<div dir="ltr">Hello!<div><br></div><div>I'm testing user namespaces and I have quite some problem getting them to work.</div><div><br></div><div>First of all, I have user namespaces support enabled in kernel:</div><div>
<br></div><div><div>offlinehacker:~/ $ uname -r</div><div>3.10.10</div></div><div><div>offlinehacker:~/ $ ls /proc/self/ns/</div><div>ipc@ mnt@ net@ pid@ user@ uts@</div></div><div><br></div><div>I created simple ubuntu rootfs and when I start container without idmap, so without user namespace mappings, it works just fine:</div>
<div><br></div><div>Libivrt config:</div><div><br></div><div><div><domain type='lxc'></div><div> <name>helloworld</name></div><div> <memory>102400</memory></div><div> <os></div>
<div> <type>exe</type></div><div> <init>/bin/dash</init></div><div> </os></div><div> <!--<idmap></div><div> <uid start='0' target='499' count='10'/></div>
<div> <gid start='0' target='100' count='10'/></div><div> </idmap>--></div><div> <devices></div><div> <console type='pty'/></div><div> <filesystem type='mount'></div>
<div> <source dir='/home/offlinehacker/rootfs'/></div><div> <target dir='/'/></div><div> </filesystem></div><div> </devices></div><div></domain></div></div><div>
<br></div><div>This is how my rootfs looks like:</div><div><br></div><div>offlinehacker:~/ $ ls -la rootfs<br></div><div><div>drwxr-xr-x 23 offlinehacker users 4096 sep 5 19:06 ./</div><div>drwxr-xr-x 59 offlinehacker users 4096 sep 5 19:06 ../</div>
<div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:11 bin/</div><div>drwxr-xr-x 3 offlinehacker users 4096 avg 27 14:11 boot/</div><div>drwxr-xr-x 4 offlinehacker users 4096 avg 27 14:11 dev/</div>
<div>drwxr-xr-x 86 offlinehacker users 4096 sep 5 18:20 etc/</div><div>drwxr-xr-x 3 offlinehacker users 4096 avg 27 14:11 home/</div><div>lrwxrwxrwx 1 offlinehacker users 33 avg 27 14:10 initrd.img -> /boot/initrd.img-3.2.0-52-virtual</div>
<div>drwxr-xr-x 18 offlinehacker users 4096 avg 27 14:10 lib/</div><div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:10 lib64/</div><div>drwx------ 2 offlinehacker users 4096 avg 27 14:11 lost+found/</div>
<div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:09 media/</div><div>drwxr-xr-x 2 offlinehacker users 4096 apr 19 2012 mnt/</div><div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:09 opt/</div>
<div>-rw-r--r-- 1 offlinehacker vboxusers 231671365 avg 27 14:12 precise-server-cloudimg-amd64-root.tar.gz</div><div>drwxr-xr-x 2 offlinehacker users 4096 apr 19 2012 proc/</div><div>drwx------ 2 offlinehacker users 4096 sep 3 23:47 root/</div>
<div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:11 run/</div><div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:11 sbin/</div><div>drwxr-xr-x 2 offlinehacker users 4096 mar 5 2012 selinux/</div>
<div>drwxr-xr-x 2 offlinehacker users 4096 avg 27 14:09 srv/</div><div>drwxr-xr-x 2 offlinehacker users 4096 apr 14 2012 sys/</div><div>drwxrwxrwt 2 offlinehacker users 4096 sep 4 01:39 tmp/</div>
<div>drwxr-xr-x 10 offlinehacker users 4096 avg 27 14:09 usr/</div><div>drwxr-xr-x 12 offlinehacker users 4096 sep 5 18:10 var/</div><div>lrwxrwxrwx 1 offlinehacker users 29 avg 27 14:10 vmlinuz -> boot/vmlinuz-3.2.0-52-virtual</div>
</div><div><br></div><div>And this is who I am:</div><div><div>offlinehacker:~/ $ id</div><div>uid=499(offlinehacker) gid=67(libvirtd) groups=100(users),1(wheel),57(networkmanager),67(libvirtd)</div></div><div><br></div>
<div>
When I create the container with idmap uncommented I get the following error:</div><div><br></div><div><div>offlinehacker:~/ $ virsh -c lxc:/// create helloworld.xml</div><div>error: Failed to create domain from helloworld.xml</div>
<div>error: internal error: guest failed to start: 2013-09-05 19:08:57.781+0000: 19036: debug</div></div><div><br></div><div>And these are the logs:</div><div><div>sep 05 19:08:52 laptop libvirtd[1542]: server=0x7fc8a60ddd60 client=0x7fc8a60e68d0 msg=0x7fc8a60e9380 rerr=0x7fc89a32cd40 args=0x7fc88800b4a0 ret=0x7fc88800a1c0</div>
<div>sep 05 19:08:52 laptop libvirtd[1542]: priv=0x7fc8a60e91f0 conn=(nil)</div><div>sep 05 19:08:52 laptop libvirtd[1542]: name=lxc:///</div><div>sep 05 19:08:57 laptop libvirtd[1542]: Cannot recv data: Connection reset by peer</div>
<div>sep 05 19:08:58 laptop libvirtd[1542]: internal error: guest failed to start: 2013-09-05 19:08:57.781+0000: 19036: debug</div></div><div><br></div><div>Looks like .oldroot, dev, proc and sys gets created with mapped permissions(499:100), but container fails to start.</div>
<div><br></div><div>Any help or direction how to get this working would be appriciated,</div><div>Thanks, Jaka Hudoklin!</div></div>