Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-03-04 Thread Daniel P. Berrange
On Tue, Mar 04, 2014 at 05:16:42PM +0100, Dariusz Michaluk wrote: On 03.03.2014 16:26, Daniel P. Berrange wrote: That looks really bizarre. The same two directory names nested over and over again. I can't reproduce this kind of thing on my own host. Libvirt only ever creates the first two

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-03-04 Thread Dariusz Michaluk
On 03.03.2014 16:26, Daniel P. Berrange wrote: That looks really bizarre. The same two directory names nested over and over again. I can't reproduce this kind of thing on my own host. Libvirt only ever creates the first two levels as expected /sys/fs/cgroup/systemd/machine.slice

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-03-03 Thread Dariusz Michaluk
Hi. Another week, another experiment ;) I was trying to run systemd user session for non-root user, for example darek (uid=1000), operation failed with error: systemd[26]: pam_unix(systemd-user:session): session opened for user darek by (uid=0) systemd[1]: Started Login Service.

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-03-03 Thread Daniel P. Berrange
On Mon, Mar 03, 2014 at 03:52:01PM +0100, Dariusz Michaluk wrote: Hi. Another week, another experiment ;) I was trying to run systemd user session for non-root user, for example darek (uid=1000), operation failed with error: systemd[26]: pam_unix(systemd-user:session): session opened for

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-28 Thread Dariusz Michaluk
On 27.02.2014 16:32, Stephan Sachse wrote: On Thu, Feb 27, 2014 at 3:07 PM, Dariusz Michaluk d.micha...@samsung.com wrote: On 26.02.2014 17:59, Stephan Sachse wrote: # chown -R foo:foo /var/lib/libvirt/filesystems/mycontainer you must shift the uids for the container 0 - 666, 1 - 667, 2 -

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-27 Thread Kashyap Chamarthy
On Wed, Feb 26, 2014 at 05:24:03PM +0100, Dariusz Michaluk wrote: [. . .] If all login attempts are rejected, please boot host machine with audit=0 # vi /etc/default/grub GRUB_CMDLINE_LINUX= [...] audit=0 [...] IIUC, this is no longer needed with systemd 209 and above. I just did a quick

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-27 Thread Dariusz Michaluk
On 26.02.2014 17:59, Stephan Sachse wrote: # chown -R foo:foo /var/lib/libvirt/filesystems/mycontainer you must shift the uids for the container 0 - 666, 1 - 667, 2 - 668. there is a tool for this: uidmapshift I prepared two containers, the first I used chown, in the second uidmapshift,

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-27 Thread Dariusz Michaluk
On 27.02.2014 11:43, Kashyap Chamarthy wrote: IIUC, this is no longer needed with systemd 209 and above. I just did a quick test[1] with systemd-210-2.fc21.x86_64 3.14.0-0.rc4.git0.1.fc21.x86_64 and audit subsystem enabled: $ auditctl -s AUDIT_STATUS: enabled=1 flag=1 pid=816

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-27 Thread Stephan Sachse
On Thu, Feb 27, 2014 at 3:07 PM, Dariusz Michaluk d.micha...@samsung.com wrote: On 26.02.2014 17:59, Stephan Sachse wrote: # chown -R foo:foo /var/lib/libvirt/filesystems/mycontainer you must shift the uids for the container 0 - 666, 1 - 667, 2 - 668. there is a tool for this: uidmapshift

[libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-26 Thread Dariusz Michaluk
Hi! I with my colleagues from Samsung trying to run systemd in Linux container. I saw that the others are experimenting in this topic, so I would like to present the results of my work and tests, perhaps it will be helpful to others. As the prototype I used a manual written by Daniel:

Re: [libvirt-users] [libvirt] LXC, user namespaces and systemd

2014-02-26 Thread Stephan Sachse
# chown -R foo:foo /var/lib/libvirt/filesystems/mycontainer you must shift the uids for the container 0 - 666, 1 - 667, 2 - 668. there is a tool for this: uidmapshift some tools may not work, because of the missing file capabilities. chown removes all file capabilities! try ping as user inside