Attached the debdiff for systemd 261.3-0ubuntu4 targeting stonking.
Changes:
- Rebased on top of 261.3-0ubuntu3 currently in the archive.
- Cherry-picked the upstream fix from PR #44413 (handling EPERM/EACCES on
character and block device nodes in user namespaces, containers, or user scope).
- Preserves original node permissions on skipped chown and leaves regular file
failure behavior unchanged (exits with code 73).
- Tested on stonking in an unprivileged container: udev configuration succeeds
with exit code 0.
- All unit tests in test/test-systemd-tmpfiles.py pass.
Debian BTS #1140336 has been forwarded to upstream PR #44413.
** Description changed:
- In unprivileged user namespaces (e.g. sbuild with unshare backend,
- rootless containers, Apptainer), static device nodes bind-mounted from
- the host (/dev/kvm, /dev/fuse, etc.) are owned by IDs outside the
- namespace mapping or lack write permissions to inode metadata in the
- underlying VFS. As a result, fchownat() and fchmod() return EPERM (exit
- code 73).
+ [ Impact ]
+ When installing or upgrading udev inside unprivileged user namespaces (e.g.
sbuild with unshare backend, rootless containers, Apptainer), systemd-tmpfiles
fails during udev.postinst with exit code 73:
+ fchownat() of /dev/kvm failed: Operation not permitted
+ dpkg: error processing package udev (--configure)
- Previously, systemd-tmpfiles failures were masked by a trailing '|| true'
fallback in the maintainer script. Starting with debhelper 14
(dh_installtmpfiles), the fallback was dropped from udev.postinst:
- systemd-tmpfiles ${DPKG_ROOT:+--root="$DPKG_ROOT"} --create
static-nodes-permissions.conf
- With the fallback gone, udev configuration aborts with exit code 73 during
sbuild or container builds.
+ This happens because dh_installtmpfiles in debhelper 14 dropped the
+ trailing "|| true" fallback from maintainer scripts, and systemd-
+ tmpfiles aborted fatally upon receiving EPERM or EACCES when chowning
+ static device nodes whose owner lies outside the namespace mapping.
- Root Cause:
- fd_set_perms() in src/tmpfiles/tmpfiles.c treats any failure from fchownat()
or fchmod_opath() as fatal and returns EX_CANTCREAT (73), failing to
distinguish privilege errors on device nodes from file creation errors.
Additionally, static-nodes-permissions.conf uses the 'z' prefix without
tolerating unprivileged execution.
+ [ Fix ]
+ In src/tmpfiles/tmpfiles.c (fd_set_perms):
+ Gracefully tolerate privilege errors (EPERM, EACCES) when modifying ownership
or permissions on character and block device nodes (S_ISCHR, S_ISBLK) in user
runtime scope, unprivileged user namespaces, or containers.
+ If a temporary mode tightening was applied before the failed chown, restore
the original node mode (st_mode & 07777) before skipping via shortcut.
+ Regular files still fail fatally with EX_CANTCREAT (exit code 73) on
permission errors.
- Fix:
- 1. In src/tmpfiles/tmpfiles.c (fd_set_perms):
- Treat privilege errors (ERRNO_IS_PRIVILEGE: EPERM, EACCES) on character
and block devices (S_ISCHR, S_ISBLK) as non-fatal, logging them at debug level.
Additionally, respect Item.allow_failure if set.
- 2. In tmpfiles.d/static-nodes-permissions.conf.in:
- Mark static device node entries with the 'z-' action prefix instead of
'z', explicitly allowing systemd-tmpfiles to tolerate permission setting
failures in unprivileged environments.
+ [ Test Plan ]
+ 1. Inside an unprivileged container or user namespace with /dev/null
bind-mounted:
+ echo 'z /dev/null 0666 0 0' | systemd-tmpfiles --create - --user
+ Verify exit status is 0 and log reports:
+ "Lacking privilege to fchownat device node /dev/null, skipping: Operation
not permitted"
+ 2. Run against a regular file where user lacks chown capability:
+ echo 'z /etc/shadow 0600 0 0' | systemd-tmpfiles --create - --user
+ Verify exit status is 73 (EX_CANTCREAT) and operation fails fatally.
+ 3. Run as root on host:
+ Verify /dev/null ownership is preserved and exit status is 0.
+ 4. Run full unit test suite:
+ python3 test/test-systemd-tmpfiles.py build/systemd-tmpfiles
+ Verify 100% test pass.
- Upstream & Debian Status:
- - Debian BTS: #1140336
(https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1140336)
- - Target: Ubuntu 26.10 (stonking development series)
- - Proposed Package: systemd 261.3-0ubuntu4
+ [ Where problems could occur ]
+ The change only relaxes errors for device nodes (character and block devices)
when running in user scope, user namespaces, or containers.
+ If a user intentionally requires strict ownership enforcement on a
bind-mounted static device node inside an unprivileged container, failures will
now be logged at debug level and skipped instead of aborting execution. Regular
files and root executions remain unaffected.
+
+ [ Other Info ]
+ - Target release: Ubuntu 26.10 (stonking)
+ - Development release (tenacious): Upstream PR #44413 is submitted and
passing upstream CI; will be synced once merged into upstream main.
+ - Upstream PR: https://github.com/systemd/systemd/pull/44413
+ - Debian BTS: #1140336 (https://bugs.debian.org/1140336)
+ - Test suite: upstream and debian test suites pass with 0 regressions.
--- [ Original Report ]
Imported from Debian bug http://bugs.debian.org/1140336:
Package: udev
Version: 261~rc4-1
Severity: normal
- X-Debbugs-Cc: [email protected]
+ X-Debbugs-Cc: <email address hidden>
Dear Maintainer,
I am using sbuild with the unshare backend and this config for
autopkgtest:
$autopkgtest_opts = ['--', 'unshare', '--release', '%r', '--arch', '%a',
'-b', '/dev/kvm', '/dev/kvm'];
Running sbuild --run-autopkgtest on the dracut source code started to
fail during package installation:
Setting up udev (261~rc4-1) ...
Creating group 'input' with GID 995.
Creating group 'sgx' with GID 994.
Creating group 'clock' with GID 993.
Creating group 'kvm' with GID 992.
Creating group 'render' with GID 991.
fchownat() of /dev/kvm failed: Operation not permitted
dpkg: error processing package udev (--configure):
old udev package postinst maintainer script subprocess failed with exit
status 73
--
Benjamin Drung
Debian & Ubuntu Developer
** Patch added: "debdiff for systemd 261.3-0ubuntu4 (stonking)"
https://bugs.launchpad.net/debian/+source/systemd/+bug/2160036/+attachment/6012199/+files/systemd_261.3-0ubuntu4.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160036
Title:
udev: fchownat() of /dev/kvm failed: Operation not permitted
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2160036/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
