Hi,
I really don't know much about Linux but it looks like the problem I reported has something to do with Debian?
Now, I don't use Debian at all (I use Guix System) and do you think this is a Bug in Guix (in that this Debian specific word should never even be mentioned in Guix?)
To summarize this bug again:
The Bug:
The container command no longer works, after the commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e.
guix environment -C
Additional Information:
Instead of working as it did until the commit, the command now dies with the following error mesage:
guix environment: error: cannot create container: unprivileged user cannot create user namespaces
guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone to "1"
The message "please set /proc/sys/kernel/unprivileged_userns_clone to "1",
seems irrelevant to Guix System users as it may only relate to Debian users.
I don't know why this Debian specific message is here in the first place...
Disclaimer : I am assuming this is indeed Debian specific (I tried to install LinuxLinux (the Guix default) but failed - my AMD graphics card won't allow me to even boot, unless I use regular Linux. )
I scanned for the phrase in LinuxLibre source code but there was no mention of it:
~/Downloads$ tar -xf linux-libre-5.9.12-gnu.tar.xz
~/Downloads$ cd linux-5.9.12/
~/Downloads/linux-5.9.12$ rg -i unprivileged_userns_clone
Just FYI: the problem phrase is indeed found in the Debian Kernel Patch:
~/co/debian$ rg -i unprivileged_userns_clone
linux/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch
25:+extern int unprivileged_userns_clone;
27:+#define unprivileged_userns_clone 0
36:+ if ((clone_flags & CLONE_NEWUSER) && !unprivileged_userns_clone)
47:+ if ((unshare_flags & CLONE_NEWUSER) && !unprivileged_userns_clone) {
65:+extern int unprivileged_userns_clone;
77:+ .procname = "unprivileged_userns_clone",
78:+ .data = &unprivileged_userns_clone,
96:+int unprivileged_userns_clone;
Cheers,
Yasu
commit 8bc5ca5160db3d82bd5b6b2b7ed80c96f42bd33e
Date: Thu Dec 3 16:00:18 2020 +0000
linux-container: Correct test for unprivileged user namespace support.
* gnu/build/linux-container.scm (unprivileged-user-namespace-supported?):
Return #f when the 'userns-file' does not exist.
diff --git a/gnu/build/linux-container.scm b/gnu/build/linux-container.scm
index 4a8bed5a9a..3870b50907 100644
--- a/gnu/build/linux-container.scm
+++ b/gnu/build/linux-container.scm
@@ -44,7 +44,7 @@
(let ((userns-file "/proc/sys/kernel/unprivileged_userns_clone"))
(if (file-exists? userns-file)
(eqv? #\1 (call-with-input-file userns-file read-char))
- #t)))
+ #f)))
On Sat, 2020-12-05 at 09:20 +0900, yasu wrote:
Hi Pj,
I tried the command and it didn't work...
I use Guix System (not a foreign distribution) as described at the bottom
-Yasu
On Fri, 2020-12-04 at 19:55 +0100, Pjotr Prins wrote:
On Fri, Dec 04, 2020 at 05:32:08PM +0100, zimoun wrote:
Have you tried to do the recommandation?
please set /proc/sys/kernel/unprivileged_userns_clone to "1"
As root:
echo 1 > /proc/sys/kernel/unprivileged_userns_clone
Yes, it is common on Debian and such.
Pj.
root@guix ~#
echo 1 > /proc/sys/kernel/unprivileged_userns_clone -bash: /proc/sys/kernel/unprivileged_userns_clone: No such file or directory
Generation 5631 Dec 05 2020 09:09:16 (current)
file name: /var/guix/profiles/system-5631-link
canonical file name: /gnu/store/qqzk4kvrhxjcia3hcq3xqrcdi36azzz9-system
label: GNU with Linux 5.9.12
bootloader: grub-efi
root device: label: "my-root"
kernel: /gnu/store/9a93vpq4aa1c3adiaaa3blwc18r9r7zz-linux-5.9.12/bzImage
channels:
guix:
branch: master
commit: 86d635b85035086d21c319f31f628761df5c82e5
nonguix:
branch: master
commit: b08ea529d4d36468b20ef4aff6dc87b3de0eff70
guix-chromium:
branch: master
commit: 2de450b92e5f2624d4f964407686934e22239f7b
configuration file: /gnu/store/hlma107m2004g6qq00ihm190am5mh9z0-configuration.scm