udev fails to update (oneric host, lucid container)

[Gary Poster]

==================================================
SRU Justification:
1. Impact: container updates can fail as a result of failed mknods
2. Development fix: allow mknod in containers for all devices (but continue restricting use)
3. Stable fix: same as development fix
4. Test case: In a container, do 'mknod /tmp/ppp c 108 0'
5. Regression potential: a typo in the template update could break container creations. However the fix itself will not break containers. Security should not be impacted as the container will not be able to use the devices it creates.
==================================================
You will find when running “apt-get upgrade” (if you have Lucid updates enabled in /etc/apt/sources.list) that you get this error on upgrading udev:

mknod: `/lib/udev/devices/ppp': Operation not permitted

This problem is mentioned on https://help.ubuntu.com/community/LXC#Issues and described many places. Here are two.

http://www.emanuelis.eu/2010/09/15/mknod-lib-udev-devices-ppp-operation-not-permitted-when-updating-ubuntu-10-04-on-virtual-lxc-machine/
http://johnlewis.ie/lxc-firewall-logging-and-udev-upgrade-in-ubuntu/

This seems like an old, known problem, but I did not find a Launchpad bug, so I'm filing it. The change to /var/lib/lxc/server/config seemed to fix it for me (though then revealing bug 892892 next).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Clint Byrum (clint-fewbar)]

Hello Gary, or anyone else affected,

Accepted lxc into oneiric-proposed, the package will build now and be available in a few hours. Please test and give feedback here. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

[Gary Poster (gary)]

Hi. I'm trying to verify, but lxc-create no longer works for me, probably because of a careless mistake on my part (updating all proposed packages). I'll keep working on it.

[Gary Poster (gary)]

To be clear, lxc-create is still broken after I revert lxc to the current, non-proposed version.

[Gary Poster (gary)]

My lxc is working again (the solution was to clear out the lxc cache).

Unfortunately, it still does not work for me with a fresh lxc--running a lucid container inside an oneiric host. Perhaps the SRU was for running an oneiric container?

Symptoms: as before, during an update, I get this:

Setting up udev (151-12.3) ...
mknod: `/lib/udev/devices/ppp': Operation not permitted

Simply running mknod I get this:

$ sudo mknod /tmp/ppp c 108 0
mknod: `/tmp/ppp': Operation not permitted

Again, my workaround is this: at the bottom of "/var/lib/lxc/server/config" add this snippet:

# Mods to allow udev upgrade
lxc.cgroup.devices.allow = c 108:0 rwm
lxc.cgroup.devices.allow = b 7:0 rwm
lxc.cgroup.devices.allow = c 10:200 rwm

[Serge Hallyn (serge-hallyn)]

Can you show the config file for the freshly created config file which does not allow mknod?

[Gary Poster (gary)]

My apologies, Serge and Clint. I can confirm that this proposed SRU fixes the problem for me, and I don't see any newly introduced problems.

Apparently I had not updated correctly: I was using 0.7.5 -0ubuntu8.2. I see the new config now that I create a new instance with lxc 0.7.5 -0ubuntu8.3.

Thank you.

[Launchpad Janitor (janitor)]

This bug was fixed in the package lxc - 0.7.5-0ubuntu8.3

---------------
lxc (0.7.5-0ubuntu8.3) oneiric-proposed; urgency=low

  * debian/patches/0010-ubuntu-template-allow-mknod.patch:
    Allow mknod for any device (LP: #902190)
 -- Serge Hallyn <email address hidden> Fri, 09 Dec 2011 16:07:12 -0600