{"action":"closed","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/1737","repository_url":"https://api.github.com/repos/lxc/lxc","labels_url":"https://api.github.com/repos/lxc/lxc/issues/1737/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/1737/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/1737/events","html_url":"https://github.com/lxc/lxc/issues/1737","id":249063416,"number":1737,"title":"Cannot start privileged containers without cap sys_admin on Linux Kernel 4.6 and newer","user":{"login":"kartoffelheinz","id":869865,"avatar_url":"https://avatars0.githubusercontent.com/u/869865?v=4","gravatar_id":"","url":"https://api.github.com/users/kartoffelheinz","html_url":"https://github.com/kartoffelheinz","followers_url":"https://api.github.com/users/kartoffelheinz/followers","following_url":"https://api.github.com/users/kartoffelheinz/following{/other_user}","gists_url":"https://api.github.com/users/kartoffelheinz/gists{/gist_id}","starred_url":"https://api.github.com/users/kartoffelheinz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kartoffelheinz/subscriptions","organizations_url":"https://api.github.com/users/kartoffelheinz/orgs","repos_url":"https://api.github.com/users/kartoffelheinz/repos","events_url":"https://api.github.com/users/kartoffelheinz/events{/privacy}","received_events_url":"https://api.github.com/users/kartoffelheinz/received_events","type":"User","site_admin":false},"labels":[{"id":13436403,"url":"https://api.github.com/repos/lxc/lxc/labels/Bug","name":"Bug","color":"eb6420","default":false}],"state":"closed","locked":false,"assignee":{"login":"brauner","id":7353573,"avatar_url":"https://avatars0.githubusercontent.com/u/7353573?v=4","gravatar_id":"","url":"https://api.github.com/users/brauner","html_url":"https://github.com/brauner","followers_url":"https://api.github.com/users/brauner/followers","following_url":"https://api.github.com/users/brauner/following{/other_user}","gists_url":"https://api.github.com/users/brauner/gists{/gist_id}","starred_url":"https://api.github.com/users/brauner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brauner/subscriptions","organizations_url":"https://api.github.com/users/brauner/orgs","repos_url":"https://api.github.com/users/brauner/repos","events_url":"https://api.github.com/users/brauner/events{/privacy}","received_events_url":"https://api.github.com/users/brauner/received_events","type":"User","site_admin":false},"assignees":[{"login":"brauner","id":7353573,"avatar_url":"https://avatars0.githubusercontent.com/u/7353573?v=4","gravatar_id":"","url":"https://api.github.com/users/brauner","html_url":"https://github.com/brauner","followers_url":"https://api.github.com/users/brauner/followers","following_url":"https://api.github.com/users/brauner/following{/other_user}","gists_url":"https://api.github.com/users/brauner/gists{/gist_id}","starred_url":"https://api.github.com/users/brauner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brauner/subscriptions","organizations_url":"https://api.github.com/users/brauner/orgs","repos_url":"https://api.github.com/users/brauner/repos","events_url":"https://api.github.com/users/brauner/events{/privacy}","received_events_url":"https://api.github.com/users/brauner/received_events","type":"User","site_admin":false}],"milestone":null,"comments":12,"created_at":"2017-08-09T15:08:21Z","updated_at":"2017-10-30T15:30:14Z","closed_at":"2017-10-30T15:30:14Z","author_association":"NONE","body":"This bug is present atleast for 1 year now, but since we use Debian only and stock kernel was way below 4.6 (3.16 to be precise), we thought it might get fixed \"by itself\". Unfortunately, this was not the case and now Debian 9 arrived with Kernel 4.9 and the bug prevents us from upgrading.