container root directory has broken permissions with tight umask and --keep-data

[Martin Pitt]

While fixing autopkgtest for tight umasks (http://bugs.debian.org/761049) I noticed that LXC fails under tight umasks, too:

$ sudo -i
# umask 077
# lxc-start-ephemeral --keep-data -o adt-utopic
[... boots ... ]
adt-utopic-9x0b7tw_ login: ubuntu
Password:
Welcome to Ubuntu Utopic Unicorn (development branch) (GNU/Linux 3.16.0-14-generic x86_64)

 * Documentation: https://help.ubuntu.com/
Unable to cd to '/home/ubuntu'

then it fails and goes back to the login prompt. This is because of

$ sudo lxc-attach -n adt-utopic-9x0b7tw_
root@adt-utopic-9x0b7tw_:/# ls -ld /
drwx------ 1 root root 4096 Sep 10 14:23 /

apparently the container overlay root directory is created with the host umask, and thus any non-root process in the container can't execute anything due to / having 0700 permissions only.

This is with LXC 1.1.0~alpha1-0ubuntu4 under current Utopic.

[Martin Pitt (pitti)]

BTW, I have added a workaround to autopkgtest, so this isn't a blocker for me.

[Serge Hallyn (serge-hallyn)]

Thanks. Meanwhile I've raised the issue on lxc-devel mailing list.

[Stéphane Graber (stgraber)]

root@blah-o24tmx0f:/# ls -ld /
drwxr-xr-x 1 root root 18 Nov 9 18:13 /