[-- Attachment #1.1: Type: text/plain, Size: 4862 bytes --] Hi, I really don't know much about Linux but it looks like the problem I reported has something to do with Debian? https://unix.stackexchange.com/questions/303213/how-to-enable-user-namespaces-in-the-kernel-for-unprivileged-unshare Now, I don't use Debian at all (I use Guix System) and do you think this is a Bug in Guix (in that this Debian specific word should never even be mentioned in Guix?) To summarize this bug again: The Bug: The container command no longer works, after the commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e. guix environment -C Additional Information: Instead of working as it did until the commit, the command now dies with the following error mesage: guix environment: error: cannot create container: unprivileged user cannot create user namespaces guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1" The message "please set /proc/sys/kernel/unprivileged_userns_clone to "1", seems irrelevant to Guix System users as it may only relate to Debian users. I don't know why this Debian specific message is here in the first place... Disclaimer :-): I am assuming this is indeed Debian specific (I tried to install LinuxLinux (the Guix default) but failed - my AMD graphics card won't allow me to even boot, unless I use regular Linux. ) I scanned for the phrase in LinuxLibre source code but there was no mention of it: ~/Downloads$ tar -xf linux-libre-5.9.12-gnu.tar.xz ~/Downloads$ cd linux-5.9.12/ ~/Downloads/linux-5.9.12$ rg -i unprivileged_userns_clone Just FYI: the problem phrase is indeed found in the Debian Kernel Patch: ~/co/debian$ rg -i unprivileged_userns_clone linux/debian/patches/debian/add-sysctl-to-disallow- unprivileged-CLONE_NEWUSER-by-default.patch 25:+extern int unprivileged_userns_clone; 27:+#define unprivileged_userns_clone 0 36:+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) 47:+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) { 65:+extern int unprivileged_userns_clone; 77:+ .procname = "unprivileged_userns_clone", 78:+ .data = &unprivileged_userns_clone, 96:+int unprivileged_userns_clone; Cheers, Yasu commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33eAuthor: Paul Garlick < pgarlick@tourbillion-technology.com>Date: Thu Dec 3 16:00:18 2020 +0000 linux-container: Correct test for unprivileged user namespace support. Fixes <https://bugs.gnu.org/31977>;. Reported by Paul Garlick <pgarlick@tourbillion-technology.com>. * gnu/build/linux-container.scm (unprivileged-user-namespace- supported?): Return #f when the 'userns-file' does not exist. diff --git a/gnu/build/linux-container.scm b/gnu/build/linux- container.scmindex 4a8bed5a9a..3870b50907 100644--- a/gnu/build/linux- container.scm+++ b/gnu/build/linux-container.scm@@ -44,7 +44,7 @@ (let ((userns-file "/proc/sys/kernel/unprivileged_userns_clone")) (if (file-exists? userns-file) (eqv? #\1 (call-with-input-file userns-file read- char))- #t)))+ #f))) On Sat, 2020-12-05 at 09:20 +0900, yasu wrote: > Hi Pj, > Thank you for you reply (and your wonderful Hacking Guide > https://gitlab.com/pjotrp/guix-notes/blob/master/HACKING.org)! > I tried the command and it didn't work... > I use Guix System (not a foreign distribution) as described at the > bottom > -Yasu > > On Fri, 2020-12-04 at 19:55 +0100, Pjotr Prins wrote: > > On Fri, Dec 04, 2020 at 05:32:08PM +0100, zimoun wrote: > > > Have you tried to do the recommandation? > > > > > > please set /proc/sys/kernel/unprivileged_userns_clone to "1" > > > > As root: > > > > echo 1 > /proc/sys/kernel/unprivileged_userns_clone > > > > Yes, it is common on Debian and such. > > > > Pj. > > root@guix ~# echo 1 > /proc/sys/kernel/unprivileged_userns_clone- > bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or > directory > root@guix ~# guix system describeGeneration 5631 Dec 05 2020 > 09:09:16 (current) file name: /var/guix/profiles/system-5631- > link canonical file name: > /gnu/store/qqzk4kvrhxjcia3hcq3xqrcdi36azzz9-system