\r\n\r\n# Required information\r\n\r\n * Distribution: Debian amd64 \r\n * Distribution version: (8 and 9)\r\n * The output of\r\n   * `lxc-start --version`: 2.0.7\r\n   * `lxc-checkconfig`:\r\n>--- Namespaces ---\r\nNamespaces: enabled\r\nUtsname namespace: enabled\r\nIpc namespace: enabled\r\nPid namespace: enabled\r\nUser namespace: enabled\r\nNetwork namespace: enabled\r\nMultiple /dev/pts instances: enabled\r\n--- Control groups ---\r\nCgroup: enabled\r\nCgroup clone_children flag: enabled\r\nCgroup device: enabled\r\nCgroup sched: enabled\r\nCgroup cpu account: enabled\r\nCgroup memory controller: enabled\r\nCgroup cpuset: enabled\r\n--- Misc ---\r\nVeth pair device: enabled\r\nMacvlan: enabled\r\nVlan: enabled\r\nBridges: enabled\r\nAdvanced netfilter: enabled\r\nCONFIG_NF_NAT_IPV4: enabled\r\nCONFIG_NF_NAT_IPV6: enabled\r\nCONFIG_IP_NF_TARGET_MASQUERADE: enabled\r\nCONFIG_IP6_NF_TARGET_MASQUERADE: enabled\r\nCONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled\r\nFUSE (for use with lxcfs): enabled\r\n--- Checkpoint/Restore ---\r\ncheckpoint restore: enabled\r\nCONFIG_FHANDLE: enabled\r\nCONFIG_EVENTFD: enabled\r\nCONFIG_EPOLL: enabled\r\nCONFIG_UNIX_DIAG: enabled\r\nCONFIG_INET_DIAG: enabled\r\nCONFIG_PACKET_DIAG: enabled\r\nCONFIG_NETLINK_DIAG: enabled\r\nFile capabilities: enabled\r\nNote : Before booting a new kernel, you can check its configuration\r\nusage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig`\r\n\r\n   * `uname -a`: Linux ws 4.9.0-3-amd64 #1 SMP Debian 4.9.30-2+deb9u2 (2017-06-26) x86_64 GNU/Linux\r\n   * `cat /proc/self/cgroup`\r\n>10:devices:/user.slice/user-0.slice/session-c5.scope\r\n9:cpu,cpuacct:/user.slice/user-0.slice/session-c5.scope\r\n8:freezer:/user/root/0\r\n7:memory:/user.slice/user-0.slice/session-c5.scope\r\n6:perf_event:/\r\n5:pids:/user.slice/user-0.slice/session-c5.scope\r\n4:cpuset:/\r\n3:net_cls,net_prio:/\r\n2:blkio:/user.slice/user-0.slice/session-c5.scope\r\n1:name=systemd:/user.slice/user-0.slice/session-c5.scope\r\n   * `cat /proc/1/mounts`\r\n>sysfs /sys sysfs rw,nosuid,nodev,noexec,relatime 0 0\r\nproc /proc proc rw,nosuid,nodev,noexec,relatime 0 0\r\nudev /dev devtmpfs rw,nosuid,relatime,size=65943932k,nr_inodes=16485983,mode=755 0 0\r\ndevpts /dev/pts devpts rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000 0 0\r\ntmpfs /run tmpfs rw,nosuid,noexec,relatime,size=13197976k,mode=755 0 0\r\nsecurityfs /sys/kernel/security securityfs rw,nosuid,nodev,noexec,relatime 0 0\r\ntmpfs /dev/shm tmpfs rw,nosuid,nodev 0 0\r\ntmpfs /run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k 0 0\r\ntmpfs /sys/fs/cgroup tmpfs ro,nosuid,nodev,noexec,mode=755 0 0\r\ncgroup /sys/fs/cgroup/systemd cgroup rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/lib/systemd/systemd-cgroups-agent,name=systemd 0 0\r\npstore /sys/fs/pstore pstore rw,nosuid,nodev,noexec,relatime 0 0\r\ncgroup /sys/fs/cgroup/blkio cgroup