I am trying to setup app-emulation/lxc-1.1.2 on a sys-kernel/hardened-sources-3.18.9 machine with sys-apps/systemd-218-r3, but run into the following issue: No such file or directory - failed to mount 'mqueue' on '/var/lib/lxc/rootfs/dev/mqueue' I assume that LXC will itself mount something into /var/lib/lxc/rootfs/dev, but misses to create an empty mqueue directory. In any case, I tried to create it manually, which made no difference: # find /var/lib/lxc/rootfs /var/lib/lxc/rootfs /var/lib/lxc/rootfs/proc /var/lib/lxc/rootfs/.keep_app-emulation_lxc-0 /var/lib/lxc/rootfs/sys /var/lib/lxc/rootfs/dev /var/lib/lxc/rootfs/dev/mqueue /var/lib/lxc/rootfs/README The container's image also contains the directory, but that does not have any effect, either: # find /var/lib/lxc/XXX.rootfs/dev/mqueue/ /var/lib/lxc/XXX/rootfs/dev/mqueue/ Reproducible: Always # journalctl -u lxc@XXX systemd[1]: Starting Linux Container XXX... lxc-devsetup[29504]: /dev is devtmpfs systemd[1]: Started Linux Container XXX. lxc-start[29506]: lxc-start: conf.c: mount_entry: 1722 No such file or directory - failed to mount 'mqueue' on '/var/lib/lxc/rootfs/dev/mqueue' lxc-start[29506]: lxc-start: conf.c: lxc_setup: 3843 failed to setup the mount entries for 'XXX' lxc-start[29506]: lxc-start: start.c: do_start: 699 failed to setup the container lxc-start[29506]: lxc-start: sync.c: __sync_wait: 51 invalid sequence number 1. expected 2 lxc-start[29506]: lxc-start: start.c: __lxc_start: 1164 failed to spawn 'XXX' systemd[1]: lxc@XXX.service: main process exited, code=exited, status=255/n/a systemd[1]: lxc@XXX.service: control process exited, code=exited status=2 systemd[1]: Unit lxc@XXX.service entered failed state. systemd[1]: lxc@XXX.service failed. lxc-start[29506]: lxc-start: lxc_start.c: main: 344 The container failed to start. lxc-start[29506]: lxc-start: lxc_start.c: main: 348 Additional information can be obtained by setting the --logfile and --logpriority options. lxc-stop[29520]: XXX is not running # cat /var/lib/lxc/XXX/config lxc.include = /usr/share/lxc/config/gentoo.moresecure.conf lxc.utsname = XXX lxc.arch = amd64 lxc.network.type = veth lxc.network.link = br0 lxc.network.flags = up […] lxc.rootfs = /var/lib/lxc/XXX/rootfs lxc.mount.entry=sys sys sysfs rbind,rslave 0 0 # emerge --info lxc systemd hardened-sources Portage 2.2.18 (python 2.7.9-final-0, hardened/linux/amd64/selinux, gcc-4.8.4, glibc-2.20-r2, 3.18.9-hardened x86_64) ================================================================= System Settings ================================================================= System uname: Linux-3.18.9-hardened-x86_64-AMD_Athlon-tm-_64_Processor_3700+-with-gentoo-2.2 KiB Mem: 2046996 total, 167240 free KiB Swap: 4194300 total, 4189940 free Timestamp of repository gentoo: Sun, 31 May 2015 15:15:01 +0000 sh bash 4.3_p33-r2 ld GNU ld (Gentoo 2.24 p1.4) 2.24 distcc 3.1 x86_64-pc-linux-gnu [disabled] app-shells/bash: 4.3_p33-r2::gentoo dev-lang/perl: 5.20.2::gentoo dev-lang/python: 2.7.9-r1::gentoo, 3.3.5-r1::gentoo dev-util/cmake: 2.8.12.2-r1::gentoo sys-apps/baselayout: 2.2::gentoo sys-apps/openrc: 0.13.11::gentoo sys-apps/sandbox: 2.6-r1::gentoo sys-devel/autoconf: 2.69::gentoo sys-devel/automake: 1.13.4::gentoo, 1.14.1::gentoo sys-devel/binutils: 2.24-r3::gentoo sys-devel/gcc: 4.8.4::gentoo sys-devel/gcc-config: 1.7.3::gentoo sys-devel/libtool: 2.4.6::gentoo sys-devel/make: 