Your message dated Sun, 29 Aug 2021 09:22:03 +0800
with message-id <[email protected]>
and subject line Bug#978065 lxc: After upgrade lxc to 4.0.5-1, cannot start
with lxc.cap.drop sys_admin
has caused the Debian Bug report #978065,
regarding lxc: After upgrade lxc to 4.0.5-1, cannot start with lxc.cap.drop
sys_admin
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
978065: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978065
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: lxc
Version: 1:4.0.5-1
Severity: normal
Dear Maintainer,
*** Reporter, please consider answering these questions, where appropriate ***
As title, rollback to previous version or remove
"lxc.cap.drop=sys_admin" solved the issue.
I found this error in debug.log
conf - conf.c:lxc_mount_auto_mounts:728 - Invalid cross-device
link - Failed to mount "/sys/fs/cgroup"
* What led up to the situation?
* What exactly did you do (or not do) that was effective (or
ineffective)?
* What was the outcome of this action?
* What outcome did you expect instead?
*** End of the template - remove these template lines ***
-- System Information:
Debian Release: bullseye/sid
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 5.9.0-5-amd64 (SMP w/8 CPU threads)
Kernel taint flags: TAINT_WARN
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:en
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages lxc depends on:
ii debconf [debconf-2.0] 1.5.74
ii libc6 2.31-6
ii libcap2 1:2.44-1
ii libgcc-s1 10.2.1-3
ii liblxc1 1:4.0.5-1
ii libseccomp2 2.5.1-1
ii libselinux1 3.1-2+b2
ii lsb-base 11.1.0
Versions of packages lxc recommends:
ii apparmor 2.13.5-1+b2
ii bridge-utils 1.6-3
pn debootstrap <none>
ii dirmngr 2.2.20-1
pn dnsmasq-base <none>
ii gnupg 2.2.20-1
ii iproute2 5.10.0-1
pn libpam-cgfs <none>
ii lxc-templates 3.0.4-4
ii lxcfs 4.0.5-1
ii nftables 0.9.7-1
ii openssl 1.1.1i-1
ii rsync 3.2.3-3
pn uidmap <none>
Versions of packages lxc suggests:
ii btrfs-progs 5.9-1+b1
ii lvm2 2.03.10-1
ii python3-lxc 1:3.0.4-1+b4
-- Configuration Files:
/etc/apparmor.d/usr.bin.lxc-start changed:
/usr/bin/lxc-start flags=(attach_disconnected) {
#include <abstractions/lxc/start-container>
mount options=(rw, bind) -> /proc/sys/kernel/random/boot_id,
mount options=(ro, nosuid, nodev, noexec, remount, bind) ->
/proc/sys/kernel/random/boot_id,
}
/etc/default/lxc-net changed:
USE_LXC_BRIDGE="false"
/etc/lxc/default.conf changed:
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 0
-- debconf information:
lxc/auto_update_config:
--- End Message ---
--- Begin Message ---
Hi, sorry for late reply (don't why I did not received any notification when people reply this
bug report)
I do not have this problem anymore (but forget when , which version solved)
So, I close this report now, thanks.
Yes, I can run lxc.cap.drop = sys_admin (attached config for reference)
# Distribution configuration
lxc.include = /usr/share/lxc/config/common.conf
lxc.include = /usr/share/lxc/config/userns.conf
lxc.arch = linux64
lxc.tty.dir =
# Container specific configuration
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 0
lxc.rootfs.path = dir:/var/lib/lxc/nginx/rootfs
lxc.uts.name = nginx
# Container specific configuration
lxc.start.auto = 0
lxc.start.delay = 0
lxc.idmap = u 0 200000 65536
lxc.idmap = g 0 200000 65536
lxc.cap.drop = sys_module mac_admin mac_override sys_time mknod net_raw
sys_rawio sys_admin
lxc.no_new_privs = 1
# Network configuration
lxc.net.0.flags = up
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.hwaddr = 00:16:3e:00:00:02
lxc.net.0.ipv4.address = 10.0.3.2/24
lxc.net.0.ipv4.gateway = 10.0.3.1
lxc.cgroup2.memory.max = 400M
lxc.mount.entry = proc proc proc
rw,remount,nodev,nosuid,noexec,relatime,hidepid=2,gid=0 0 0
lxc.mount.entry = tmpfs run tmpfs
rw,nosuid,nodev,noexec,relatime,mode=0755,size=100M,create=dir 0 0
lxc.mount.entry = tmpfs run/lock tmpfs
rw,nosuid,nodev,noexec,relatime,mode=1777,size=5M,create=dir 0 0
lxc.mount.entry = tmpfs dev/shm tmpfs
rw,nosuid,nodev,noexec,relatime,mode=1777,size=384M,create=dir 0 0
Regards,
John.
--
Key fingerprint: CDB3 6C62 254B C088 1E5D DD32 182C 97DB CF2C 80AC
# Distribution configuration
lxc.include = /usr/share/lxc/config/common.conf
lxc.include = /usr/share/lxc/config/userns.conf
lxc.arch = linux64
lxc.tty.dir =
# Container specific configuration
lxc.apparmor.profile = generated
lxc.apparmor.allow_nesting = 0
lxc.rootfs.path = dir:/var/lib/lxc/nginx/rootfs
lxc.uts.name = nginx
# Container specific configuration
lxc.start.auto = 0
lxc.start.delay = 0
lxc.idmap = u 0 200000 65536
lxc.idmap = g 0 200000 65536
lxc.cap.drop = sys_module mac_admin mac_override sys_time mknod net_raw
sys_rawio sys_admin
lxc.no_new_privs = 1
# Network configuration
lxc.net.0.flags = up
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.hwaddr = 00:16:3e:00:00:02
lxc.net.0.ipv4.address = 10.0.3.2/24
lxc.net.0.ipv4.gateway = 10.0.3.1
lxc.cgroup2.memory.max = 400M
lxc.mount.entry = proc proc proc
rw,remount,nodev,nosuid,noexec,relatime,hidepid=2,gid=0 0 0
lxc.mount.entry = tmpfs run tmpfs
rw,nosuid,nodev,noexec,relatime,mode=0755,size=100M,create=dir 0 0
lxc.mount.entry = tmpfs run/lock tmpfs
rw,nosuid,nodev,noexec,relatime,mode=1777,size=5M,create=dir 0 0
lxc.mount.entry = tmpfs dev/shm tmpfs
rw,nosuid,nodev,noexec,relatime,mode=1777,size=384M,create=dir 0 0
--- End Message ---
