** Changed in: systemd (Ubuntu Vivid)
Importance: Undecided => Medium
You received this bug notification because you are a member of Ubuntu
Touch seeded packages, which is subscribed to lxc in Ubuntu.
journal is broken in unprivileged LXC and nspawn containers
Status in lxc package in Ubuntu:
Status in systemd package in Ubuntu:
Status in systemd source package in Vivid:
Status in systemd source package in Wily:
- Under Ubuntu 15.04 (or 15.10), set up an unprivileged container as in
- Boot it. You'll get a lot of errors like
[FAILED] Failed to start Journal Service.
systemd-journald-audit.socket failed to listen on sockets: Operation not
[FAILED] Failed to listen on Journal Audit Socket.
- The same happens with systemd-nspawn -b.
As a result, the journal isn't working at all, and you have a bunch of
failed journal related units.
With a fixed systemd package, systemd in the container should realize
that it cannot listen to the audit socket (as the kernel doesn't allow
that -- the audit subsystem isn't fit for namespaces right now), and
"sudo journalctl" should show the journal and systemd-journald.service
should be running. These systemd fixes are sufficient for nspawn, but
not completely for unprivileged LXC containers -- there the journal
will start working, but systemd-journald-audit.socket will still keep
failing (this is less important)
REGRESSION POTENTIAL: Very low. This only affects the fallback error
code path if binding to the audit socket failed. In that case the
journal is currently not working at all. This usually doesn't happen
on real iron/VMs (they also always CAP_AUDIT_READ), so there is no
practical change there.
To manage notifications about this bug go to:
Mailing list: https://launchpad.net/~touch-packages
Post to : firstname.lastname@example.org
Unsubscribe : https://launchpad.net/~touch-packages
More help : https://help.launchpad.net/ListHelp