Closed redglobuli closed 2 years ago
brknkfr
commented
2 years ago I have exactly the same problem and logs. I did a fresh installation of coolwsd in an unprivileged lxc container running debian 11 (amd64). It has been working fine before in an unprivileged container. It stopped working with the two latest releases.
However, in an privileged container it is working fine.
What did change so that it is not working anymore in an unprivileged container?
iasdeoupxe
commented
2 years ago Cross-post from #5164:
Noticed the same this week on an unprivileged LXC container running Debian 10.
After digging a little bit around this looks like some kind of missing file capabilities. The current ones for /usr/bin/coolmount looks like the following:
root@myhost:~# getcap /usr/bin/coolmount
/usr/bin/coolmount = cap_sys_admin+epAfter doing the following to set the same file capabilities like already set for /usr/bin/coolforkit:
root@myhost:~# setcap cap_chown,cap_fowner,cap_sys_chroot,cap_mknod+ep /usr/bin/coolmount
root@myhost:~# service coolmount restartthe issue disappears and the connection to the 9980 port of coolwsd isn't timing out anymore (getting a HTTP 200 now) for me.
DISCLAIMER: Not sure if only one of these new file capabilities are required so use at your own risk because i don't know the impact of setting too much capabilities.
redglobuli
commented
2 years ago yep, that worked.
Let's see if the collabora folks can tell us if these rights are too open.
timar
commented
2 years ago /usr/bin/coolmount needs cap_sys_admin privilege, because this privilege is required for the mount syscall. If you remove this privilege and add cap_chown,cap_fowner,cap_sys_chroot,cap_mknod instead, then the check for mount will fail, and bind mounting will not be used. So, it fixes your problem, but not the way you expected.
The real fix was pushed, and COOL/CODE 22.05.6.3 will contain it. In short: unexpectedly in some cases mount works but unmount doesn't, therefore the code has to check for success of both mount and unmount before enabling bind mounting.
iasdeoupxe
commented
2 years ago For references #5289 and #5291 seems to contain the mentioned fix.
Describe the bug Everything worked with 21.06, now i upgraded to 22.05 and coolwsd isn't responding on 9980 anymore.
The instance is running on OpenVZ VPS.
curl -k http://127.0.0.1:9980 times out
journalctl shows (i set logging to trace) a loop like this:
only problem i see may be this:
I also tried to apt purge every package, removed /opt/cool, /opt/collaboraoffice /etc/cool and re-installed everything.
Then i changed protocol to IPv4, listen on loopback, disable ssl, enable ssl termination, wopi.host set to my nextcloud instance.
Permissions look the following:
Anything i may have missed upgrading?