Status update after upstream review on
https://github.com/systemd/systemd/pull/44413:
1. Upstream decided against ignoring EPERM/EACCES on device nodes in
src/tmpfiles/tmpfiles.c, as permission errors on device nodes should not be
masked in core tmpfiles logic. I removed the proposed debdiff attachment.
2. The regression was originally triggered by debhelper 13.32 (commit
14a5fb77), which dropped "|| true" from autoscripts/postinst-init-tmpfiles.
3. In debhelper 14.5 (14.5ubuntu1), commit 40011ce0 reverted 14a5fb77 per
Debian CTTE (#1141909) and restored "|| true" to the postinst snippet.
4. Starting with systemd 261.3-0ubuntu3 in stonking and tenacious (rebuilt
against debhelper 14.5ubuntu1), udev.postinst again runs:
systemd-tmpfiles ${DPKG_ROOT:+--root="$DPKG_ROOT"} --create
static-nodes-permissions.conf || true
As a result, udev installation inside "sbuild --chroot-mode=unshare"
with bind-mounted /dev/kvm completes with exit status 0 in current
archive packages, and no Ubuntu delta in systemd is needed.
** Tags removed: patch
** Description changed:
- [ Impact ]
- When installing or upgrading udev inside unprivileged user namespaces (e.g.
sbuild with unshare backend, rootless containers, Apptainer), systemd-tmpfiles
fails during udev.postinst with exit code 73:
- fchownat() of /dev/kvm failed: Operation not permitted
- dpkg: error processing package udev (--configure)
-
- This happens because dh_installtmpfiles in debhelper 14 dropped the
- trailing "|| true" fallback from maintainer scripts, and systemd-
- tmpfiles aborted fatally upon receiving EPERM or EACCES when chowning
- static device nodes whose owner lies outside the namespace mapping.
-
- [ Fix ]
- Under active revision following upstream review on PR #44413. As noted by
upstream (Lennart Poettering), suppressing EPERM in tmpfiles.c core weakens
access control invariants on bare metal and privileged systems. The fix is
being refactored into distro packaging (guarding the static-nodes tmpfiles
invocation in udev.postinst when running in an unprivileged build chroot /
container without active systemd).
-
- [ Test Plan ]
- 1. Run sbuild with unshare backend and autopkgtest with /dev/kvm bind-mounted:
- sbuild --chroot-mode=unshare --run-autopkgtest ...
- 2. Verify udev package configuration completes with exit code 0.
- 3. On a standard booted host with active systemd, verify udev.postinst
continues to apply static-nodes-permissions.conf correctly.
- 4. Run systemd package test suite: 0 regressions.
-
- [ Where problems could occur ]
- The packaging guard only bypasses static-nodes tmpfiles execution in
unprivileged chroots or containers where systemd is not booted. On live systems
running systemd, permissions on static device nodes continue to be enforced as
before.
-
- [ Other Info ]
- - Target release: Ubuntu 26.10 (stonking)
- - Upstream PR: https://github.com/systemd/systemd/pull/44413 (upstream review
concluded that core tmpfiles C suppression should be dropped in favor of distro
packaging handling)
- - Debian BTS: #1140336 (https://bugs.debian.org/1140336)
-
- --- [ Original Report ]
Imported from Debian bug http://bugs.debian.org/1140336:
Package: udev
Version: 261~rc4-1
Severity: normal
- X-Debbugs-Cc: <email address hidden>
+ X-Debbugs-Cc: [email protected]
Dear Maintainer,
I am using sbuild with the unshare backend and this config for
autopkgtest:
$autopkgtest_opts = ['--', 'unshare', '--release', '%r', '--arch', '%a',
'-b', '/dev/kvm', '/dev/kvm'];
Running sbuild --run-autopkgtest on the dracut source code started to
fail during package installation:
Setting up udev (261~rc4-1) ...
Creating group 'input' with GID 995.
Creating group 'sgx' with GID 994.
Creating group 'clock' with GID 993.
Creating group 'kvm' with GID 992.
Creating group 'render' with GID 991.
fchownat() of /dev/kvm failed: Operation not permitted
dpkg: error processing package udev (--configure):
old udev package postinst maintainer script subprocess failed with exit
status 73
- --
+ --
Benjamin Drung
Debian & Ubuntu Developer
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160036
Title:
udev: fchownat() of /dev/kvm failed: Operation not permitted
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/2160036/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
