I'm running systemd-259.7-1.fc44.x86_64 and using mkosi to create
"pristine" /usr only verity signed images with hopes of distributing
them for use with unprivileged systemd-nspawn. Using systemd-nspawn as
root works properly, but testing with an unprivileged user fails with:
Failed to issue io.systemd.MountFileSystem.MountImage() varlink call: No
such device or address
Is it possible for unprivileged users to start /usr only systemd-nspawn
instances? I have tried other --volatile options and omitted --volatile
altogether without success.
builduser@buildhost:~$ SYSTEMD_LOG_LEVEL=debug systemd-nspawn
--volatile=yes -nUbi fedora-ci.raw
Loaded shared library 'libmount.so.1' via dlopen().
Loaded shared library 'libseccomp.so.2' via dlopen().
Loaded shared library 'libselinux.so.1' via dlopen().
Can't connect to udev control socket, assuming we are in same netns.
Setting RLIMIT_CPU to infinity.
Setting RLIMIT_FSIZE to infinity.
Setting RLIMIT_DATA to infinity.
Setting RLIMIT_STACK to 8388608:infinity.
Setting RLIMIT_CORE to 0:infinity.
Setting RLIMIT_RSS to infinity.
Setting RLIMIT_NPROC to 125270.
Setting RLIMIT_NOFILE to 1024:524288.
Setting RLIMIT_MEMLOCK to 8388608.
Setting RLIMIT_AS to infinity.
Setting RLIMIT_LOCKS to infinity.
Setting RLIMIT_SIGPENDING to 125270.
Setting RLIMIT_MSGQUEUE to 819200.
Setting RLIMIT_NICE to 0.
Setting RLIMIT_RTPRIO to 0.
Setting RLIMIT_RTTIME to infinity.
Resolved versioned directory pattern
'/home/builduser/mkosi.output/fedora-ci.raw' to file
'/home/builduser/mkosi.output/fedora-ci.raw' as version 'n/a'.
Successfully forked off '(polkit-agent)' as PID 9644.
Skipping PR_SET_MM, as we don't have privileges.
varlink: Setting state idle-client
Successfully forked off '(sd-mkuserns)' as PID 9649.
varlink: Changing state idle-client → calling
varlink: Sending message:
{"method":"io.systemd.NamespaceResource.AllocateUserRange","parameters":{"name":"nspawn-9643-fedora-ci","mangleName":true,"size":65536,"userNamespaceFileDescriptor":0}}
varlink: Received message: {"parameters":{"name":null}}
varlink: Changing state calling → called
varlink: Changing state called → idle-client
Successfully forked off '(sd-pinuserns)' as PID 9676.
Skipping PR_SET_MM, as we don't have privileges.
varlink: Setting state idle-client
varlink: Changing state idle-client → calling
varlink: Sending message:
{"method":"io.systemd.MountFileSystem.MountImage","parameters":{"imageFileDescriptor":0,"userNamespaceFileDescriptor":1,"readOnly":true,"growFileSystems":false,"veritySharing":true,"allowInteractiveAuthentication":true}}
varlink: Received message:
{"error":"io.systemd.System","parameters":{"origin":"linux","errno":6,"errnoName":"ENXIO"}}
varlink: Changing state calling → called
varlink: Changing state called → idle-client
Failed to issue io.systemd.MountFileSystem.MountImage() varlink call: No
such device or address
