search

canonical / lxd

Powerful system container and virtual machine manager
https://canonical.com/lxd
GNU Affero General Public License v3.0
4.32k stars 927 forks source link

unshare failed: Permission denied (Noble 24.04) #12882

Closed nteodosio closed 6 months ago

nteodosio commented 6 months ago

Required information

Issue description

I did this before and it worked fine. Now I get error with unshare:

% lxc start p
% lxc console -t vga p
unshare: unshare failed: Permission denied

Steps to reproduce

  1. Create an instance. I used lxc launch prompting:ubuntu-23.10-desktop p --vm --console=vga -c limits.cpu=4 -c limits.memory=4GiB.
  2. Maybe reboot (I don't know what triggered the problem so...).
  3. lxc start p && lxc console -t vga p

Information to attach

nteodosio commented 6 months ago

Found the way to get past that error right here, https://github.com/canonical/lxd/issues/11920:

% >/etc/apparmor.d/usr.bin.unshare cat <<EOF
abi <abi/4.0>,
include <tunables/global>
/usr/bin/unshare flags=(unconfined) {
  userns,
  # Site-specific additions and overrides. See local/README for details.
  include if exists <local/usr.bin.unshare>
}
EOF
% apparmor_parser -r /etc/apparmor.d/usr.bin.unshare
tomponline commented 6 months ago

@simondeziel please can you look into this?

tomponline commented 6 months ago

@simondeziel this will be solved by re-enabling globally disabling restricted userns right?

simondeziel commented 6 months ago

@nteodosio to workaround this temporarily, can you try (as root):

echo "==> Disabling Apparmor unprivileged userns mediation"
echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns

echo "==> Disabling Apparmor unprivileged unconfined mediation"
echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_unconfined
simondeziel commented 6 months ago

This is the PR to have those keys disabled by LXD: https://github.com/canonical/lxd-pkg-snap/pull/327

tomponline commented 6 months ago

This should be fixed in latest/edge now and will be in the LXD 5.21 release.

DiogoConstantino commented 2 months ago

Just some feedback: I'm on Mantic with LXD 5.21, I'm still experiencing this issue.

tomponline commented 2 months ago

@DiogoConstantino did you try the workaround here?

https://github.com/canonical/lxd/issues/12882#issuecomment-1941766215

tomponline commented 2 months ago

@DiogoConstantino is it specifically with lxc console you're seeing the issue with?

DiogoConstantino commented 2 months ago

I did not test the workaround, because I rather have that working to secure my system, and this is not a show stopper for me.

This is specifically with lxc console, I haven't tested in any other way.

Meanwhile, I tested this on 24.04, and it did worked as expected. It appears to be a 23.10 specific issue, and due to the nearby EOL, I don't think it's a big deal. I just want people to know about it in case they also experience it in the next few weeks.

tomponline commented 2 months ago

Meanwhile, I tested this on 24.04, and it did worked as expected. It appears to be a 23.10 specific issue, and due to the nearby EOL, I don't think it's a big deal. I just want people to know about it in case they also experience it in the next few weeks.

Thanks for clarification. :)