Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Pierre Neidhardt]

This issue seems to be gone for me with kernel 5.10.x.
I guess it was a kernel bug then.

-- 
Pierre Neidhardt
https://ambrevar.xyz/


signature.asc
Description: PGP signature

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[zimoun]

Hi,

On Mon, 07 Dec 2020 at 21:35, Pierre Neidhardt  wrote:

>> Thanks, that gives us a clue.  So all or part of the path
>> '/proc/sys/kernel' is missing?
>
> Nope, my /proc/sys/kernel has 121 direct files and directories :/

Well, it is expected.  And now all is clear.  Explanations starting
there:

   

Quickly said, the initial code was assuming Debian-like kernel patches
as Vagrant reported and this is not in the linux-libre source code with
a wrong Guix error message.

One bug is still there. :-)


All the best,
simon

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Paul Garlick]

Hi Pierre,

> # echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> -bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or
> directory

Thanks, that gives us a clue.  So all or part of the path
'/proc/sys/kernel' is missing?

Best regards,

Paul.

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Pierre Neidhardt]

Hi Paul,

> Can you try, as root on Guix System:
>
> $ echo 1 > /proc/sys/kernel/unprivileged_userns_clone

# echo 1 > /proc/sys/kernel/unprivileged_userns_clone
-bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or directory

-- 
Pierre Neidhardt
https://ambrevar.xyz/


signature.asc
Description: PGP signature

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[zimoun]

Hi Pierre,

On Mon, 07 Dec 2020 at 12:57, Pierre Neidhardt  wrote:

> Guix' bug?

You get something as:

  $ guix environment -C guix
  guix environment: error: cannot create container: unprivileged user cannot 
create user namespaces
  guix environment: error: please set 
/proc/sys/kernel/unprivileged_userns_clone to "1"

right?   Have you tried to do the recommendation?

  please set /proc/sys/kernel/unprivileged_userns_clone to "1"

in other words, as root:

  # echo 1 > /proc/sys/kernel/unprivileged_userns_clone
  $ guix environment -C --ad-hoc hello -- hello

and report.


Thanks,
simon

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Yasuaki Kudo]

Just FYI (sorry to interject) , my original email was stripped of html 
elements?  anyway, I was referring to this link 
https://security.stackexchange.com/questions/209529/what-does-enabling-kernel-unprivileged-userns-clone-do#comment442083_209533
  -Yasu

> On Dec 7, 2020, at 21:31, Paul Garlick  
> wrote:
> 
> Hi Pierre,
> 
> Can you try, as root on Guix System:
> 
> $ echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> 
> If you could report success or failure that would be helpful; the
> unprivileged-user-namespace-supported? test in gnu/build/linux-
> container.scm should be the same irrespective of the underlying
> distribution (Debian, CentOS, Guix System ...).
> 
> Best regards,
> 
> Paul.
> 
>> On Mon, 2020-12-07 at 12:57 +0100, Pierre Neidhardt wrote:
>> Hi!
>> 
>> I can reproduce the issue since I 'recondigure'd my Guix System.
>> I'm on cebfb29abb151ede95696181d2446c63504593d7.
>> 
>> Guix' bug?
>> 
>> 
> 
> 

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Pierre Neidhardt]

Hi!

I can reproduce the issue since I 'recondigure'd my Guix System.
I'm on cebfb29abb151ede95696181d2446c63504593d7.

Guix' bug?

-- 
Pierre Neidhardt
https://ambrevar.xyz/


signature.asc
Description: PGP signature

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Paul Garlick]

Hi Pierre,

Can you try, as root on Guix System:

$ echo 1 > /proc/sys/kernel/unprivileged_userns_clone

If you could report success or failure that would be helpful; the
unprivileged-user-namespace-supported? test in gnu/build/linux-
container.scm should be the same irrespective of the underlying
distribution (Debian, CentOS, Guix System ...).

Best regards,

Paul.

On Mon, 2020-12-07 at 12:57 +0100, Pierre Neidhardt wrote:
> Hi!
> 
> I can reproduce the issue since I 'recondigure'd my Guix System.
> I'm on cebfb29abb151ede95696181d2446c63504593d7.
> 
> Guix' bug?
> 
> 

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Jesse Dowell]

Hi All,

I believe the recommended suggestion is Debian specific is it not?

My kernel supports user namespaces and doesn't expose that file at that
location.

The only way I can work around the issue is to downgrade guix to the commit
on the master branch right before 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e

guix pull --commit=0d5d1bdf911659f60601058e8e1678187b7ba664
--allow-downgrades

Best,
Jesse

On Sun, Dec 6, 2020 at 12:03 PM zimoun  wrote:

> Hi,
>
> Please try the recommendation. Have you tried it?
>
>   please set /proc/sys/kernel/unprivileged_userns_clone to "1"
>
> As root, you just do:
>
>   echo 1 > /proc/sys/kernel/unprivileged_userns_clone
>
> then “guix environment -C” should work as expected.  To do the trick
> automatically with Sheperd, I do not know, but I am sure that the
> systemd equivalent
>
>   echo "kernel.unprivileged_userns_clone = 1" > /etc/sysctl.d/local.conf
>   sysctl --system
>
> seems doable with Guix System.
>
>
> On my system, and I need explanations if it does not work similarly on
> yours, I simply do:
>
> --8<---cut here---start->8---
> $ guix environment -C --ad-hoc hello -- hello
> guix environment: error: cannot create container: unprivileged user cannot
> create user namespaces
> guix environment: error: please set
> /proc/sys/kernel/unprivileged_userns_clone to "1"
>
> $ su -
> Password:
> # echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> # logout
>
> $ guix environment -C --ad-hoc hello -- hello
> Hello, world!
> --8<---cut here---end--->8---
>
> Hope that helps,
> simon
>
>
>
>

Re: bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces

[Tobias Geerinckx-Rice]

yasu 写道：
Now, I don't use Debian at all (I use Guix System) and do you 
think
this is a Bug in Guix (in that this Debian specific word should 
never

even be mentioned in Guix?)


It's not Debian-specific.  It is a bug in Guix.

It should try to create a namespace and properly report an error 
iff that fails, not prematurely abort after farting about in 
/proc.


A separate unprivileged-user-namespace-supported? is broken by 
design.  Reverting commit 8bc5ca5 works around this but it wasn't 
to blame.


Kind regards,

T G-R


signature.asc
Description: PGP signature