Re: [PATCH] environment: container: Do not remount network files as read-only.

[Drew C <me@drewc.ca>]

[-- Attachment #1: Type: text/plain, Size: 3077 bytes --]

On Sat, Mar 26, 2016 at 7:06 AM, Thompson, David <dthompson2@worcester.edu>
wrote:

> On Fri, Mar 18, 2016 at 4:51 PM, Ludovic Courtès <ludo@gnu.org> wrote:
> > "Thompson, David" <dthompson2@worcester.edu> skribis:
> >
> >> I noticed that 'guix environment --container --network' didn't work on
> >> an Ubuntu machine I was on, and the culprit was remounting things like
> >> /etc/resolv.conf read-only after the initial bind mount.
>


One thing that I have run across is the following :

$ cat /etc/resolv.conf
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by
resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.1.1

It re-writes that file every time a new network connection is made.

$ man resolvconf
[...]
DESCRIPTION
       The resolvconf package comprises a simple database for  run-time
 name‐
       server information and a simple framework for notifying applications
of
       changes in that information.  Resolvconf thus sets  itself  up  as
 the
       intermediary  between  programs  that supply nameserver information
and
       applications that use that information.
[...]

I am not at all sure if this is the cause of the issue, but I have run into
it many times before with WiFi and me trying to edit it to 8.8.8.8, so I
figure this is a decent time to bring it up.

Cheers,

Drew Crampsie



> >
> > [...]
> >
> >>                                              (file-system-mapping
> >>                                               (source file)
> >>                                               (target file)
> >> -                                             (writable? #f))))
> >> +                                             ;; An unpriviliged user
> might not
> >> +                                             ;; be able to remount
> >> +                                             ;; /etc/resolv.conf as
> read-only,
> >> +                                             ;; so we say that it is
> writable
> >> +                                             ;; here, even though in
> practice
> >> +                                             ;; it is not.
> >> +                                             (writable? #t))))
> >>                                       %network-configuration-files)
> >
> > Not sure I understand: why would bind-mounting /etc/resolv.conf
> > read-only fail?
>
> I haven't figured out the exact reason yet, but here's a strace
> snippet as proof:
>
> [pid 11334] mount("/etc/resolv.conf",
> "/tmp/guix-directory.Rc4nc6//etc/resolv.conf", 0x23da000,
> MS_RDONLY|MS_BIND, NULL) = 0
> [pid 11334] mount("/etc/resolv.conf",
> "/tmp/guix-directory.Rc4nc6//etc/resolv.conf", 0x23e4080,
> MS_RDONLY|MS_REMOUNT|MS_BIND, NULL) = -1 EPERM (Operation not
> permitted)
>
> Another Ubuntu user was able to reproduce this as well.  I find it
> kind of silly to mount these files read-only because an unprivileged
> user couldn't write to them anyway.  WDYT?
>
> - Dave
>
>

[-- Attachment #2: Type: text/html, Size: 4638 bytes --]