Bug 1379852 - SPC - Cannot restart host operating from container
Summary: SPC - Cannot restart host operating from container
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: systemd
Version: 7.2
Hardware: All
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Lukáš Nykrýn
QA Contact: Frantisek Sumsal
Depends On:
Blocks: 1166465 74systemd 1384523 1390601 1391383
TreeView+ depends on / blocked
Reported: 2016-09-27 21:04 UTC by davis phillips
Modified: 2017-08-01 09:09 UTC (History)
12 users (show)

Fixed In Version: systemd-219-31.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1384523 1390601 1391383 (view as bug list)
Last Closed: 2017-08-01 09:09:52 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:2297 0 normal SHIPPED_LIVE systemd bug fix and enhancement update 2017-08-01 12:40:16 UTC

Description davis phillips 2016-09-27 21:04:11 UTC
Description of problem:
When a container issues a reboot or telinit command regardless of privileged flag settings specifically when --pid=host is provided, the result will always meet a chroot error. 

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Atomic Host release 7.2

How reproducible:

/usr/bin/docker run  --privileged -v /proc/:/hostproc/ -v /sys/fs/cgroup:/sys/fs/cgroup  -v /var/log:/var/log -v /run/systemd:/run/systemd -v /sysroot:/sysroot -v=/var/lib/sss/pipes/:/var/lib/sss/pipes/:rw -v /etc/passwd:/etc/passwd -v /etc/shadow:/etc/shadow -v /tmp:/tmp:rw -v /etc/sysconfig:/etc/sysconfig:rw -v /etc/resolv.conf:/etc/resolv.conf:rw -v /etc/nsswitch.conf:/etc/nsswitch.conf:rw -v /etc/hosts:/etc/hosts:rw -v /etc/hostname:/etc/hostname:rw --env container=docker --net=host  --pid=host openvmtools

with the following Dockerfile:

FROM registry.access.redhat.com/rhel7

RUN yum -y --disablerepo=\* --enablerepo=rhel-7-server-rpms install yum-utils && \
  yum-config-manager --disable \* && \
  yum-config-manager --enable rhel-7-server-rpms && \
  yum clean all

RUN yum -y install file open-vm-tools perl open-vm-tools-deploypkg net-tools && \
yum clean all

CMD /usr/bin/vmtoolsd

Steps to Reproduce:
1. Attempt to customize a VMware virtual machine running Atomic OS 7.2 
2. Use systemd unit file to automate the execution of the container for customization
3. The final step of the customization issues a telinit 0

Actual results:
Running in chroot, ignoring request.

Expected results:
Rebooted VM with properly applied networking configuration.

Additional info:
Please refer to the following bugzilla for more information concerning the hows and whys - 

I dug into the systemd a little and here are the excerpts in question:

line 8050

        if (arg_action != ACTION_SYSTEMCTL && running_in_chroot() > 0) {
                log_info("Running in chroot, ignoring request.");
                r = 0;
                goto finish;

line 487

int running_in_chroot(void) {
        int ret;

        ret = files_same("/proc/1/root", "/");
        if (ret < 0)
                return ret;

        return ret == 0;

Comment 2 davis phillips 2016-09-27 21:17:07 UTC
As for the container check, would it make sense to check for /.dockerenv or /.dockerinit in the running_in_chroot function?

Comment 3 Daniel Walsh 2016-09-27 21:49:20 UTC
Only if you want to only ever run under docker.  Why would you want to check if you are running in a container?

Comment 4 Daniel Walsh 2016-09-27 22:07:38 UTC
Looking at systemd/systemctl code it looks like it is checking if the processes is running in a container and then blocking certain access.  

We want to allow processes inside of a privileged contianer to interact with systemd on the host.  There needs to be a way to bypass this check.  

On an atomic host there is no way to ship software other then a container, and we need to ship software that manages systemd.

Comment 5 Michal Sekletar 2016-10-04 12:45:28 UTC
We disallow that because in general case talking to PID 1 from chroot is not what you want, e.g. PID 1 operates on different set of unit files than you can see in the chroot environment.

However, in cases when you know what you are doing we should allow people to shoot them self into the foot (doesn't apply here because you just want to reboot).

I discussed this issue with Lennart on systemd.conf and he proposed that we add new environment variable (SYSTEMCTL_ALLOW_CHROOT or so) and if set chroot check will be skipped.

Comment 6 Daniel Walsh 2016-10-06 10:53:46 UTC
That works for me.  We need this in Fedora and RHEL though.

Comment 7 Lukáš Nykrýn 2016-10-06 11:15:11 UTC
Tentative devel_ack for 7.4. But it needs to get to upstream first.

Comment 9 Daniel Walsh 2016-10-13 13:10:15 UTC
Lukáš any chance of getting this prior to 7.4?

Comment 10 Lukáš Nykrýn 2016-10-13 13:22:29 UTC
I think we should be able the get it into upstream soon, the patch is trivial although pretty "annoying", all systemd binaries use the same function for parsing environment variables and systemctl will need something extra.

But tomorrow is my Upstream Friday so I will try to come with pull request.

And then we can pack it to the next z-stream, probably batch 1, if everything goes well.

Comment 11 Lukáš Nykrýn 2016-10-14 08:58:21 UTC

Comment 12 davis phillips 2016-10-14 19:30:50 UTC
Awesome! Thanks so much Lukáš!

Comment 14 Lukáš Nykrýn 2016-10-17 06:37:04 UTC

Comment 17 Lukáš Nykrýn 2016-10-21 15:16:58 UTC
fix pushed to staging -> https://github.com/lnykryn/systemd-rhel/commit/f3750cbfd21b2e5f6f46077082f60e3a74ee4807 -> post

Comment 21 davis phillips 2016-12-09 14:31:15 UTC
Tested and works great! Thanks again!

Comment 26 errata-xmlrpc 2017-08-01 09:09:52 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.