{"action":"created","issue":{"url":"https://api.github.com/repos/lxc/lxc/issues/842","repository_url":"https://api.github.com/repos/lxc/lxc","labels_url":"https://api.github.com/repos/lxc/lxc/issues/842/labels{/name}","comments_url":"https://api.github.com/repos/lxc/lxc/issues/842/comments","events_url":"https://api.github.com/repos/lxc/lxc/issues/842/events","html_url":"https://github.com/lxc/lxc/issues/842","id":135710606,"number":842,"title":"CentOS 7.2 unshare(CLONE_NEWNS) fails","user":{"login":"perj","id":224521,"avatar_url":"https://avatars.githubusercontent.com/u/224521?v=3","gravatar_id":"","url":"https://api.github.com/users/perj","html_url":"https://github.com/perj","followers_url":"https://api.github.com/users/perj/followers","following_url":"https://api.github.com/users/perj/following{/other_user}","gists_url":"https://api.github.com/users/perj/gists{/gist_id}","starred_url":"https://api.github.com/users/perj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/perj/subscriptions","organizations_url":"https://api.github.com/users/perj/orgs","repos_url":"https://api.github.com/users/perj/repos","events_url":"https://api.github.com/users/perj/events{/privacy}","received_events_url":"https://api.github.com/users/perj/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":12,"created_at":"2016-02-23T11:27:39Z","updated_at":"2016-02-24T13:12:30Z","closed_at":null,"body":"I'm trying to create an unprivileged container as root on a CentOS 7.2 box, with user namespaces enabled in the kernel (`grubby --args=user_namespace.enable=1` + reboot).\r\n\r\nRunning `lxc-create -n test -t download` as root with these lines in lxc.conf:\r\n```\r\nlxc.id_map = u 0 9900000 100000\r\nlxc.id_map = g 0 9900000 100000\r\n```\r\n\r\nThe newuidmap and newgidmap binaries are not available on this machine (not distributed by CentOS).\r\n\r\nThere's some code I traced to lxc_usernsexec.c:\r\n```\r\n[pid 28970] execve(\"/bin/lxc-usernsexec\", [\"lxc-usernsexec\", \"-m\", \"u:0:9900000:100000\", \"-m\", \"g:0:9900000:100000\", \"-m\", \"u:100000:0:1\", \"-m\", \"g:100000:0:1\", \"--\", \"/usr/share/lxc/templates/lxc-dowload\", \"--path=/var/lib/lxc/test\", \"--name=test\", \"--rootfs=/var/lib/lxc/test/rootfs\", \"--mapped-uid\", \"100000\", ...], [/* 23 vars */]) = 0\r\n```\r\n\r\nIt first sets up the namespaces:\r\n```\r\n[pid 28973] unshare(CLONE_NEWNS|CLONE_NEWUSER) = 0 # child\r\n...\r\n[pid 28970] open(\"/proc/28973/uid_map\", O_WRONLY|O_CREAT|O_TRUNC, 0666) = 5 # parent\r\n[pid 28970] write(5, \"0 9900000 100000\\n100000 0 1\\n\", 28) = 28\r\n```\r\n\r\nEverything goes well here. But then there's a second call to unshare, and this one fails:\r\n\r\n```\r\n[pid 28973] unshare(CLONE_NEWNS)        = -1 EPERM (Operation not permitted) # child\r\n```\r\n\r\nlxc-create then aborts before I get to choose an image to download.\r\n\r\nPerhaps this second call to CLONE_NEWNS isn't really needed? It'd be great if it could be avoided if so, since it seems everything works except for that.\r\nLooking at the commit log this was the initial commit for lxc_usernsexec.c so that didn't tell me very much. I tried commenting out the second call to unshare, and as far as I can tell everything works as it should, running with uid 9900000 as root inside the container, but I don't really know this API well enough to make a definite call.\r\n\r\nLXC version: 1.0.8 installed from EPEL. New lxc_usernsexec.c built from git master branch commit b450a79dd5cc2282c4d2ca56544378cc89ead44e\r\n\r\nI know the kernel is probably acting in an unexpected way by denying the second call, it seems the RedHat kernel is a bit special in this regard."},"comment":{"url":"https://api.github.com/repos/lxc/lxc/issues/comments/188250538","html_url":"https://github.com/lxc/lxc/issues/842#issuecomment-188250538","issue_url":"https://api.github.com/repos/lxc/lxc/issues/842","id":188250538,"user":{"login":"perj","id":224521,"avatar_url":"https://avatars.githubusercontent.com/u/224521?v=3","gravatar_id":"","url":"https://api.github.com/users/perj","html_url":"https://github.com/perj","followers_url":"https://api.github.com/users/perj/followers","following_url":"https://api.github.com/users/perj/following{/other_user}","gists_url":"https://api.github.com/users/perj/gists{/gist_id}","starred_url":"https://api.github.com/users/perj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/perj/subscriptions","organizations_url":"https://api.github.com/users/perj/orgs","repos_url":"https://api.github.com/users/perj/repos","events_url":"https://api.github.com/users/perj/events{/privacy}","received_events_url":"https://api.github.com/users/perj/received_events","type":"User","site_admin":false},"created_at":"2016-02-24T13:12:30Z","updated_at":"2016-02-24T13:12:30Z","body":"They both work without error:\r\n```\r\n$ unshare -fU -- echo bla\r\nbla\r\n$ sudo unshare -fU -- echo bla\r\nbla\r\n```\r\n\r\nAdding the `m` flag only works for root though:\r\n```\r\n$ unshare -fUm -- echo bla\r\nunshare: unshare failed: Operation not permitted\r\n$ sudo unshare -fUm -- echo bla\r\nbla\r\n```"}}