Date: Sun, 16 Jun 2019 17:34:09 +0200
From: Daniel Kulesz <daniel.ina1@googlemail.com>
To: Chloe Kudryavtsev <toast@toastin.space>
Cc: alpine-user@lists.alpinelinux.org
Subject: Re: [alpine-user] liblxc segfaults when trying to start
 unprivileged container
Message-Id: <20190616173409.0a99d8d8aa40165b1e1eec1d@googlemail.com>
In-Reply-To: <d8dcca4f-4cb0-ee45-31b0-d497907a016f@toastin.space>
References: <20190304235659.b64e6019003b26b4edcb2a67@googlemail.com>
	<988908273.7812074.1553849007859@mail.yahoo.com>
	<d8dcca4f-4cb0-ee45-31b0-d497907a016f@toastin.space>
Precedence: list
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

Hi Chloe,

thank you for pointing this out (and sorry for taking so long to thank and answer you)! It seems there are various opinions whether enabling this option is insecure or not:

https://security.stackexchange.com/questions/209529/what-does-enabling-kernel-unprivileged-userns-clone-do

Would you argue that running unprivileged containers as root is more secure than enabling this option and running unprivileged containers as non-root?

Cheers, Daniel


P.S.
I found a promising tutorial for running unprivileged containers as root:

https://blog.benoitblanchon.fr/lxc-unprivileged-container/


On Fri, 29 Mar 2019 13:21:21 -0400
Chloe Kudryavtsev <toast@toastin.space> wrote:

> On 3/29/2019 4:43 AM, paul gauret wrote:
> > in my case doing everything with root.
> >> Privileged containers work just fine.
> 
> We're missing kernel.unprivileged_userns_clone for whatever reason.
> You have to enable that to run things as non-root (which I suspect 
> you're trying to do).
> 
> Spun up a VM to test: unprivileged containers are just fine as root, but 
> not as a user (in the latter case you get a segfault - likely because an 
> unprivileged user is trying to userns clone without having the right to :) )
> 
> I suppose the question now becomes "why are we missing that option".
> 
> In the interim, feel free to have root-owned unprivileged containers 
> (you can give root subuids just like everywhere else, and everything 
> ends up running as UID 100000 or whatever you use).
> 
> 
> ---
> Unsubscribe:  alpine-user+unsubscribe@lists.alpinelinux.org
> Help:         alpine-user+help@lists.alpinelinux.org
> ---
> 




---
Unsubscribe:  alpine-user+unsubscribe@lists.alpinelinux.org
Help:         alpine-user+help@lists.alpinelinux.org
---