label: GNU with > Linux 5.9.12 bootloader: grub-efi root device: label: "my-root" > kernel: /gnu/store/9a93vpq4aa1c3adiaaa3blwc18r9r7zz-linux- > 5.9.12/bzImage channels: guix: repository URL: > https://git.savannah.gnu.org/git/guix.git branch: > master commit: > 86d635b85035086d21c319f31f628761df5c82e5 nonguix: repository > URL: https://gitlab.com/nonguix/nonguix branch: > master commit: b08ea529d4d36468b20ef4aff6dc87b3de0eff70 guix- > chromium: repository URL: > https://gitlab.com/mbakke/guix-chromium.git branch: > master commit: 2de450b92e5f2624d4f964407686934e22239f7b > configuration file: /gnu/store/hlma107m2004g6qq00ihm190am5mh9z0- > configuration.scm [-- Attachment #1.2: Type: text/html, Size: 8836 bytes --] [-- Attachment #2: face-smile.png --] [-- Type: image/png, Size: 871 bytes --]
[-- Attachment #1: Type: text/plain, Size: 562 bytes --] yasu 写道: > Now, I don't use Debian at all (I use Guix System) and do you > think > this is a Bug in Guix (in that this Debian specific word should > never > even be mentioned in Guix?) It's not Debian-specific. It is a bug in Guix. It should try to create a namespace and properly report an error iff that fails, not prematurely abort after farting about in /proc. A separate unprivileged-user-namespace-supported? is broken by design. Reverting commit 8bc5ca5 works around this but it wasn't to blame. Kind regards, T G-R [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 247 bytes --]
Hi, Please try the recommendation. Have you tried it? please set /proc/sys/kernel/unprivileged_userns_clone to "1" As root, you just do: echo 1 > /proc/sys/kernel/unprivileged_userns_clone then “guix environment -C” should work as expected. To do the trick automatically with Sheperd, I do not know, but I am sure that the systemd equivalent echo "kernel.unprivileged_userns_clone = 1" > /etc/sysctl.d/local.conf sysctl --system seems doable with Guix System. On my system, and I need explanations if it does not work similarly on yours, I simply do: --8<---------------cut here---------------start------------->8--- $ guix environment -C --ad-hoc hello -- hello guix environment: error: cannot create container: unprivileged user cannot create user namespaces guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1" $ su - Password: # echo 1 > /proc/sys/kernel/unprivileged_userns_clone # logout $ guix environment -C --ad-hoc hello -- hello Hello, world! --8<---------------cut here---------------end--------------->8--- Hope that helps, simon
Hi Zimoun,
I tried as you suggested but it didn't work...
root@guix ~# echo "kernel.unprivileged_userns_clone = 1" >
/etc/sysctl.d/local.conf
-bash: /etc/sysctl.d/local.conf: No such file or directory
root@guix ~# sysctl --system
root@guix ~# logout
~$ guix environment -C
guix environment: error: cannot create container: unprivileged user
cannot create user namespaces
guix environment: error: please set
/proc/sys/kernel/unprivileged_userns_clone to "1"
Now, if this posting were to be belived, I think this term
kernel.unprivileged_userns_clone
is specific to Debian Linux, and does not exist outside of that circle.
It disables a bit of "hardening" that Debian patches into their
distribution kernel. If you're not running such a kernel, it will
fail
and not do anything, as such a setting doesn't even exist in the
mainline Linux kernel.
I wonder how this term came in to Guix in the first place?
-Yasu
On Sun, 2020-12-06 at 17:56 +0100, zimoun wrote:
> Hi,
>
> Please try the recommendation. Have you tried it?
>
> please set /proc/sys/kernel/unprivileged_userns_clone to "1"
>
> As root, you just do:
>
> echo 1 > /proc/sys/kernel/unprivileged_userns_clone
>
> then “guix environment -C” should work as expected. To do the trick
> automatically with Sheperd, I do not know, but I am sure that the
> systemd equivalent
>
> echo "kernel.unprivileged_userns_clone = 1" >
> /etc/sysctl.d/local.conf
> sysctl --system
>
> seems doable with Guix System.
