You have been subscribed to a public bug: I'm trying to set up a Centos 6 instance using lxc and it works fine except that non-root users cannot create pseudo-terminals under /dev/pts. After lots of googling, it appears that Lxc has reverted to an earlier bad behavior, in that /dev/pts is being created with the wrong permissions.
HOST # fgrep pts /proc/mounts devpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 LXC instance [root@rh64bare ~]# fgrep pts /proc/mounts devpts /dev/console devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 devpts /dev/tty1 devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 devpts /dev/tty2 devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 devpts /dev/tty3 devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 devpts /dev/tty4 devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0 devpts /dev/pts devpts rw,relatime,mode=600,ptmxmode=666 0 0 devpts /dev/ptmx devpts rw,relatime,mode=600,ptmxmode=666 0 0 Note the mode on /dev/pts; only root can create pseudo terminals. I tried to add an explicit devpts line to the instance fstab with the correct parameters, but nothing changed. Additionally, /dev/pts is being created root/root, not root/tty, so the gid=5 (also missing from the /dev/pts options) would have no effect in any case. Running Ubuntu 13.10 (but saw it with 13.4 as well). This was fixed upstream: commit 67e5a20ad1b5579a571f43f7dd8a1556a8bea7a1 Author: Stéphane Graber <[email protected]> Date: Tue Oct 15 14:54:41 2013 -0400 Improper pty permissions - missing mode=0620, gid=5 This fix is coming from Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720122 The reason for the hardcoded gid= and mode= is because of the fix for CVE-2013-2207 which removes pt_chown from glibc and so requires proper write access to devpts. It looks like the "tty" group is guaranteed to be gid=5 on at least all RedHat based and Debian based systems. So this hardcode gid shouldn't be a big problem. If we however support any distro where that's not the case, we'll need to implement an extra lxc.conf option and matching template changes. Signed-off-by: Stéphane Graber <[email protected]> Signed-off-by: Serge Hallyn <[email protected]> Appears to be fixed in Trusty, but really needs to be backported to Saucy ** Affects: lxc (Ubuntu) Importance: Undecided Status: New -- /dev/pts being created with mode=600 by Lxc https://bugs.launchpad.net/bugs/1242913 You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. -- Ubuntu-server-bugs mailing list [email protected] Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
