Don't attempt to create devices in LXC containers

[Stéphane Graber]

Right now the "makedev" postinst script will attempt to create a number of devices in /dev, failing the package upgrade should any of those mknod calls fail.

LXC containers, especially unprivileged ones do not allow the use of mknod, making it impossible to upgrade makedev in those containers and preventing Ubuntu release upgrades.

The fix is quite simple, detect that we are running in an LXC container and skip the rest of the postinst script as is done in a number of other cases.

= SRU
== Rationale
This issue prevents release to release upgrades in unprivileged LXC containers when makedev is part of the upgraded set. This is currently visible when upgrading from Ubuntu 12.04 to Ubuntu 14.04.

== Testcase
Install the new package in an unprivileged container. With LXD, simply use "lxc launch ubuntu:<series> test" to create the container.

Prior to this fix, the upgrade will fail on some mknod errors, after it, it'll go on after printing a message indicating that LXC was detected.

== Regression potential
The detection logic is based on PID 1's environment containing a container=lxc entry. If a non-LXC system somehow had that set, it'd lead to the makedev upgrade no longer creating extra devices. This is unlikely to really matter though since the system is clearly already functioning properly at that point.

Similarly, some privileged LXC containers can be configured in a way where mknod is possible, this update will still disable the postinst for those cases as short of attempting every mknod ahead of time, there is no reliable way to detect any seccomp or apparmor policy in play.

[Dustin Kirkland  (kirkland)]

This needs to be urgently fixed for 12.04, as this bug is blocking upgrades of 12.04 to 14.04 succeeding.

[Launchpad Janitor (janitor)]

This bug was fixed in the package makedev - 2.3.1-93ubuntu2

---------------
makedev (2.3.1-93ubuntu2) zesty; urgency=medium

  * Don't attempt to create /dev devices when inside a container.
    (LP: #1675163)

 -- Stéphane Graber <email address hidden> Wed, 22 Mar 2017 16:38:22 -0400

[Stéphane Graber (stgraber)]

root@zesty:~# apt install makedev
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  makedev
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 24.4 kB of archives.
After this operation, 98.3 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu zesty/universe amd64 makedev all 2.3.1-93ubuntu2 [24.4 kB]
Fetched 24.4 kB in 0s (81.9 kB/s)
Selecting previously unselected package makedev.
(Reading database ... 26514 files and directories currently installed.)
Preparing to unpack .../makedev_2.3.1-93ubuntu2_all.deb ...
Unpacking makedev (2.3.1-93ubuntu2) ...
Setting up makedev (2.3.1-93ubuntu2) ...
LXC container detected, aborting due to LXC managed /dev.
Processing triggers for man-db (2.7.6.1-2) ...
root@zesty:~#

[Stéphane Graber (stgraber)]

Uploaded all the SRUs.

[Robie Basak (racb)]

Hello Stéphane, or anyone else affected,

Accepted makedev into precise-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/makedev/2.3.1-89ubuntu3 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Robie Basak (racb)]

Hello Stéphane, or anyone else affected,

Accepted makedev into trusty-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/makedev/2.3.1-93ubuntu2~ubuntu14.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Robie Basak (racb)]

Hello Stéphane, or anyone else affected,

Accepted makedev into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/makedev/2.3.1-93ubuntu2~ubuntu16.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Robie Basak (racb)]

Hello Stéphane, or anyone else affected,

Accepted makedev into yakkety-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/makedev/2.3.1-93ubuntu2~ubuntu16.10.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed.Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Stéphane Graber (stgraber)]

root@makedev-12-04:~# apt-get dist-upgrade
Reading package lists... Done
Building dependency tree
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  makedev
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 27.7 kB of archives.
After this operation, 0 B of additional disk space will be used.
Do you want to continue [Y/n]?
Get:1 http://archive.ubuntu.com/ubuntu/ precise-proposed/main makedev all 2.3.1-89ubuntu3 [27.7 kB]
Fetched 27.7 kB in 0s (93.2 kB/s)
(Reading database ... 12624 files and directories currently installed.)
Preparing to replace makedev 2.3.1-89ubuntu2 (using .../makedev_2.3.1-89ubuntu3_all.deb) ...
Unpacking replacement makedev ...
Setting up makedev (2.3.1-89ubuntu3) ...
LXC container detected, aborting due to LXC managed /dev.
root@makedev-12-04:~#

So Ubuntu 12.04 looks good.