>
>
> On my system, and I need explanations if it does not work similarly
> on
> yours, I simply do:
>
> --8<---------------cut here---------------start------------->8---
> $ guix environment -C --ad-hoc hello -- hello
> guix environment: error: cannot create container: unprivileged user
> cannot create user namespaces
> guix environment: error: please set
> /proc/sys/kernel/unprivileged_userns_clone to "1"
>
> $ su -
> Password:
> # echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> # logout
>
> $ guix environment -C --ad-hoc hello -- hello
> Hello, world!
> --8<---------------cut here---------------end--------------->8---
>
> Hope that helps,
> simon
[-- Attachment #1: Type: text/plain, Size: 185 bytes --] Hi! I can reproduce the issue since I 'recondigure'd my Guix System. I'm on cebfb29abb151ede95696181d2446c63504593d7. Guix' bug? -- Pierre Neidhardt https://ambrevar.xyz/ [-- Attachment #2: signature.asc --] [-- Type: application/pgp-signature, Size: 511 bytes --]
[-- Attachment #1: Type: text/plain, Size: 1002 bytes --] Just FYI (sorry to interject) , my original email was stripped of html elements? anyway, I was referring to this link https://security.stackexchange.com/questions/209529/what-does-enabling-kernel-unprivileged-userns-clone-do#comment442083_209533 -Yasu > On Dec 7, 2020, at 21:31, Paul Garlick <pgarlick@tourbillion-technology.com> wrote: > > Hi Pierre, > > Can you try, as root on Guix System: > > $ echo 1 > /proc/sys/kernel/unprivileged_userns_clone > > If you could report success or failure that would be helpful; the > unprivileged-user-namespace-supported? test in gnu/build/linux- > container.scm should be the same irrespective of the underlying > distribution (Debian, CentOS, Guix System ...). > > Best regards, > > Paul. > >> On Mon, 2020-12-07 at 12:57 +0100, Pierre Neidhardt wrote: >> Hi! >> >> I can reproduce the issue since I 'recondigure'd my Guix System. >> I'm on cebfb29abb151ede95696181d2446c63504593d7. >> >> Guix' bug? >> >> > > [-- Attachment #2: Type: text/html, Size: 2047 bytes --]
Hi Pierre,
On Mon, 07 Dec 2020 at 12:57, Pierre Neidhardt <mail@ambrevar.xyz> wrote:
> Guix' bug?
You get something as:
$ guix environment -C guix
guix environment: error: cannot create container: unprivileged user cannot create user namespaces
guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1"
right? Have you tried to do the recommendation?
please set /proc/sys/kernel/unprivileged_userns_clone to "1"
in other words, as root:
# echo 1 > /proc/sys/kernel/unprivileged_userns_clone
$ guix environment -C --ad-hoc hello -- hello
and report.
Thanks,
simon
Hi Pierre,
> # echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> -bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or
> directory
Thanks, that gives us a clue. So all or part of the path
'/proc/sys/kernel' is missing?
Best regards,
Paul.
Hi, On Mon, 07 Dec 2020 at 21:35, Pierre Neidhardt <mail@ambrevar.xyz> wrote: >> Thanks, that gives us a clue. So all or part of the path >> '/proc/sys/kernel' is missing? > > Nope, my /proc/sys/kernel has 121 direct files and directories :/ Well, it is expected. And now all is clear. Explanations starting there: <http://logs.guix.gnu.org/guix/2020-12-07.log#211011> Quickly said, the initial code was assuming Debian-like kernel patches as Vagrant reported and this is not in the linux-libre source code with a wrong Guix error message. One bug is still there. :-) All the best, simon
On Mon, 07 Dec 2020 05:51:05 +0900
yasu <yasu@yasuaki.com> wrote:
> Hi Zimoun,
>
> I tried as you suggested but it didn't work...
>
>
> root@guix ~# echo "kernel.unprivileged_userns_clone = 1" >
> /etc/sysctl.d/local.conf
> -bash: /etc/sysctl.d/local.conf: No such file or directory
This could mean you have to create the sysctl.d directory.
Try running this:
```
# mkdir -p /etc/sysctl.d/
# echo "kernel.unprivileged_userns_clone = 1" > /etc/sysctl.d/local.conf
```