{"action":"opened","issue":{"url":"https://api.github.com/repos/CanonicalLtd/maas-docs/issues/700","repository_url":"https://api.github.com/repos/CanonicalLtd/maas-docs","labels_url":"https://api.github.com/repos/CanonicalLtd/maas-docs/issues/700/labels{/name}","comments_url":"https://api.github.com/repos/CanonicalLtd/maas-docs/issues/700/comments","events_url":"https://api.github.com/repos/CanonicalLtd/maas-docs/issues/700/events","html_url":"https://github.com/CanonicalLtd/maas-docs/issues/700","id":276921619,"number":700,"title":"Revise MAAS in LXD instructions","user":{"login":"dshcherb","id":12861810,"avatar_url":"https://avatars0.githubusercontent.com/u/12861810?v=4","gravatar_id":"","url":"https://api.github.com/users/dshcherb","html_url":"https://github.com/dshcherb","followers_url":"https://api.github.com/users/dshcherb/followers","following_url":"https://api.github.com/users/dshcherb/following{/other_user}","gists_url":"https://api.github.com/users/dshcherb/gists{/gist_id}","starred_url":"https://api.github.com/users/dshcherb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dshcherb/subscriptions","organizations_url":"https://api.github.com/users/dshcherb/orgs","repos_url":"https://api.github.com/users/dshcherb/repos","events_url":"https://api.github.com/users/dshcherb/events{/privacy}","received_events_url":"https://api.github.com/users/dshcherb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-11-27T07:16:27Z","updated_at":"2017-11-27T07:16:27Z","closed_at":null,"author_association":"NONE","body":"There is a requirement in the current documentation for a container to be created with the following options:\r\n\r\n```\r\nraw.lxc: |-\r\n    lxc.cgroup.devices.allow = c 10:237 rwm\r\n    lxc.aa_profile = unconfined\r\n    lxc.cgroup.devices.allow = b 7:* rwm\r\n  security.privileged: \"true\"\r\n```\r\n\r\nNot sure about aa_profile but device directives are there for managing loop devices (loop-control and /dev/loop<i>) and mounting file systems. Only a root user in the [root user namespace](http://man7.org/linux/man-pages/man7/user_namespaces.7.html) can use [CAP_SYS_ADMIN](http://man7.org/linux/man-pages/man2/mount.2.html) capability which is required to mount a file system.\r\n\r\nhttp://elixir.free-electrons.com/linux/v4.14.2/source/Documentation/admin-guide/devices.txt#L369\r\n```\r\n   7 block\tLoopback devices\r\n\t\t  0 = /dev/loop0\tFirst loop device\r\n\t\t  1 = /dev/loop1\tSecond loop device\r\n\t\t    ...\r\n\r\n\t\tThe loop devices are used to mount filesystems not\r\n\t\tassociated with block devices.\tThe binding to the\r\n\t\tloop devices is handled by mount(8) or losetup(8).\r\n...\r\n  10 char       Non-serial mice, misc features\r\n...\r\n                237 = /dev/loop-control Loopback control device\r\n```\r\n\r\nhttp://elixir.free-electrons.com/linux/v4.14.2/source/include/uapi/linux/capability.h#L278\r\n```\r\n...\r\n/* Allow mount() and umount(), setting up new smb connection */\r\n...\r\n#define CAP_SYS_ADMIN        21\r\n...\r\n```\r\n\r\nI have not found any references to usage of loop devices in 2.3.0 except for \"uec2roottar\" ones: http://paste.ubuntu.com/26056577/\r\n\r\nThis was used at some point to extract contents of images:\r\n\r\nhttps://github.com/maas/maas/commit/7e2bff357855a5b1da14fee99389bc535948f340#diff-206173771dc49f98ac3f9aeea660fb25R74\r\n\r\n===\r\n\r\nIf you use snaps on a host, then you use loop devices which immediately triggers a problem with sharing those with a container.\r\n\r\nMoreover, using privileged containers has other prlimit-related side-effects: https://github.com/CanonicalLtd/maas-docs/issues/209\r\n\r\nCould we drop that requirement from the documentation for newer MAAS versions? As far as I can see, MAAS doesn't use loop devices for relevant image manipulations anymore."}}
{"actor":{"display_login":"dshcherb"}}