Bug 1379852
Summary: | SPC - Cannot restart host operating from container | |||
---|---|---|---|---|
Product: | Red Hat Enterprise Linux 7 | Reporter: | davis phillips <dphillip> | |
Component: | systemd | Assignee: | Lukáš Nykrýn <lnykryn> | |
Status: | CLOSED ERRATA | QA Contact: | Frantisek Sumsal <fsumsal> | |
Severity: | high | Docs Contact: | ||
Priority: | urgent | |||
Version: | 7.2 | CC: | bblaskov, bbreard, dphillip, dwalsh, fsumsal, mkolaja, msekleta, ovasik, riek, scollier, snagar, systemd-maint-list | |
Target Milestone: | rc | Keywords: | EasyFix, Patch, ZStream | |
Target Release: | --- | |||
Hardware: | All | |||
OS: | Unspecified | |||
Whiteboard: | ||||
Fixed In Version: | systemd-219-31.el7 | Doc Type: | If docs needed, set a value | |
Doc Text: | Story Points: | --- | ||
Clone Of: | ||||
: | 1384523 1390601 1391383 (view as bug list) | Environment: | ||
Last Closed: | 2017-08-01 09:09:52 UTC | Type: | Bug | |
Regression: | --- | Mount Type: | --- | |
Documentation: | --- | CRM: | ||
Verified Versions: | Category: | --- | ||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | ||
Cloudforms Team: | --- | Target Upstream Version: | ||
Embargoed: | ||||
Bug Depends On: | ||||
Bug Blocks: | 1166465, 1383699, 1384523, 1390601, 1391383 |
Description
davis phillips
2016-09-27 21:04:11 UTC
As for the container check, would it make sense to check for /.dockerenv or /.dockerinit in the running_in_chroot function? Only if you want to only ever run under docker. Why would you want to check if you are running in a container? Looking at systemd/systemctl code it looks like it is checking if the processes is running in a container and then blocking certain access. We want to allow processes inside of a privileged contianer to interact with systemd on the host. There needs to be a way to bypass this check. On an atomic host there is no way to ship software other then a container, and we need to ship software that manages systemd. We disallow that because in general case talking to PID 1 from chroot is not what you want, e.g. PID 1 operates on different set of unit files than you can see in the chroot environment. However, in cases when you know what you are doing we should allow people to shoot them self into the foot (doesn't apply here because you just want to reboot). I discussed this issue with Lennart on systemd.conf and he proposed that we add new environment variable (SYSTEMCTL_ALLOW_CHROOT or so) and if set chroot check will be skipped. That works for me. We need this in Fedora and RHEL though. Tentative devel_ack for 7.4. But it needs to get to upstream first. Lukáš any chance of getting this prior to 7.4? I think we should be able the get it into upstream soon, the patch is trivial although pretty "annoying", all systemd binaries use the same function for parsing environment variables and systemctl will need something extra. But tomorrow is my Upstream Friday so I will try to come with pull request. And then we can pack it to the next z-stream, probably batch 1, if everything goes well. Awesome! Thanks so much Lukáš! fix pushed to staging -> https://github.com/lnykryn/systemd-rhel/commit/f3750cbfd21b2e5f6f46077082f60e3a74ee4807 -> post Tested and works great! Thanks again! Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2017:2297 |