[1.2] libct/nsenter: become root after joining userns #4474
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Containerd pre-creates userns and netns before calling runc, which results in the current code not working when SELinux is enabled, resulting in the following error: > runc create failed: unable to start container process: error during container init: error mounting "mqueue" to rootfs at "/dev/mqueue": setxattr /path/to/rootfs/dev/mqueue: operation not permitted The solution is to become root in the user namespace right after we join it. Fixes 4473. Co-authored-by: Wei Fu <[email protected]> Co-authored-by: lifubang <[email protected]> Signed-off-by: Kir Kolyshkin <[email protected]>
This comment was marked as outdated.
This comment was marked as outdated.
kolyshkin
added a commit
to kolyshkin/containerd
that referenced
this pull request
Oct 24, 2024
This is just to run CI in order to check if opencontainers/runc#4474 fixes opencontainers/runc#4466. Signed-off-by: Kir Kolyshkin <[email protected]>
kolyshkin
added a commit
to kolyshkin/containerd
that referenced
this pull request
Oct 25, 2024
This is just to run CI in order to check if opencontainers/runc#4474 fixes opencontainers/runc#4466. Signed-off-by: Kir Kolyshkin <[email protected]>
|
Would you mind change this PR to a backport of #4473? Thanks. |
I only opened this one to check if it's sufficient, and to test in using release-1.2 branch because this is where it will end up. We'll do a backport once we'll be sure the issue is fixed and the original PR is merged. In here I'm going to try @cyphar's solution (or see what's wrong with it). But this is for tomorrow :) |
|
#4474 was merged |
|
Sorry, accidentally pasted a wrong PR number |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Containerd pre-creates userns and netns before calling runc, which results in the current code not working when SELinux is enabled, resulting in the following error:
The solution (kudos to @lifubang, @fuweid, and @rata) is to become root in the user namespace right after we join it.
Fixes #4466.