4.1-r1::gentoo sys-kernel/linux-headers: 3.18::gentoo (virtual/os-headers) sys-libs/glibc: 2.20-r2::gentoo Repositories: gentoo location: /var/cache/portage/gentoo sync-type: rsync sync-uri: rsync://rsync.europe.gentoo.org/gentoo-portage priority: -1000 local location: /var/cache/portage/local masters: gentoo local ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="* -@EULA" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-pipe -mtune=generic -O2" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-pipe -mtune=generic -O2" DISTDIR="/var/cache/portage/distfiles" EMERGE_DEFAULT_OPTS="--usepkg --buildpkg --binpkg-respect-use --keep-going --nospinner" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs buildpkg compressdebug config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch parallel-install preserve-libs protect-owned sandbox selinux sesandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://ftp.spline.inf.fu-berlin.de/mirrors/gentoo/ http://ftp-stud.fht-esslingen.de/pub/Mirrors/gentoo/ http://distfiles.gentoo.org" LANG="en_GB.UTF-8" LDFLAGS="-Wl,-O1 -Wl,--as-needed -Wl,--hash-style=gnu" MAKEOPTS="-j2" PKGDIR="/var/cache/portage/packages" PORTAGE_COMPRESS="xz" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" USE="acl amd64 berkdb bzip2 caps cli cracklib crypt cxx dri gdbm gpg hardened iconv ipv6 jit justify luajit lz4 lzma lzo mmx mmxext modules multilib ncurses nls nptl open_perms openmp pam pax_kernel pcre readline sctp selinux session sse sse2 ssl systemd tcpd udev unconfined unicode urandom vhosts xattr xtpax xz zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="3dnow 3dnowext mmx mmxext sse sse2 sse3" DRACUT_MODULES="lvm" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby19 ruby20" USERLAND="GNU" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, USE_PYTHON ================================================================= Package Settings ================================================================= app-emulation/lxc-1.1.2::gentoo was built with the following: USE="cgmanager seccomp -doc -examples -lua -python" ABI_X86="64" PYTHON_TARGETS="python3_3 -python3_4" CFLAGS="-pipe -mtune=generic -O2 -g -fno-strict-aliasing" CXXFLAGS="-pipe -mtune=generic -O2 -g -fno-strict-aliasing" sys-apps/systemd-218-r3::gentoo was built with the following: USE="acl kmod lz4 lzma pam seccomp (selinux) (-apparmor) -audit -cryptsetup -curl -doc -elfutils -gcrypt -gudev -http -idn -introspection (-kdbus) -policykit -python -qrcode (-ssl) -sysv-utils -terminal -test -vanilla -xkb" ABI_X86="64 -32 -x32" PYTHON_SINGLE_TARGET="python2_7 -python3_3 -python3_4" PYTHON_TARGETS="python2_7 python3_3 -python3_4" sys-kernel/hardened-sources-3.18.9::gentoo was built with the following: USE="-build -deblob -symlink" ABI_X86="64" # lxc-checkconfig Kernel configuration not found at /proc/config.gz; searching... Kernel configuration found at /boot/config-3.18.9-hardened --- Namespaces --- Namespaces: enabled Utsname namespace: enabled Ipc namespace: enabled Pid namespace: enabled User namespace: enabled Network namespace: enabled Multiple /dev/pts instances: enabled --- Control groups --- Cgroup: enabled Cgroup clone_children flag: enabled Cgroup device: enabled Cgroup sched: enabled Cgroup cpu account: enabled Cgroup memory controller: enabled Cgroup cpuset: enabled --- Misc --- Veth pair device: enabled Macvlan: enabled Vlan: