Bug 554203

Summary: LXC: /dev/pts needs to be mounted with mount options gid=5,mode=620.
Product: [Fedora] Fedora Reporter: Robin Green <greenrd>
Component: libvirtAssignee: Libvirt Maintainers <libvirt-maint>
Status: CLOSED WONTFIX QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: 14CC: anton, berrange, clalance, crobinso, dougsland, gansalmon, itamar, jforbes, jonathan, kernel-maint, onestero, veillard, virt-maint
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-01-24 16:46:35 EST Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Attachments:
Description Flags
container definition
none
logs from strace none

Description Robin Green 2010-01-10 17:28:04 EST
Created attachment 382883 [details]
container definition

Description of problem:
See summary

Version-Release number of selected component (if applicable):
kernel-PAE-2.6.32.2-18.fc13.i686

How reproducible:
Always

Steps to Reproduce:
1. yum install libvirt lxc mach
2. Put the following in ~/.machrc:
config['defaultroot'] = 'fedora-development-i386-core'
3. mach setup minimal
4. mach yum install coreutils shadow-utils strace nullmodem
5. mach chroot
6. useradd test
7. Exit the chroot
8. Download attached file ptybug.xml
9. virsh --connect lxc:/// define ptybug.xml
10. virsh --connect lxc:/// start ptybug
11. virsh --connect lxc:/// console ptybug
12. su - test
13. strace -f -e trace=none nullmodem -F 0 1

Actual results:
nullmodem 0.0.6 (compiled Jul 27 2009 01:51:15)
Opening port 0
Opening port 1
Reopening, 0, port 0
Process 27 attached
Process 26 suspended
Process 26 resumed
Process 27 detached
--- SIGCHLD (Child exited) @ 0 (0) ---
Open pty failed : Exec format error
Reopening, 1, port 1
Process 28 attached
Process 26 suspended
Process 26 resumed
Process 28 detached
--- SIGCHLD (Child exited) @ 0 (0) ---
Open pty failed : Exec format error
Process 29 attached
Process 26 suspended
Process 26 resumed
Process 29 detached
--- SIGCHLD (Child exited) @ 0 (0) ---
Open pty failed : Exec format error
Process 30 attached
Process 26 suspended
Process 26 resumed
Process 30 detached
--- SIGCHLD (Child exited) @ 0 (0) ---
Open pty failed : Exec format error

Expected results: (taken from run outside the lxc container)
nullmodem 0.0.6 (compiled Jul 27 2009 01:51:15)
Opening port 0
Opening port 1
Reopening, 0, port 0
Reopening, 1, port 1

Additional info:
I used libvirt instead of the lxc command-line tools because of bug 554145 and bug 554164
Comment 1 Oleg Nesterov 2010-03-05 14:15:59 EST
(In reply to comment #0)
>
> 9. virsh --connect lxc:/// define ptybug.xml
> 10. virsh --connect lxc:/// start ptybug
> 11. virsh --connect lxc:/// console ptybug
> 12. su - test

this fails with

    su: incorrect password# id                       
    uid=0(root) gid=0(root) groups=0(root) context=system_u:system_r:virtd_t:s0-s0:c0.c1023

and I don't know how to fix su.

> 13. strace -f -e trace=none nullmodem -F 0 1

if I do the above without su, it fails with EPERM instead
of ENOEXEC.

And, it fails the same way without strace too.

Hmm. According to strace, chown32("/dev/pts/1", 0, 5) returns EPERM
and then nullmodem reports "Open pty failed: Permission denied".

    bash-4.1# touch /tmp/xxx
    bash-4.1# ls -l /tmp/xxx 
    -rw-r--r--. 1 root root 0 Mar  5 13:36 /tmp/xxx
    bash-4.1# chown test:test /tmp/xxx 
    chown: changing ownership of `/tmp/xxx': Operation not permitted

So. it is not clear to me how to reproduce the problem. And sorry,
I do not know how to setup this container environment correctly.

Could you please confirm nullmodem does work without strace?

If yes, please do "strace -ff -o log" and show the resulting log.*
files.

---------------------------------------------------------------------
But. Please note that, since you run "strace -f" under user "test",
any setuid binary will not get the root privs. Probably this explains
the problem, afaics nullmodem needs the help of /usr/libexec/pt_chown.
Comment 2 Robin Green 2010-03-05 15:09:31 EST
I took the Fedora 13 choice when rawhide was forked, and unfortunately LXC is unusable for me on F13 at the moment due to bug 570708. I will come back to this bug after that bug is addressed.
Comment 3 Robin Green 2010-03-13 04:56:59 EST
(In reply to comment #1)
> (In reply to comment #0)
> >
> > 9. virsh --connect lxc:/// define ptybug.xml
> > 10. virsh --connect lxc:/// start ptybug
> > 11. virsh --connect lxc:/// console ptybug
> > 12. su - test
> 
> this fails with
> 
>     su: incorrect password# id                       
>     uid=0(root) gid=0(root) groups=0(root)
> context=system_u:system_r:virtd_t:s0-s0:c0.c1023

> 
> and I don't know how to fix su.