[Stéphane Graber (stgraber)]

root@makedev-14-04:~# apt install makedev
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  makedev
1 upgraded, 0 newly installed, 0 to remove and 3 not upgraded.
Need to get 24.5 kB of archives.
After this operation, 1024 B of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty-proposed/main makedev all 2.3.1-93ubuntu2~ubuntu14.04.1 [24.5 kB]
Fetched 24.5 kB in 0s (66.7 kB/s)

(Reading database ... 14748 files and directories currently installed.)
Preparing to unpack .../makedev_2.3.1-93ubuntu2~ubuntu14.04.1_all.deb ...
Unpacking makedev (2.3.1-93ubuntu2~ubuntu14.04.1) over (2.3.1-93ubuntu1) ...
Setting up makedev (2.3.1-93ubuntu2~ubuntu14.04.1) ...
LXC container detected, aborting due to LXC managed /dev.
root@makedev-14-04:~#

Ubuntu 14.04 too.

[Stéphane Graber (stgraber)]

root@makedev-16-04:~# apt install makedev
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following packages will be upgraded:
  makedev
1 upgraded, 0 newly installed, 0 to remove and 12 not upgraded.
Need to get 24.4 kB of archives.
After this operation, 29.7 kB disk space will be freed.
Get:1 http://archive.ubuntu.com/ubuntu xenial-proposed/main amd64 makedev all 2.3.1-93ubuntu2~ubuntu16.04.1 [24.4 kB]
Fetched 24.4 kB in 0s (55.5 kB/s)
(Reading database ... 13025 files and directories currently installed.)
Preparing to unpack .../makedev_2.3.1-93ubuntu2~ubuntu16.04.1_all.deb ...
Unpacking makedev (2.3.1-93ubuntu2~ubuntu16.04.1) over (2.3.1-93ubuntu1) ...
Setting up makedev (2.3.1-93ubuntu2~ubuntu16.04.1) ...
LXC container detected, aborting due to LXC managed /dev.
root@makedev-16-04:~#

Ubuntu 16.04 too.

[Stéphane Graber (stgraber)]

root@makedev-16-10:~# apt install makedev
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  makedev
0 upgraded, 1 newly installed, 0 to remove and 15 not upgraded.
Need to get 24.4 kB of archives.
After this operation, 98.3 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu yakkety-proposed/universe amd64 makedev all 2.3.1-93ubuntu2~ubuntu16.10.1 [24.4 kB]
Fetched 24.4 kB in 0s (56.8 kB/s)
Selecting previously unselected package makedev.
(Reading database ... 13163 files and directories currently installed.)
Preparing to unpack .../makedev_2.3.1-93ubuntu2~ubuntu16.10.1_all.deb ...
Unpacking makedev (2.3.1-93ubuntu2~ubuntu16.10.1) ...
Setting up makedev (2.3.1-93ubuntu2~ubuntu16.10.1) ...
LXC container detected, aborting due to LXC managed /dev.
root@makedev-16-10:~#

Ubuntu 16.10 too.

[Stéphane Graber (stgraber)]

root@makedev-17-04:~# apt install makedev
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following NEW packages will be installed:
  makedev
0 upgraded, 1 newly installed, 0 to remove and 23 not upgraded.
Need to get 24.4 kB of archives.
After this operation, 98.3 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu zesty/universe amd64 makedev all 2.3.1-93ubuntu2 [24.4 kB]
Fetched 24.4 kB in 0s (91.9 kB/s)
Selecting previously unselected package makedev.
(Reading database ... 13236 files and directories currently installed.)
Preparing to unpack .../makedev_2.3.1-93ubuntu2_all.deb ...
Unpacking makedev (2.3.1-93ubuntu2) ...
Setting up makedev (2.3.1-93ubuntu2) ...
LXC container detected, aborting due to LXC managed /dev.
root@makedev-17-04:~#

Ubuntu 17.04 too.

[Stéphane Graber (stgraber)]

Marking the SRU as verification-done.
I've also confirmed that the SRU when installed outside of a container doesn't skip the device creation code and so doesn't regress it's usual behavior in that regard.

[Stéphane Graber (stgraber)]

The verification of the Stable Release Update for makedev has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package makedev - 2.3.1-93ubuntu2~ubuntu14.04.1

---------------
makedev (2.3.1-93ubuntu2~ubuntu14.04.1) trusty; urgency=medium

  * Don't attempt to create /dev devices when inside a container.
    (LP: #1675163)

 -- Stéphane Graber <email address hidden> Wed, 22 Mar 2017 16:38:22 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package makedev - 2.3.1-93ubuntu2~ubuntu16.10.1

---------------
makedev (2.3.1-93ubuntu2~ubuntu16.10.1) yakkety; urgency=medium

  * Don't attempt to create /dev devices when inside a container.
    (LP: #1675163)

 -- Stéphane Graber <email address hidden> Wed, 22 Mar 2017 16:38:22 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package makedev - 2.3.1-89ubuntu3

---------------
makedev (2.3.1-89ubuntu3) precise; urgency=medium

  * Don't attempt to create /dev devices when inside a container.
    (LP: #1675163)