enabled File capabilities: enabled # grep GRKERNSEC /boot/config-3.18.9-hardened CONFIG_GRKERNSEC=y CONFIG_GRKERNSEC_CONFIG_AUTO=y # CONFIG_GRKERNSEC_CONFIG_CUSTOM is not set CONFIG_GRKERNSEC_CONFIG_SERVER=y # CONFIG_GRKERNSEC_CONFIG_DESKTOP is not set CONFIG_GRKERNSEC_CONFIG_VIRT_NONE=y # CONFIG_GRKERNSEC_CONFIG_VIRT_GUEST is not set # CONFIG_GRKERNSEC_CONFIG_VIRT_HOST is not set CONFIG_GRKERNSEC_CONFIG_PRIORITY_PERF=y # CONFIG_GRKERNSEC_CONFIG_PRIORITY_SECURITY is not set CONFIG_GRKERNSEC_PROC_GID=10 CONFIG_GRKERNSEC_TPE_UNTRUSTED_GID=100 CONFIG_GRKERNSEC_SYMLINKOWN_GID=100 CONFIG_GRKERNSEC_KMEM=y CONFIG_GRKERNSEC_IO=y CONFIG_GRKERNSEC_BPF_HARDEN=y CONFIG_GRKERNSEC_PERF_HARDEN=y CONFIG_GRKERNSEC_RAND_THREADSTACK=y CONFIG_GRKERNSEC_PROC_MEMMAP=y CONFIG_GRKERNSEC_KSTACKOVERFLOW=y CONFIG_GRKERNSEC_BRUTE=y CONFIG_GRKERNSEC_MODHARDEN=y CONFIG_GRKERNSEC_HIDESYM=y CONFIG_GRKERNSEC_RANDSTRUCT=y CONFIG_GRKERNSEC_RANDSTRUCT_PERFORMANCE=y CONFIG_GRKERNSEC_KERN_LOCKOUT=y # CONFIG_GRKERNSEC_NO_RBAC is not set CONFIG_GRKERNSEC_ACL_HIDEKERN=y CONFIG_GRKERNSEC_ACL_MAXTRIES=3 CONFIG_GRKERNSEC_ACL_TIMEOUT=30 # CONFIG_GRKERNSEC_PROC is not set CONFIG_GRKERNSEC_LINK=y CONFIG_GRKERNSEC_SYMLINKOWN=y CONFIG_GRKERNSEC_FIFO=y # CONFIG_GRKERNSEC_SYSFS_RESTRICT is not set # CONFIG_GRKERNSEC_ROFS is not set CONFIG_GRKERNSEC_DEVICE_SIDECHANNEL=y CONFIG_GRKERNSEC_CHROOT=y # CONFIG_GRKERNSEC_CHROOT_MOUNT is not set # CONFIG_GRKERNSEC_CHROOT_DOUBLE is not set # CONFIG_GRKERNSEC_CHROOT_PIVOT is not set CONFIG_GRKERNSEC_CHROOT_CHDIR=y # CONFIG_GRKERNSEC_CHROOT_CHMOD is not set CONFIG_GRKERNSEC_CHROOT_FCHDIR=y CONFIG_GRKERNSEC_CHROOT_MKNOD=y CONFIG_GRKERNSEC_CHROOT_SHMAT=y CONFIG_GRKERNSEC_CHROOT_UNIX=y CONFIG_GRKERNSEC_CHROOT_FINDTASK=y CONFIG_GRKERNSEC_CHROOT_NICE=y CONFIG_GRKERNSEC_CHROOT_SYSCTL=y CONFIG_GRKERNSEC_CHROOT_RENAME=y # CONFIG_GRKERNSEC_CHROOT_CAPS is not set CONFIG_GRKERNSEC_CHROOT_INITRD=y # CONFIG_GRKERNSEC_AUDIT_GROUP is not set # CONFIG_GRKERNSEC_EXECLOG is not set CONFIG_GRKERNSEC_RESLOG=y # CONFIG_GRKERNSEC_CHROOT_EXECLOG is not set # CONFIG_GRKERNSEC_AUDIT_PTRACE is not set # CONFIG_GRKERNSEC_AUDIT_CHDIR is not set # CONFIG_GRKERNSEC_AUDIT_MOUNT is not set CONFIG_GRKERNSEC_SIGNAL=y # CONFIG_GRKERNSEC_FORKFAIL is not set CONFIG_GRKERNSEC_TIME=y CONFIG_GRKERNSEC_PROC_IPADDR=y CONFIG_GRKERNSEC_RWXMAP_LOG=y CONFIG_GRKERNSEC_DMESG=y CONFIG_GRKERNSEC_HARDEN_PTRACE=y CONFIG_GRKERNSEC_PTRACE_READEXEC=y CONFIG_GRKERNSEC_SETXID=y CONFIG_GRKERNSEC_HARDEN_IPC=y CONFIG_GRKERNSEC_TPE=y # CONFIG_GRKERNSEC_TPE_ALL is not set # CONFIG_GRKERNSEC_TPE_INVERT is not set CONFIG_GRKERNSEC_TPE_GID=100 CONFIG_GRKERNSEC_BLACKHOLE=y CONFIG_GRKERNSEC_NO_SIMULT_CONNECT=y # CONFIG_GRKERNSEC_SOCKET is not set CONFIG_GRKERNSEC_DENYUSB=y # CONFIG_GRKERNSEC_DENYUSB_FORCE is not set CONFIG_GRKERNSEC_SYSCTL=y # CONFIG_GRKERNSEC_SYSCTL_DISTRO is not set CONFIG_GRKERNSEC_SYSCTL_ON=y # CONFIG_GRKERNSEC_SELINUX_AVC_LOG_IPADDR is not set CONFIG_GRKERNSEC_FLOODTIME=10 CONFIG_GRKERNSEC_FLOODBURST=6
P.S: The host has mqueue mounted: # mount | grep mqueue mqueue on /dev/mqueue type mqueue (rw,relatime,seclabel)