Hmm, strange. I don't encounter this error. Maybe an SELinux issue? (SELinux is disabled on my machine.)

> > 13. strace -f -e trace=none nullmodem -F 0 1
> 
> if I do the above without su, it fails with EPERM instead
> of ENOEXEC.

This bug only occurs when you run as non-root. EPERM might also be an SELinux issue?

> Could you please confirm nullmodem does work without strace?

Yes, reconfirmed.
 
> If yes, please do "strace -ff -o log" and show the resulting log.*
> files.

I will attach them momentarily.

> 
> ---------------------------------------------------------------------
> But. Please note that, since you run "strace -f" under user "test",
> any setuid binary will not get the root privs. Probably this explains
> the problem, afaics nullmodem needs the help of /usr/libexec/pt_chown.    

No, it doesn't explain the problem, because nullmodem does work as user test without strace. It also works when run under strace, but not inside LXC.
Comment 4 Robin Green 2010-03-13 04:58:43 EST
Created attachment 399815 [details]
logs from strace
Comment 5 Oleg Nesterov 2010-03-13 07:19:47 EST
(In reply to comment #3)
> (In reply to comment #1)
> > ---------------------------------------------------------------------
> > But. Please note that, since you run "strace -f" under user "test",
> > any setuid binary will not get the root privs. Probably this explains
> > the problem, afaics nullmodem needs the help of /usr/libexec/pt_chown.    
> 
> No, it doesn't explain the problem,

it does ;) please look into the logs. Like I expected, nullmodem
failed to chown32("/dev/pts/1", 500, 5) (see log.30) and it spawns
the suid pt_chown to do this. But since this all runs under strace,
pt_chown starts without root privileges and therefore it can't help.

> because nullmodem does work as user test
> without strace.

See above. Say, /bin/mount, won't work under strace too. Any suid
app won't work, this is correct. 

> It also works when run under strace, but not inside LXC.

So the question is: how to setup the devpts magic properly
inside LXC so that pt_exec is not needed. But I  know nothing
about this.

To be absolutely sure, please do "chmod u-s /usr/libexec/pt_chown"
_inside_ lxc, then run nullmodem without strace.
Comment 6 Robin Green 2010-03-13 19:57:48 EST
(In reply to comment #5) 
> So the question is: how to setup the devpts magic properly
> inside LXC so that pt_exec is not needed.

Ah, yes, you're right. Sorry.

> To be absolutely sure, please do "chmod u-s /usr/libexec/pt_chown"
> _inside_ lxc, then run nullmodem without strace.    

Indeed, it doesn't work when I do that, as you expected.

After some work, I found out that the problem is very similar to the one described in bug 506219. Summary: /dev/pts needs to be mounted with mount options gid=5,mode=620.

Since libvirt is responsible for mounting the private /dev/pts (and nothing else changes the mount options) I've changed the component of this bug to libvirt. Please reassign this bug to an appropriate owner, as I don't have privileges to do that.
Comment 7 Robin Green 2010-10-12 13:09:35 EDT
This bug still exists in libvirt-0.8.3-2.fc14.i686 on Fedora 14 (see comment#6 above for how to fix).
Comment 8 Daniel Berrange 2011-02-23 07:04:02 EST
This is fixed in libvirt GIT now

http://libvirt.org/git/?p=libvirt.git;a=commit;h=08fb2a9ce855c6ed1042e451fb4dfc6664a77d64
Comment 9 Fedora Admin XMLRPC Client 2011-09-22 13:59:44 EDT
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 10 Fedora Admin XMLRPC Client 2011-09-22 14:03:29 EDT
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 11 Fedora Admin XMLRPC Client 2011-11-30 15:00:18 EST
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 12 Fedora Admin XMLRPC Client 2011-11-30 15:00:49 EST
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 13 Fedora Admin XMLRPC Client 2011-11-30 15:05:56 EST
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 14 Fedora Admin XMLRPC Client 2011-11-30 15:06:02 EST
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 15 Cole Robinson 2012-01-24 16:46:35 EST
F14 is EOL, please reopen if this is still relevant in a more recent fedora.