Unprivileged LXC and grsecurity kernel

3 posts / 0 new
Last post
#1 Sat, 2017-03-04 09:57
fludardes
  • fludardes's picture
  • Offline
  • Last seen: 3 months 1 week ago
  • Joined: 2017-03-04

Hello. Excuse me, please, but it seems that there is some kind of incompatibility between grsec kernel variants and the use of unprivileged LXC containers... Or maybe I do something wrong.

I try to create such container with command

# lxc-create -B btrfs -f /etc/lxc/default.conf -n alpine_1 -t download -- -d alpine -r 3.4 -a i386

/etc/lxc/default.conf I have created and changed to something like:
# Alpine fix from /etc/lxc/lxc.conf
lxc.cgroup.use = @kernel
...
# Mapping
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536

The root user has a subuid and subgid range.
But I receive an error:
newuidmap: Target process 2106 is owned by a different user: uid:0 pw_uid:0 st_uid:0, gid:0 pw_gid:0 st_gid:30
error mapping child
setgid: Invalid argument
lxc-create: lxccontainer.c: create_run_template: 1290 container creation template for ... failed
lxc-create: tools/lxc_create.c: main: 318 Error creating container

Maybe, this github issue is related to the problem...
It works with vanilla kernel on Alpine Linux, also it works on Arch Linux with grsec kernel from their repo (their version is built without GRKERNSEC_SYSFS_RESTRICT)
I just hope - is there some workaround without kernel rebuild? Sorry.

Alpine Linux v3.5, kernel: 4.4.52-0-virtgrsec
Thanks.

Sun, 2017-04-16 23:01
z33ky
  • z33ky's picture
  • Offline
  • Last seen: 4 months 2 days ago
  • Joined: 2014-06-13

Try booting with the kernel parameter grsec_sysfs_restrict=0.

On top of that you might also need to set

kernel.grsecurity.chroot_caps = 0
kernel.grsecurity.chroot_deny_chmod = 0
kernel.grsecurity.chroot_deny_pivot = 0
kernel.grsecurity.chroot_deny_chroot = 0
kernel.grsecurity.chroot_deny_mount = 0

via sysctl.

Alpine version 3.5 (both container and host) works for me in this configuration.

Wed, 2017-04-19 20:42 (Reply to #2)
fludardes
  • fludardes's picture
  • Offline
  • Last seen: 3 months 1 week ago
  • Joined: 2017-03-04

Oh, thanks a lot! Without that I had to compile a custom kernel. Maybe, it will be nice to have a hint for this in Wiki.

Log in or register to post comments