* bug#61156: ‘guix container exec’ does not actually change PID namespaces
@ 2023-01-29 21:58 Ludovic Courtès
2023-01-30 22:51 ` Ludovic Courtès
0 siblings, 1 reply; 2+ messages in thread
From: Ludovic Courtès @ 2023-01-29 21:58 UTC (permalink / raw)
To: 61156
Currently, when a Guix program runs in separate user, mount, and PID
namespaces (for example via (guix least-authority)), ‘guix container
exec’ fails badly:
guix container exec 10652 /gnu/store/720rj90bch716isd8z7lcwrnvz28ap4y-bash-static-5.1.8/bin/sh
guix container: error: process terminated with signal 11
or, similarly:
nsenter --preserve-credentials -U -m -t 10652 -m -U -p -F /gnu/store/720rj90bch716isd8z7lcwrnvz28ap4y-bash-static-5.1.8/bin/sh
Segmentation fault
Stracing reveals that the child process segfaults immediately after
attempting to read /proc/self/exe:
14111 readlink("/proc/self/exe", 0x7ffccefa29c0, 4096) = -1 ENOENT (No such file or directory)
14111 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xffffffffffffffff} ---
The segfault is due to <https://issues.guix.gnu.org/52671>.
But why isn’t /proc visible in the first place? It *is* definitely
mounted within that process’s namespace, as confirmed here:
$ ls -ld /proc/10652/root/proc
dr-xr-xr-x 326 root root 0 Jan 29 21:55 /proc/10652/root/proc/
The reason is that calling setns(2) on a PID namespace “changes only the
PID namespace that subsequently created child processes of the caller
will be placed in; it does not change the PID namespace of the caller
itself.”
This is why removing ‘-F’ in the ‘nsenter’ command line above solves the
problem.
Conclusion: ’container-excursion’ should fork so that the PID namespace
change takes effect.
Ludo’.
^ permalink raw reply [flat|nested] 2+ messages in thread
* bug#61156: ‘guix container exec’ does not actually change PID namespaces
2023-01-29 21:58 bug#61156: ‘guix container exec’ does not actually change PID namespaces Ludovic Courtès
@ 2023-01-30 22:51 ` Ludovic Courtès
0 siblings, 0 replies; 2+ messages in thread
From: Ludovic Courtès @ 2023-01-30 22:51 UTC (permalink / raw)
To: 61156-done
Ludovic Courtès <ludo@gnu.org> skribis:
> The reason is that calling setns(2) on a PID namespace “changes only the
> PID namespace that subsequently created child processes of the caller
> will be placed in; it does not change the PID namespace of the caller
> itself.”
Fixed in 0ef8fe22ed8985c9656835fc25ab3463d55b6669.
Ludo’.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-01-30 22:53 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-29 21:58 bug#61156: ‘guix container exec’ does not actually change PID namespaces Ludovic Courtès
2023-01-30 22:51 ` Ludovic Courtès
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).