From: yasu <yasu@yasuaki.com>
To: bug-guix@gnu.org, pgarlick@tourbillion-technology.com,
Pjotr Prins <pjotr.public12@thebird.nl>,
zimoun <zimon.toutoune@gmail.com>
Cc: Guix Devel <guix-devel@gnu.org>
Subject: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces
Date: Sun, 06 Dec 2020 21:41:00 +0900 [thread overview]
Message-ID: <bde9689feb5e69e4e3dcb027be33fe1ca30a7227.camel@yasuaki.com> (raw)
In-Reply-To: <4556420c9440a6c34df93213e3934176e214483f.camel@yasuaki.com>
[-- Attachment #1.1: Type: text/plain, Size: 4862 bytes --]
Hi,
I really don't know much about Linux but it looks like the problem I
reported has something to do with Debian?
https://unix.stackexchange.com/questions/303213/how-to-enable-user-namespaces-in-the-kernel-for-unprivileged-unshare
Now, I don't use Debian at all (I use Guix System) and do you think
this is a Bug in Guix (in that this Debian specific word should never
even be mentioned in Guix?)
To summarize this bug again:
The Bug:
The container command no longer works, after the commit
8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
guix environment -C
Additional Information:
Instead of working as it did until the commit, the command now
dies with the following error mesage:
guix environment: error: cannot create container:
unprivileged user cannot create user namespaces
guix environment: error: please set
/proc/sys/kernel/unprivileged_userns_clone to "1"
The message "please set
/proc/sys/kernel/unprivileged_userns_clone to "1",
seems irrelevant to Guix System users as it may only relate to
Debian users.
I don't know why this Debian specific message is here in the
first place...
Disclaimer :-):
I am assuming this is indeed Debian specific (I tried to
install LinuxLinux (the Guix default) but failed - my AMD graphics card
won't allow me to even boot, unless I use regular Linux. )
I scanned for the phrase in LinuxLibre source code but there
was no mention of it:
~/Downloads$ tar -xf linux-libre-5.9.12-gnu.tar.xz
~/Downloads$ cd linux-5.9.12/
~/Downloads/linux-5.9.12$ rg -i unprivileged_userns_clone
Just FYI: the problem phrase is indeed found in the Debian
Kernel Patch:
~/co/debian$ rg -i unprivileged_userns_clone
linux/debian/patches/debian/add-sysctl-to-disallow-
unprivileged-CLONE_NEWUSER-by-default.patch
25:+extern int unprivileged_userns_clone;
27:+#define unprivileged_userns_clone 0
36:+ if ((clone_flags & CLONE_NEWUSER) &&
!unprivileged_userns_clone)
47:+ if ((unshare_flags & CLONE_NEWUSER) &&
!unprivileged_userns_clone) {
65:+extern int unprivileged_userns_clone;
77:+ .procname = "unprivileged_userns_clone",
78:+ .data = &unprivileged_userns_clone,
96:+int unprivileged_userns_clone;
Cheers,
Yasu
commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33eAuthor: Paul Garlick <
pgarlick@tourbillion-technology.com>Date: Thu Dec 3 16:00:18 2020
+0000
linux-container: Correct test for unprivileged user namespace
support.
Fixes <https://bugs.gnu.org/31977>;. Reported by Paul Garlick
<pgarlick@tourbillion-technology.com>.
* gnu/build/linux-container.scm (unprivileged-user-namespace-
supported?): Return #f when the 'userns-file' does not exist.
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-
container.scmindex 4a8bed5a9a..3870b50907 100644--- a/gnu/build/linux-
container.scm+++ b/gnu/build/linux-container.scm@@ -44,7 +44,7
@@ (let ((userns-file
"/proc/sys/kernel/unprivileged_userns_clone")) (if (file-exists?
userns-file) (eqv? #\1 (call-with-input-file userns-file read-
char))- #t)))+ #f)))
On Sat, 2020-12-05 at 09:20 +0900, yasu wrote:
> Hi Pj,
> Thank you for you reply (and your wonderful Hacking Guide
> https://gitlab.com/pjotrp/guix-notes/blob/master/HACKING.org)!
