:00 +0900 |
User-agent: | Evolution 3.34.2 |
Hi, I really don't know much about Linux but it looks like the problem I reported has something to do with Debian? Now, I don't use Debian at all (I use Guix System) and do you think this is a Bug in Guix (in that this Debian specific word should never even be mentioned in Guix?) To summarize this bug again: The Bug: The container command no longer works, after the commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e. guix environment -C Additional Information: Instead of working as it did until the commit, the command now dies with the following error mesage: guix environment: error: cannot create container: unprivileged user cannot create user namespaces guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1" The message "please set /proc/sys/kernel/unprivileged_userns_clone to "1", seems irrelevant to Guix System users as it may only relate to Debian users. I don't know why this Debian specific message is here in the first place... Disclaimer : I am assuming this is indeed Debian specific (I tried to install LinuxLinux (the Guix default) but failed - my AMD graphics card won't allow me to even boot, unless I use regular Linux. ) I scanned for the phrase in LinuxLibre source code but there was no mention of it: ~/Downloads$ tar -xf linux-libre-5.9.12-gnu.tar.xz ~/Downloads$ cd linux-5.9.12/ ~/Downloads/linux-5.9.12$ rg -i unprivileged_userns_clone Just FYI: the problem phrase is indeed found in the Debian Kernel Patch: ~/co/debian$ rg -i unprivileged_userns_clone linux/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch 25:+extern int unprivileged_userns_clone; 27:+#define unprivileged_userns_clone 0 36:+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) 47:+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { 65:+extern int unprivileged_userns_clone; 77:+ .procname = "unprivileged_userns_clone", 78:+ .data = &unprivileged_userns_clone, 96:+int unprivileged_userns_clone; Cheers, Yasu commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e Author: Paul Garlick <pgarlick@tourbillion-technology.com> Date: Thu Dec 3 16:00:18 2020 +0000 linux-container: Correct test for unprivileged user namespace support. Fixes <https://bugs.gnu.org/31977>;. Reported by Paul Garlick <pgarlick@tourbillion-technology.com>. * gnu/build/linux-container.scm (unprivileged-user-namespace-supported?): Return #f when the 'userns-file' does not exist. diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm index 4a8bed5a9a..3870b50907 100644 --- a/gnu/build/linux-container.scm +++ b/gnu/build/linux-container.scm @@ -44,7 +44,7 @@ (let ((userns-file "/proc/sys/kernel/unprivileged_userns_clone")) (if (file-exists? userns-file) (eqv? #\1 (call-with-input-file userns-file read-char)) - #t))) + #f))) On Sat, 2020-12-05 at 09:20 +0900, yasu wrote:
|
[Prev in Thread] | Current Thread | [Next in Thread] |