systemd-nspawn: EPERM mounting sysfs inside container #27994
Description
systemd version the issue has been seen with
253.1, 253.3
Used distribution
NixOS 23.05
Linux kernel version used
5.15.114
CPU architectures issue was seen on
x86_64
Component
systemd-nspawn
Expected behaviour you didn't see
Inside a systemd-nspawn (252.5, which is good) container:
$ ip netns add test
$ ip netns exec test ip a
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
$ mount -t sysfs sysfs /sys
strace on ip netns exec test ip a shows it succeeded in mounting sysfs:
mount("", "/", 0x5620045b885f, MS_REC|MS_SLAVE, NULL) = 0
umount2("/sys", MNT_DETACH) = -1 EINVAL (Invalid argument)
statfs("/sys", {f_type=TMPFS_MAGIC, f_bsize=4096, f_blocks=1024, f_bfree=1024, f_bavail=1024, f_files=1024, f_ffree=1015, f_fsid={val=[2821066525, 2097802640]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_RDONLY|ST_NOSUID|ST_NODEV|ST_NOEXEC|ST_RELATIME}) = 0
mount("test", "/sys", "sysfs", MS_RDONLY, NULL) = 0
Unexpected behaviour you saw
Inside a systemd-nspawn (253.1 or 253.3, which are not good) container:
$ ip netns add test
$ ip netns exec test ip a
mount of /sys failed: Operation not permitted
$ mount -t sysfs sysfs /sys
mount: /sys: permission denied.
strace on ip netns exec test ip a shows it failed at mounting sysfs:
mount("", "/", 0x559c6e10f85f, MS_REC|MS_SLAVE, NULL) = 0
umount2("/sys", MNT_DETACH) = -1 EINVAL (Invalid argument)
statfs("/sys", {f_type=TMPFS_MAGIC, f_bsize=4096, f_blocks=1024, f_bfree=1024, f_bavail=1024, f_files=1024, f_ffree=1015, f_fsid={val=[2350213845, 934180118]}, f_namelen=255, f_frsize=4096, f_flags=ST_VALID|ST_RDONLY|ST_NOSUID|ST_NODEV|ST_NOEXEC|ST_RELATIME}) = 0
mount("test", "/sys", "sysfs", MS_RDONLY, NULL) = -1 EPERM (Operation not permitted)
write(2, "mount of /sys failed: Operation "..., 46mount of /sys failed: Operation not permitted
) = 46
exit_group(-1) = ?
+++ exited with 255 +++
Steps to reproduce the problem
- Set up a fresh container:
debootstrap stable ./container http://deb.debian.org/debian. - Boot with
systemd-nspawn(253.1):systemd-nspawn -b --private-network --private-users=pick -M container. - Inside the container, install
iproute2and execute the commands:ip netns add test ip netns exec test ip a mount -t sysfs sysfs /sys
I noticed when strace systemd-nspawn itself that 252.5 uses chroot while 253.1 uses pivot_root, which suggests it might be related to 57c10a5 (cc @brauner).
Additional program output to the terminal or log subsystem illustrating the issue
No response