> I tried the command and it didn't work...
> I use Guix System (not a foreign distribution) as described at the
> bottom
> -Yasu
>
> On Fri, 2020-12-04 at 19:55 +0100, Pjotr Prins wrote:
> > On Fri, Dec 04, 2020 at 05:32:08PM +0100, zimoun wrote:
> > > Have you tried to do the recommandation?
> > >
> > > please set /proc/sys/kernel/unprivileged_userns_clone to "1"
> >
> > As root:
> >
> > echo 1 > /proc/sys/kernel/unprivileged_userns_clone
> >
> > Yes, it is common on Debian and such.
> >
> > Pj.
>
> root@guix ~# echo 1 > /proc/sys/kernel/unprivileged_userns_clone-
> bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or
> directory
> root@guix ~# guix system describeGeneration 5631 Dec 05 2020
> 09:09:16 (current) file name: /var/guix/profiles/system-5631-
> link canonical file name:
> /gnu/store/qqzk4kvrhxjcia3hcq3xqrcdi36azzz9-system label: GNU with
> Linux 5.9.12 bootloader: grub-efi root device: label: "my-root"
> kernel: /gnu/store/9a93vpq4aa1c3adiaaa3blwc18r9r7zz-linux-
> 5.9.12/bzImage channels: guix: repository URL:
> https://git.savannah.gnu.org/git/guix.git branch:
> master commit:
> 86d635b85035086d21c319f31f628761df5c82e5 nonguix: repository
> URL: https://gitlab.com/nonguix/nonguix branch:
> master commit: b08ea529d4d36468b20ef4aff6dc87b3de0eff70 guix-
> chromium: repository URL:
> https://gitlab.com/mbakke/guix-chromium.git branch:
> master commit: 2de450b92e5f2624d4f964407686934e22239f7b
> configuration file: /gnu/store/hlma107m2004g6qq00ihm190am5mh9z0-
> configuration.scm
[-- Attachment #1.2: Type: text/html, Size: 8836 bytes --]
[-- Attachment #2: face-smile.png --]
[-- Type: image/png, Size: 871 bytes --]
next parent reply other threads:[~2020-12-06 12:42 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <e5c86d238ca5174b745b8ea6cb0cb6ad6b20aa5e.camel@yasuaki.com>
[not found] ` <CAJ3okZ19V7jh8SEOSKR+kMw_9qCWupjiHecNi+0v2A_fKH2EKQ@mail.gmail.com>
[not found] ` <20201204185537.qhapfbyaq7cr5lkr@thebird.nl>
[not found] ` <4556420c9440a6c34df93213e3934176e214483f.camel@yasuaki.com>
2020-12-06 12:41 ` yasu [this message]
2020-12-06 16:16 ` bug#45069: BUG: Re: guix environment: error: cannot create container: unprivileged user cannot create user namespaces Tobias Geerinckx-Rice via Bug reports for GNU Guix
2020-12-06 16:56 ` zimoun
2020-12-06 20:51 ` yasu
2021-01-06 10:49 ` raingloom
[not found] ` <CADdvwM-h6q9BvO5ZWxgUbHfdzDRc-Sj899ZPgrwqV5o1XUVnDg@mail.gmail.com>
2020-12-07 11:57 ` bug#45069: " Pierre Neidhardt
[not found] ` <1f56aef4d7b707826f34413672408e33385bbc6a.camel@tourbillion-technology.com>
2020-12-07 12:41 ` Yasuaki Kudo
[not found] ` <87tusxwncj.fsf@ambrevar.xyz>
2020-12-07 19:50 ` Paul Garlick
[not found] ` <87im9dwe07.fsf@ambrevar.xyz>
2020-12-07 21:09 ` zimoun
2020-12-07 13:26 ` zimoun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bde9689feb5e69e4e3dcb027be33fe1ca30a7227.camel@yasuaki.com \
--to=yasu@yasuaki.com \
--cc=bug-guix@gnu.org \
--cc=guix-devel@gnu.org \
--cc=pgarlick@tourbillion-technology.com \
--cc=pjotr.public12@thebird.nl \
--cc=zimon.toutoune@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).