checksecurity shows find: ‘/dev/.lxd-mounts’: Permission denied in lxd container

Bug #2043521 reported by Mitchell Dzurick
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
checksecurity (Ubuntu)
New
Undecided
Unassigned

Bug Description

in an LXD container, attempting to use checksecurity will result in the string being printed:
find: ‘/dev/.lxd-mounts’: Permission denied

repro:

$ lxc launch ubuntu-daily:noble n
$ lxc shell n
# apt install -y checksecurity
# checksecurity
...
find: ‘/dev/.lxd-mounts’: Permission denied
...

This comes from the extension check-setuid

```
root@n:~# checksecurity -debug
Checking plugin DISKFREE
Executing plugin diskfree (/usr/share/checksecurity/check-diskfree)
Checking plugin IPTABLES-LOGS
Plugin IPTABLES-LOGS Disabled
Value was
Checking plugin PASSWD
Executing plugin passwd (/usr/share/checksecurity/check-passwd)
Checking plugin SETUID
Executing plugin setuid (/usr/share/checksecurity/check-setuid)
find: ‘/dev/.lxd-mounts’: Permission denied
Checking plugin SOCKETS
Executing plugin sockets (/usr/share/checksecurity/check-sockets)
```

Debugging further:

# sed '30s/^/set -x\n/' -i /usr/share/checksecurity/check-setuid
# checksecurity
...
+ ionice -t -c3 find / /dev /dev/lxd /dev/.lxd-mounts /snap /run/snapd/ns/lxd.mnt -ignore_readdir_race -xdev ( -false ) -prune -o ( -type f -perm /06000 -o ( ( -type b -o -type c ) -a -not ( -false ) ) ) -printf %8i %5m %3n %-10u %-10g %9s %t %h/%f\n
find: ‘/dev/.lxd-mounts’: Permission denied
...

Revision history for this message
Mitchell Dzurick (mitchdz) wrote :

I don't have time to fix this, just reporting an issue I noticed during the noble merge.

description: updated
Revision history for this message
Sergio Durigan Junior (sergiodj) wrote :

I believe the title and description should be adjusted to clarify that this happens in LXD containers, not LXC (which are different types of containers).

Revision history for this message
Mitchell Dzurick (mitchdz) wrote :

Ah my bad, I've been using those terms interchangeably. Thanks Sergio! I'll update it.

summary: - checksecurity shows find: ‘/dev/.lxd-mounts’: Permission denied in lxc
+ checksecurity shows find: ‘/dev/.lxd-mounts’: Permission denied in lxd
container
description: updated
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.