least-authority-wrapper - clone: permission not permitted

least-authority-wrapper - clone: permission not permitted

[Marc Coquand]

Heya,

I'm trying to /wrap/ my head around least-authority-wrapper.

Specifically, I have a guile script that sends an email with msmtp and
fetches secrets using cat. This is a script that is run by the laminar
service when a build job is complete. Since it doesn't need to access
all secrets I make available through sops-guix, I wanted to try to
containerize it and lock it down from accessing files outside of the
ones it needs. 

This is the program that I have:

(least-authority-wrapper
    (program-file "after" notify-mail-gexp)
    #:name "after"
    #:user "laminar"
    #:group "laminar"
    #:namespaces
    '(mnt) ;; This is the namespace causing issues
    #:mappings (list
		(file-system-mapping
		 (source (file-append nss-certs "/etc/ssl/certs"))
		 (target source)
		 (writable? #t))
		(file-system-mapping
		 (source "/var/lib/laminar")
		 (target source)
		 (writable? #t))
		(file-system-mapping
		 (source "/run/secrets/after")
		 (target source)
		 (writable? #t)))
    #:preserved-environment-variables
    '( "USER" "TERM" "JOB" "RESULT" "RUN" "SSL_CERT_FILE" "SSL_CERT_DIR" "GIT_SSL_CAINFO"))

After some debugging, I found that it was the namespace 'mnt that was
causing issues, the script works when I remove it. 

The error I'm getting is

Backtrace:
           5 (primitive-load "/var/lib/laminar/cfg/after")
In ice-9/eval.scm:
   191:35  4 (_ #f)
In gnu/build/linux-container.scm:
    300:8  3 (call-with-temporary-directory #<procedure 7f7e58d71a50?>)
   397:16  2 (_ "/tmp/guix-directory.nIT1Mt")
    239:7  1 (run-container "/tmp/guix-directory.nIT1Mt" (#<<fil?> ?) ?)
In guix/build/syscalls.scm:
  1143:12  0 (_ 131089)

guix/build/syscalls.scm:1143:12: In procedure clone: 131089: Operation not permitted

When I try to invoke the script.

Any clue why I'm getting the operation not permitted error? 

-- 
Marc

Re: least-authority-wrapper - clone: permission not permitted

[Ludovic Courtès]

Hi Marc,

Marc Coquand <marc@coquand.email> skribis:

> After some debugging, I found that it was the namespace 'mnt that was
> causing issues, the script works when I remove it. 
>
> The error I'm getting is
>
> Backtrace:
>            5 (primitive-load "/var/lib/laminar/cfg/after")
> In ice-9/eval.scm:
>    191:35  4 (_ #f)
> In gnu/build/linux-container.scm:
>     300:8  3 (call-with-temporary-directory #<procedure 7f7e58d71a50?>)
>    397:16  2 (_ "/tmp/guix-directory.nIT1Mt")
>     239:7  1 (run-container "/tmp/guix-directory.nIT1Mt" (#<<fil?> ?) ?)
> In guix/build/syscalls.scm:
>   1143:12  0 (_ 131089)
>
> guix/build/syscalls.scm:1143:12: In procedure clone: 131089: Operation not permitted
>
> When I try to invoke the script.
>
> Any clue why I'm getting the operation not permitted error? 

Are unprivileged user namespaces enabled on this system?

If they are, could it be that you’re trying to run this from a namespace
that lacks this capability?  (I always forget why exactly you cannot
always create processes in separate namespaces, but there are
restrictions that show up typically when nesting things.)

HTH,
Ludo’.