[vserver] Re: Problem starting vservers with linux-3.0-rc5-vs2.3.1-pre3

From: Sebastian Steinhuber <sebastian.steinhuber_at_googlemail.com>
Date: Wed 20 Jul 2011 - 23:18:27 BST
Message-ID: <4E275433.8010401@googlemail.com>

Am 20.07.2011 15:29, schrieb Herbert Poetzl:
>> #vserver dds start
>> vcontext: vc_ctx_create(): Function not implemented
>
> this is a mainline/upstream bug, which basically happens
> when unsharing the USER namespace. what happens is that
> all capabilities are dropped, and as result, the userspace
> tool cannot issue Linux-VServer syscall commands anymore
> (because of missing CAP_CONTEXT)
>
> this can be verified on vanilla linux-3.0 kernels with
> http://vserver.13thfloor.at/Stuff/clone_newuser.c
> in the following way:
>
> gcc -o clone_newuser clone_newuser.c
> ../clone_newuser ls /root/
>
> assuming that /root does not have any right for 'other'
> this will result in a permission denied (when the USER
> namespace is compiled into the kernel)
>
> as it is rather hard to disable the USER namespace in
> linux-3.0-rc5-vs2.3.1-pre3, I prepared a new patch which
> allows you to disable that namespace for now until the
> issue is fixed upstream ...
>
> best,
> Herbert

Both linux-3.0-rc5-vs2.3.1-pre3 and linux-3.0-rc7-vs2.3.1-pre3 are
running fine now without user namespace. Your assumption was absolutely
right, the kernel was built with CONFIG_USER_NS=y before.
Herbert, many thanks for explaining and providing this workaround.

Sebastian
Received on Wed Jul 20 23:18:49 2011

[Next/Previous Months] [Main vserver Project Homepage] [Howto Subscribe/Unsubscribe] [Paul Sladen's vserver stuff]
Generated on Wed 20 Jul 2011 - 23:18:49 BST by hypermail 2.1.8