 -- Stéphane Graber <email address hidden> Fri, 24 Mar 2017 02:12:05 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package makedev - 2.3.1-93ubuntu2~ubuntu16.04.1

---------------
makedev (2.3.1-93ubuntu2~ubuntu16.04.1) xenial; urgency=medium

  * Don't attempt to create /dev devices when inside a container.
    (LP: #1675163)

 -- Stéphane Graber <email address hidden> Wed, 22 Mar 2017 16:38:22 -0400

[Andy Buchanan (andy-buchanans)]

The fix doesn't appear to be working for me on xenial. Package being installed is the one shown above as having the fix, but I still get this error:

user@ubuntu:~$ sudo apt install makedev
sudo: unable to resolve host ubuntu
Reading package lists... Done
Building dependency tree
Reading state information... Done
makedev is already the newest version (2.3.1-93ubuntu2~ubuntu16.04.1).
0 upgraded, 0 newly installed, 0 to remove and 59 not upgraded.
1 not fully installed or removed.
After this operation, 0 B of additional disk space will be used.
Do you want to continue? [Y/n]
Setting up makedev (2.3.1-93ubuntu2~ubuntu16.04.1) ...
mknod: mem-: Operation not permitted
makedev mem c 1 1 root kmem 0640: failed
mknod: kmem-: Operation not permitted
makedev kmem c 1 2 root kmem 0640: failed
mknod: null-: Operation not permitted
makedev null c 1 3 root root 0666: failed
mknod: port-: Operation not permitted
makedev port c 1 4 root kmem 0640: failed
mknod: zero-: Operation not permitted
makedev zero c 1 5 root root 0666: failed
mknod: full-: Operation not permitted
makedev full c 1 7 root root 0666: failed
mknod: random-: Operation not permitted
makedev random c 1 8 root root 0666: failed
mknod: urandom-: Operation not permitted
makedev urandom c 1 9 root root 0666: failed
mknod: tty-: Operation not permitted
makedev tty c 5 0 root tty 0666: failed
mknod: ram0-: Operation not permitted
makedev ram0 b 1 0 root disk 0660: failed
mknod: ram1-: Operation not permitted
makedev ram1 b 1 1 root disk 0660: failed
mknod: ram2-: Operation not permitted
makedev ram2 b 1 2 root disk 0660: failed
mknod: ram3-: Operation not permitted
makedev ram3 b 1 3 root disk 0660: failed
mknod: ram4-: Operation not permitted
makedev ram4 b 1 4 root disk 0660: failed
mknod: ram5-: Operation not permitted
makedev ram5 b 1 5 root disk 0660: failed
mknod: ram6-: Operation not permitted
makedev ram6 b 1 6 root disk 0660: failed
mknod: ram7-: Operation not permitted
makedev ram7 b 1 7 root disk 0660: failed
mknod: ram8-: Operation not permitted
makedev ram8 b 1 8 root disk 0660: failed
mknod: ram9-: Operation not permitted
makedev ram9 b 1 9 root disk 0660: failed
mknod: ram10-: Operation not permitted
makedev ram10 b 1 10 root disk 0660: failed
mknod: ram11-: Operation not permitted
makedev ram11 b 1 11 root disk 0660: failed
mknod: ram12-: Operation not permitted
makedev ram12 b 1 12 root disk 0660: failed
mknod: ram13-: Operation not permitted
makedev ram13 b 1 13 root disk 0660: failed
mknod: ram14-: Operation not permitted
makedev ram14 b 1 14 root disk 0660: failed
mknod: ram15-: Operation not permitted
makedev ram15 b 1 15 root disk 0660: failed
mknod: ram16-: Operation not permitted
makedev ram16 b 1 16 root disk 0660: failed
mknod: loop0-: Operation not permitted
makedev loop0 b 7 0 root disk 0660: failed
mknod: loop1-: Operation not permitted
makedev loop1 b 7 1 root disk 0660: failed
mknod: loop2-: Operation not permitted
makedev loop2 b 7 2 root disk 0660: failed
mknod: loop3-: Operation not permitted
makedev loop3 b 7 3 root disk 0660: failed
mknod: loop4-: Operation not permitted
makedev loop4 b 7 4 root disk 0660: failed
mknod: loop5-: Operation not permitted
ma...

[Andy Buchanan (andy-buchanans)]

I've found the issue. My container is not LXC, it's supplied by elastichosts.com, a cloud provider, and must be based on some other containerization technology.

/proc/1/environ does not contain container=lxc as checked for by the postinit script in makedev, but it does have container=contain in it.

[Britlion (britlion)]

EH uses Arachsys contain for their containers - this is based on the same kernel cgroups technology as LXC, but aims to be more lightweight.

