User namespace is not enabled in raring kernel

[golubovsky]

lxc-checkconfig reports that user namespace is missing in raring.

uname -a:

Linux example 3.8.0-25-generic #37-Ubuntu SMP Thu Jun 6 20:47:30 UTC 2013 i686 athlon i686 GNU/Linux

/proc/version_signature:

Ubuntu 3.8.0-25.37-generic 3.8.13

lspci output: N/A (lspci not installed in this configuration)

lxc-checkconfig:

root@example:/# lxc-checkconfig
Kernel configuration not found at /proc/config.gz; searching...
Kernel configuration found at /boot/config-3.8.0-25-generic
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: missing
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup namespace: required
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
File capabilities: enabled

Note : Before booting a new kernel, you can check its configuration
usage : CONFIG=/path/to/config /usr/bin/lxc-checkconfig

This may be caused by the kernel config used in this package:

CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y

that is, CONFIG_USER_NS was not selected in the kernel configuration.

For comparison, similar section in the kernel config of 64-bit Precise (12.04) looks as follows:

CONFIG_NAMESPACES=y
CONFIG_UTS_NS=y
CONFIG_IPC_NS=y
CONFIG_USER_NS=y
CONFIG_PID_NS=y
CONFIG_NET_NS=y

As result, lxc-start of a container with lxc.id_map is not possible (clone() returns EINVAL).

Thanks.

[Brad Figg (brad-figg)]

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 1191600

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[golubovsky (golubovsky)]

I am unable to run apport on this installation: it is intended to be a minimal memory-resident Ubuntu base with very limited set of packages, so apport (and its python counterpart) is not to be installed there. Besides, by the nature of the issue being reported, the source of the issue is in the kernel configuration supplied rather than in some software malfunction.

Attached: output of lspci -vnvn.

[golubovsky (golubovsky)]

This is the strace output recorded when trying to start a container with lxc.id_map in config, that is, requiring user namespace. See the second clone() call which fails with EINVAL.

[golubovsky (golubovsky)]

This is the strace output recorded when starting a container without lxc.id_map in config, that s, not requiring user namespace.
All calls to clone are successful.

[golubovsky (golubovsky)]

Earlier, someone reported a similar problem in Quantal:

https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1085684

[Joseph Salisbury (jsalisbury)]

Is this not an issue with the 64 bit kernels?

[Joseph Salisbury (jsalisbury)]

Actually, I see you already stated that in the bug description.

[Joseph Salisbury (jsalisbury)]

Would it be possible for you to test the latest upstream kernel? Refer to https://wiki.ubuntu.com/KernelMainlineBuilds . Please test the latest v3.10 kernel[0].

If this bug is fixed in the mainline kernel, please add the following tag 'kernel-fixed-upstream'.

If the mainline kernel does not fix this bug, please add the tag: 'kernel-bug-exists-upstream'.

If you are unable to test the mainline kernel, for example it will not boot, please add the tag: 'kernel-unable-to-test-upstream'.
Once testing of the upstream kernel is complete, please mark this bug as "Confirmed".

Thanks in advance.

[0] http://kernel.ubuntu.com/~kernel-ppa/mainline/v3.10-rc6-saucy/

[golubovsky (golubovsky)]

This latest v3.10 kernel referred to in the previous comment did not work for me by the same reason: CONFIG_USER_NS was not defined in the build.

It is possible that the following two links explain the reason behind the decision not to enable CONFIG_USER_NS in the 13.04 kernel:

http://lwn.net/Articles/541787/

Posted Mar 7, 2013 14:05 UTC (Thu) by BernardB (subscriber, #47903) [Link]
Okay, having dug deeper, it turns out that the examples require CONFIG_USER_NS. As the article points out, 3.8 was still missing the changes for XFS and other filesystems. Unsurprisingly, Ubuntu 13.04 chose XFS and NFS support over CONFIG_USER_NS. Bummer :P

http://permalink.gmane.org/gmane.linux.kernel.containers.lxc.general/4755

I am going to try the kernel from https://launchpad.net/~ubuntu-lxc/+archive/kernel (“Ubuntu LXC team” team PPA) and will post my results here.

Thanks.

[David Leadbeater (launchpad-net-dgl)]

According to debian/changelog USER_NS was enabled in linux (2.6.32-12.16):
  * [Config] enable USER_NS
    - LP: #480739, #509808

However I don't actually see the config option set anymore (and not even a comment saying it's not set) looking at the current version in saucy: linux-image-3.11.0-13-generic (3.11.0-13.20).

[Joseph Salisbury (jsalisbury)]

This bug was nominated against a series that is no longer supported, ie saucy. The bug task representing the saucy nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Joseph Salisbury (jsalisbury)]

This bug was nominated against a series that is no longer supported, ie raring. The bug task representing the raring nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.