Public bug reported: When running `lxc-start --share net 1` on a trusty host with a trusty container, chfn / su (and presumably other utilities which use PAM) fail.
Test case: lxc-create -t ubuntu -n test1 cat >/var/lib/lxc/test1/rootfs/config <<EOM lxc.include = /usr/share/lxc/config/ubuntu.common.conf lxc.rootfs = /var/lib/lxc/test1/rootfs lxc.mount = /var/lib/lxc/test1/fstab lxc.utsname = test1 lxc.arch = amd64 EOM lxc-start -n test1 -F --share-net 1 -- chfn -f 'test' root lxc-start -n test1 -F --share-net 1 -- su - Output: # lxc-start -n test1 -F --share-net 1 -- chfn -f 'test' root chfn: PAM: System error lxc-start: lxc_start.c: main: 342 The container failed to start. lxc-start: lxc_start.c: main: 346 Additional information can be obtained by setting the --logfile and --logpriority options. # lxc-start -n test1 -F --share-net 1 -- su - su: System error lxc-start: lxc_start.c: main: 342 The container failed to start. lxc-start: lxc_start.c: main: 346 Additional information can be obtained by setting the --logfile and --logpriority options. Issues in Docker e.g. https://github.com/docker/docker/issues/6345 suggest it's because the AUDIT_WRITE capability is not being set, but it doesn't seem to be the case here as LXC by default is doing subtractive caps: # lxc-info --name test1 -c lxc.cap.keep -c lxc.cap.drop lxc.cap.keep = lxc.cap.drop = sys_module mac_admin mac_override sys_time This issue also appears to have been found in LP: #1430891, but was worked around rather than addressed. Running without --share-net doesn't exhibit this problem. ** Affects: lxc (Ubuntu) Importance: Undecided Status: New -- You received this bug notification because you are a member of Ubuntu Server Team, which is subscribed to lxc in Ubuntu. https://bugs.launchpad.net/bugs/1501959 Title: "System error" on chfn / su with lxc-start --share-net To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/lxc/+bug/1501959/+subscriptions -- Ubuntu-server-bugs mailing list Ubuntu-server-bugs@lists.ubuntu.com Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-server-bugs
