<div dir="ltr">Just noticed this list is for development-related discussions, sorry for sending support question. Will resend to libvirt-users.</div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Jan 29, 2018 at 5:08 PM, Thiago Padilha <span dir="ltr"><<a href="mailto:tpadilha84@gmail.com" target="_blank">tpadilha84@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I have a container rootfs that I use to keep all work-related stuff. This container was originally created by lxd (which creates all containers for use with user namespacing), but now I decided to start using libvirt for container management since I already use it for virtual machines, which will spare me from dealing with multiple hypervisor technologies.<div><br></div><div>I managed to create a working domain xml for the container, and everything seems to be working very well except one thing: I cannot start openconnect (VPN software) inside the container. I noticed that by default libvirt won't create /dev/net/tun for the container, so I added this to the domain xml:</div><div><br></div><div> <filesystem type='mount'><br></div><div><div> <source dir='/dev/net'/></div><div> <target dir='/dev/net'/></div><div> </filesystem></div></div><div><br></div><div>This successfully created /dev/net/tun in the container, but openconnect still can't open it even though it has 666 permissions. It seems this is exactly what lxd does to allow VPNs for their unprivileged containers, as shown by the output of ls -l /dev/net</div><div><br></div><div><div>total 0</div><div>crw-rw-rw- 1 nobody nogroup 10, 200 Jan 29 13:23 tun</div></div><div><br></div><div>The same container can also be successfully booted with systemd-nspawn, also allowing openconnect to create its VPN.</div><div><br></div><div>I already tried setting security driver to "none" in /etc/libvirt/lxc.conf, but it had no effect. I get "<span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Operation not permitted" when trying to open /dev/net/tun, which is also the message openconnect displays in its logs.</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline">Can someone guide me on how I might debug what is causing this error? BTW, here's the full xml:</span></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><br></span></div><div><span style="text-align:start;text-indent:0px;background-color:rgb(255,255,255);text-decoration-style:initial;text-decoration-color:initial;float:none;display:inline"><div><domain type='lxc'></div><div> <name>work-stuff</name></div><div> <uuid>ffee008c-ec6b-48ab-af6d-<wbr>4aba830847a1</uuid></div><div> <memory unit='KiB'>8388608</memory></div><div> <currentMemory unit='KiB'>8388608</<wbr>currentMemory></div><div> <vcpu placement='static'>16</vcpu></div><div> <resource></div><div> <partition>/machine</<wbr>partition></div><div> </resource></div><div> <os></div><div> <type arch='x86_64'>exe</type></div><div> <init>/sbin/init</init></div><div> </os></div><div> <idmap></div><div> <uid start='0' target='165536' count='65536'/></div><div> <gid start='0' target='165536' count='65536'/></div><div> </idmap></div><div> <cpu mode='host-model'></div><div> <model fallback='allow'/></div><div> </cpu></div><div> <clock offset='utc'/></div><div> <on_poweroff>destroy</on_<wbr>poweroff></div><div> <on_reboot>restart</on_reboot></div><div> <on_crash>restart</on_crash></div><div> <devices></div><div> <emulator>/usr/lib/libvirt/<wbr>libvirt_lxc</emulator></div><div> <filesystem type='mount' accessmode='passthrough'></div><div> <source dir='/var/lib/libvirt/<wbr>containers/work-stuff/rootfs'/<wbr>></div><div> <target dir='/'/></div><div> </filesystem></div><div> <filesystem type='mount'></div><div> <source dir='/dev/net'/></div><div> <target dir='/dev/net'/></div><div> </filesystem></div><div> <interface type='network'></div><div> <mac address='52:54:00:3e:59:e9'/></div><div> <source network='default'/></div><div> </interface></div><div> <console type='pty'></div><div> <target type='lxc' port='0'/></div><div> </console></div><div> </devices></div><div></domain></div><div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-transform:none;white-space:normal;word-spacing:0px"><br></div></span></div><div><br></div><div><br></div><div><br></div><div><br></div></div>
</blockquote></div><br></div>