rw,nosuid,nodev,noexec,relatime,blkio 0 0\r\ncgroup /sys/fs/cgroup/net_cls,net_prio cgroup rw,nosuid,nodev,noexec,relatime,net_cls,net_prio 0 0\r\ncgroup /sys/fs/cgroup/cpuset cgroup rw,nosuid,nodev,noexec,relatime,cpuset,clone_children 0 0\r\ncgroup /sys/fs/cgroup/pids cgroup rw,nosuid,nodev,noexec,relatime,pids 0 0\r\ncgroup /sys/fs/cgroup/perf_event cgroup rw,nosuid,nodev,noexec,relatime,perf_event 0 0\r\ncgroup /sys/fs/cgroup/memory cgroup rw,nosuid,nodev,noexec,relatime,memory 0 0\r\ncgroup /sys/fs/cgroup/freezer cgroup rw,nosuid,nodev,noexec,relatime,freezer 0 0\r\ncgroup /sys/fs/cgroup/cpu,cpuacct cgroup rw,nosuid,nodev,noexec,relatime,cpu,cpuacct 0 0\r\ncgroup /sys/fs/cgroup/devices cgroup rw,nosuid,nodev,noexec,relatime,devices 0 0\r\nsystemd-1 /proc/sys/fs/binfmt_misc autofs rw,relatime,fd=35,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=19932 0 0\r\nmqueue /dev/mqueue mqueue rw,relatime 0 0\r\ndebugfs /sys/kernel/debug debugfs rw,relatime 0 0\r\nhugetlbfs /dev/hugepages hugetlbfs rw,relatime 0 0\r\ntmpfs /tmp tmpfs rw,relatime,size=52791904k,nr_inodes=2048000 0 0\r\ntmpfs /run/shm tmpfs rw,nosuid,nodev,relatime,size=13197976k 0 0\r\n/dev/sda3 /boot ext3 rw,noatime,data=ordered 0 0\r\nlxcfs /var/lib/lxcfs fuse.lxcfs rw,nosuid,nodev,relatime,user_id=0,group_id=0,allow_other 0 0\r\nfusectl /sys/fs/fuse/connections fusectl rw,relatime 0 0\r\ntmpfs /run/user/1000 tmpfs rw,nosuid,nodev,relatime,size=13197976k,mode=700,uid=1000,gid=1000 0 0\r\ntmpfs /run/user/0 tmpfs rw,nosuid,nodev,relatime,size=13197976k,mode=700 0 0\r\n\r\n\r\n# Issue description\r\n\r\nIf you try to start a privileged container lxc.cap.drop = sys_admin (anyone not insane will want this) on a kernel newer than 4.5 the container will not boot (hangs on init), emitting the following error:\r\n>Failed` to mount tmpfs at /sys/fs/cgroup: Operation not permitted\r\nFailed to mount cgroup at /sys/fs/cgroup/systemd: No such file or directory\r\n[ESC[0;1;31m!!!!!!ESC[0m] Failed to mount API filesystems, freezing.\r\nFreezing `execution.\r\n\r\nThis works just fine with a kernel up to (including) 4.5. I remember something about cgroup architecture had changed around that time, but I'm no kernel developer.\r\n\r\n# Steps to reproduce\r\n\r\n 1. Install latest Debian version (Debian Stretch)\r\n 2. lxc-create -t download -n test -- --dist debian --release stretch --arch amd64\r\n 3. Modify config from test and include the following (mount entries are also needed for younger kernels)\r\n>lxc.cap.drop = sys_admin\r\nlxc.mount.entry = tmpfs dev/shm tmpfs rw,nosuid,nodev,size=128m,create=dir 0 0 \r\nlxc.mount.entry = tmpfs run tmpfs rw,nosuid,nodev,mode=755,size=128m,create=dir 0 0 \r\nlxc.mount.entry = tmpfs run/lock tmpfs rw,nosuid,nodev,noexec,relatime,size=5120k,create=dir 0 0\r\n 4. Start the container in foreground or in background and watch logfile\r\n\r\n# Information to attach\r\n\r\n - [x] container log (The <log> file from running `lxc-start -n <c> -o <log> -l DEBUG`) [test.log.txt](https://github.com/lxc/lxc/files/1211913/test.log.txt)\r\n - [x] console.log (from lxc-start -L <console>) [console.txt](https://github.com/lxc/lxc/files/1211912/console.txt)\r\n - [x] the containers configuration file [test.config.txt](https://github.com/lxc/lxc/files/1211914/test.config.txt)\r\n\r\n"}}
{"actor":{"display_login":"hallyn"}}