I also tried setting lxc.hook.autodev to a script that: 1. lists the contents of ${LXC_ROOTFS_MOUNT}/dev into a file in /tmp 2. creates ${LXC_ROOTFS_MOUNT}/dev/mqueue This had no effect - apparently the script was not even executed (the file mentioned in pt1 was not created). Due to bug #308553 I don't have current manpages available. Judging from the Ubuntu manpages (for LXC 1.0), autodev happens after mounting. Which puzzles me, as then the dev directory should still be in the same state as in the image - without anything mounted into it. Apparently LXC first mounts the rootfs, then its own stuff (apparently including /dev), and then executes lxc.mount.entry. Is that correct? Under these circumstances: Is there any way for me to workaround this issue?
I am not sure this is a Gentoo packaging bug itself. It seems you may have some luck in the lxc-devel mailing list.
(In reply to Markos Chandras from comment #3) > I am not sure this is a Gentoo packaging bug itself. It seems you may have > some luck in the lxc-devel mailing list. /usr/share/lxc/config/gentoo.moresecure.conf contains the mount command for dev/mqueue. So I assume someone knows why it is required and tested that it works. The only question is: Why does it work for the maintainers, but not for me?
(In reply to Dennis Schridde from comment #4) > (In reply to Markos Chandras from comment #3) > > I am not sure this is a Gentoo packaging bug itself. It seems you may have > > some luck in the lxc-devel mailing list. > > /usr/share/lxc/config/gentoo.moresecure.conf contains the mount command for > dev/mqueue. So I assume someone knows why it is required and tested that it > works. The only question is: Why does it work for the maintainers, but not > for me? We don't really maintain the upstream templates ourselves. Anyone can submit patches to the upstream mailing list so it's not really something we can really solve in the downstream bugzilla. You need to ask the lxc-devel mailing list. The gentoo templates maintainers are probably there so answer your questions
(In reply to Markos Chandras from comment #5) > We don't really maintain the upstream templates ourselves. Anyone can submit > patches to the upstream mailing list so it's not really something we can > really solve in the downstream bugzilla. You need to ask the lxc-devel > mailing list. The gentoo templates maintainers are probably there so answer > your questions Thanks for the explanation. I assumed that LXC's Gentoo support was maintained by it's Gentoo maintainers. Anyway: https://lists.linuxcontainers.org/pipermail/lxc-devel/2015-June/011837.html
To-be-expected workaround: Without the mqueue and shm lines in gentoo.moresecure.conf, the container starts.
The fix [1] is simple: Use the mount option create=dir. Thanks to hwoarang for the hint [2]! (Hidden in a commit of his, but still…) [1]: https://github.com/lxc/lxc/pull/562 [2]: https://github.com/lxc/lxc/commit/7ed54c6155982bd8376fdb88bed79c664d5e111f
(In reply to Dennis Schridde from comment #8) > The fix [1] is simple: Use the mount option create=dir. Thanks to hwoarang > for the hint [2]! (Hidden in a commit of his, but still…) > > [1]: https://github.com/lxc/lxc/pull/562 > [2]: > https://github.com/lxc/lxc/commit/7ed54c6155982bd8376fdb88bed79c664d5e111f Glad my previous commit helped. Hmm this was not merged to stable-1.1 but only to the master branch so I guess I will have to include it to 1.1.2 ebuild.
+*lxc-1.1.2-r1 (11 Jun 2015) + + 11 Jun 2015; Markos Chandras <hwoarang@gentoo.org> + +files/lxc-1.1.2-fix-gentoo-moresecure-template.patch, +lxc-1.1.2-r1.ebuild: + Version bump to apply upstream patch for the gentoo-moresecure template. Bug + #551096 +