If it's a bug not to detect LXC, it's logically a bug not to detect other container systems that work the same way, and makedev should include this as a second option to test against.

[Britlion (britlion)]

( link https://github.com/arachsys/containers )

[Joel Garboden (joelgarboden)]

I have "container=zone" on LX-Ubuntu 16.04 on Joyent's Triton private cloud

root@ops-b3-jenkins01:~# apt-get install makedev
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following held packages will be changed:
  makedev
The following packages will be upgraded:
  makedev
1 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
1 not fully installed or removed.
Need to get 0 B/24.4 kB of archives.
After this operation, 29.7 kB disk space will be freed.
Do you want to continue? [Y/n]
(Reading database ... 27263 files and directories currently installed.)
Preparing to unpack .../makedev_2.3.1-93ubuntu2~ubuntu16.04.1_all.deb ...
Unpacking makedev (2.3.1-93ubuntu2~ubuntu16.04.1) over (2.3.1-93ubuntu1) ...
Processing triggers for man-db (2.7.5-1) ...
Setting up makedev (2.3.1-93ubuntu2~ubuntu16.04.1) ...
mknod: mem-: Operation not permitted
makedev mem c 1 1 root kmem 0640: failed
mknod: kmem-: Operation not permitted
makedev kmem c 1 2 root kmem 0640: failed
mknod: null-: Operation not permitted
makedev null c 1 3 root root 0666: failed
mknod: port-: Operation not permitted
makedev port c 1 4 root kmem 0640: failed
mknod: zero-: Operation not permitted
makedev zero c 1 5 root root 0666: failed
mknod: full-: Operation not permitted
makedev full c 1 7 root root 0666: failed
mknod: random-: Operation not permitted
makedev random c 1 8 root root 0666: failed
mknod: urandom-: Operation not permitted
makedev urandom c 1 9 root root 0666: failed
mknod: tty-: Operation not permitted
makedev tty c 5 0 root tty 0666: failed
mknod: ram0-: Operation not permitted
makedev ram0 b 1 0 root disk 0660: failed
mknod: ram1-: Operation not permitted
makedev ram1 b 1 1 root disk 0660: failed
mknod: ram2-: Operation not permitted
makedev ram2 b 1 2 root disk 0660: failed
mknod: ram3-: Operation not permitted
makedev ram3 b 1 3 root disk 0660: failed
mknod: ram4-: Operation not permitted
makedev ram4 b 1 4 root disk 0660: failed
mknod: ram5-: Operation not permitted
makedev ram5 b 1 5 root disk 0660: failed
mknod: ram6-: Operation not permitted
makedev ram6 b 1 6 root disk 0660: failed
mknod: ram7-: Operation not permitted
makedev ram7 b 1 7 root disk 0660: failed
mknod: ram8-: Operation not permitted
makedev ram8 b 1 8 root disk 0660: failed
mknod: ram9-: Operation not permitted
makedev ram9 b 1 9 root disk 0660: failed
mknod: ram10-: Operation not permitted
makedev ram10 b 1 10 root disk 0660: failed
mknod: ram11-: Operation not permitted
makedev ram11 b 1 11 root disk 0660: failed
mknod: ram12-: Operation not permitted
makedev ram12 b 1 12 root disk 0660: failed
mknod: ram13-: Operation not permitted
makedev ram13 b 1 13 root disk 0660: failed
mknod: ram14-: Operation not permitted
makedev ram14 b 1 14 root disk 0660: failed
mknod: ram15-: Operation not permitted
makedev ram15 b 1 15 root disk 0660: failed
mknod: ram16-: Operation not permitted
makedev ram16 b 1 16 root disk 0660: failed
mknod: loop0-: Operation not permitted
makedev loop0 b 7 0 root disk 0660: failed
mknod: loop1-: Operation not permitted
makedev loop1 b 7 1 root disk 0660: failed
mknod: loop2-: Operation not permitted
makedev loop2 b 7 2 root d...

[Andre Schuurman (uiuntu-one)]

Not detecting arachsys containers is a high impact bug. My production servers running on Ubuntu 16.04 can no longer be updated anymore as apt is stuck on applying the makedev package which of course always fails.

I understand it is cumbersome to add all possible container types to the script. Maybe the makedev script needs to be more specific when it should run. Giving the remark in the package:

 This package is not necessary for most modern Linux systems, where the udev
 subsystem provides a more dynamic mechanism for device file management.

This means if udev is installed and don't run the script.

Andre

[Clint Armstrong (clint-f)]

This also affects containers running in systemd-nspawn containers

[Matthias Klumpp (ximion)]

FWIW, I ran into that issue today as well, and it was really annoying. So I fixed in in Debian in a generic way, so this should work for every container solution out there.
It requires systemd-detect-virt (systemd) to be installed prior to installing makedev though (which usually is the case).