permission denied in "/var/lib/lxcfs/cgroup/[memory-blkio-devices]" when querying /var with command such as : find,du,ls, ...

[Eric Desrochers]

[Impact]

 * Getting a permission denied when querying "/var" using commands such as : find, du, ls, .... complaining about permission denied in "/var/lib/lxcfs/cgroup/[memory-blkio-devices]"

[Test Case]

 * On a Xenial/Zesty machine with lxcfs installed (<=2.0.5-0ubuntu1~ubuntu16.04.1)

# find /var -name "foo"
..
find: ‘/var/lib/lxcfs/cgroup/devices/user.slice/user-0.slice/devices.allow’: Permission denied
find: ‘/var/lib/lxcfs/cgroup/devices/user.slice/user-0.slice/devices.deny’: Permission denied
find: ‘/var/lib/lxcfs/cgroup/devices/user.slice/user-0.slice/[e-mail]/devices.allow’: Permission denied
...

# du -hs /var
..
du: cannot access '/var/lib/lxcfs/cgroup/devices/user.slice/user-0.slice/[e-mail]/devices.deny': Permission denied
du: cannot access '/var/lib/lxcfs/cgroup/devices/user.slice/user-0.slice/session-27.scope/devices.allow': Permission denied
36G /var
..

# ls -altr /var/lib/lxcfs/cgroup/devices/
ls: cannot access '/var/lib/lxcfs/cgroup/devices/devices.allow': Permission denied
ls: cannot access '/var/lib/lxcfs/cgroup/devices/devices.deny': Permission denied
total 0
?????????? ? ? ? ? ? devices.deny
?????????? ? ? ? ? ? devices.allow

[Regression Potential]

 * None expected, change is trivial and already in lxcfs GitHub upstream src code
[https://github.com/lxc/lxcfs]

[Other Info]

 * Commit ID : 4117b6c bindings: allow getattr on O_WRONLY files
 * Commit URL : https://github.com/lxc/lxcfs/commit/4117b6ca6091d811581e236f5fc2d62d12c11c4e

[Eric Desrochers (slashd)]

After having apply the upstream commit[1]:

# du -hs /var
36G /var

# find /var -name "foo"

# ls -altr /var/lib/lxcfs/cgroup/devices/
total 0
drwxr-xr-x 2 root root 0 Jan 13 08:28 ..
drwxr-xr-x 2 root root 0 Jan 13 08:28 .
-rw-r--r-- 1 root root 0 Jan 13 08:28 tasks
-rw-r--r-- 1 root root 0 Jan 13 08:28 cgroup.procs
--w------- 1 root root 0 Jan 13 08:28 devices.allow
-rw-r--r-- 1 root root 0 Jan 13 08:28 release_agent
-rw-r--r-- 1 root root 0 Jan 13 08:28 cgroup.clone_children
-r--r--r-- 1 root root 0 Jan 13 08:28 cgroup.sane_behavior
-rw-r--r-- 1 root root 0 Jan 13 08:28 notify_on_release
--w------- 1 root root 0 Jan 13 08:28 devices.deny
-r--r--r-- 1 root root 0 Jan 13 08:28 devices.list
drwxr-xr-x 2 root root 0 Jan 13 08:28 machine
drwxr-xr-x 2 root root 0 Jan 13 08:28 init.scope
drwxr-xr-x 2 root root 0 Jan 13 08:28 system.slice
drwxr-xr-x 2 root root 0 Jan 13 08:28 user.slice

[1] - 4117b6c bindings: allow getattr on O_WRONLY files

[Eric Desrochers (slashd)]

Disregard this bug after more testing "2.0.5-0ubuntu1~ubuntu16.04.1" doesn't exhibit the problem.
Was confused switching from one Xenial to another with different lxcfs version.

[Eric Desrochers (slashd)]

Bug was fix in lxcfs (2.0.4-0ubuntu1~ubuntu16.04.1)

debian/changelog :

lxcfs (2.0.4-0ubuntu1~ubuntu16.04.1) xenial; urgency=medium
...
- bindings: enable access to /var/lib/lxcfs/cgroup
...

[Christopher M. Balz (christopherbalz)]

I apparently still get this bug in lxcfs `2.0.8-0ubuntu1~16.04.2`. This user also gets this bug in a version where it is alleged to have been fixed: https://github.com/bit-team/backintime/issues/782

[neeraj (ngneerajgupta1)]

i am still getting issue in 3.0.3
in ubuntu 18.04