Am 20.07.2011 15:29, schrieb Herbert Poetzl:
>> #vserver dds start
>> vcontext: vc_ctx_create(): Function not implemented
>
> this is a mainline/upstream bug, which basically happens
> when unsharing the USER namespace. what happens is that
> all capabilities are dropped, and as result, the userspace
> tool cannot issue Linux-VServer syscall commands anymore
> (because of missing CAP_CONTEXT)
>
> this can be verified on vanilla linux-3.0 kernels with
> http://vserver.13thfloor.at/Stuff/clone_newuser.c
> in the following way:
>
> gcc -o clone_newuser clone_newuser.c
> ../clone_newuser ls /root/
>
> assuming that /root does not have any right for 'other'
> this will result in a permission denied (when the USER
> namespace is compiled into the kernel)
>
> as it is rather hard to disable the USER namespace in
> linux-3.0-rc5-vs2.3.1-pre3, I prepared a new patch which
> allows you to disable that namespace for now until the
> issue is fixed upstream ...
>
> best,
> Herbert
Both linux-3.0-rc5-vs2.3.1-pre3 and linux-3.0-rc7-vs2.3.1-pre3 are
running fine now without user namespace. Your assumption was absolutely
right, the kernel was built with CONFIG_USER_NS=y before.
Herbert, many thanks for explaining and providing this workaround.
Sebastian
Received on Wed Jul 20 23:18:49 2011