Issue type:
Docker containers when running under a lxc container are unable to write to /proc/self/loginuid blocking ssh logins due to pam_loginuid.so.
OS Version/build:
debian 9.9 (up to date) running kernel 4.9.168-1 with aufs-dkms.
lxc 2.0.7-2+deb9u2
App version:
Docker version 18.09.6, build 481bc77
Docker run from inside an lxc container running with the config:
lxc.include = /usr/share/lxc/config/debian.common.conf
lxc.include = /usr/share/lxc/config/nesting.conf
Steps to reproduce:
pam_loginuid.so (write to loginuid) works when testing from:
the host
inside docker run directly on the host
inside a lxc container
But won’t allow writes when run from docker inside the lxc container.
For example when cron triggers a job for the user www-data (uid 33)
You end up seeing the following:
[pid 1693] openat(AT_FDCWD, “/proc/self/loginuid”, O_RDWR|O_NOFOLLOW) = 6
[pid 1693] read(6, “0”, 24) = 1
[pid 1693] read(6, “”, 23) = 0
[pid 1693] lseek(6, 0, SEEK_SET) = 0
[pid 1693] ftruncate(6, 0) = 0
[pid 1693] write(6, “33”, 2) = -1 EPERM (Operation not permitted)
Where as you should be seeing:
[pid 30378] openat(AT_FDCWD, “/proc/self/loginuid”, O_RDWR|O_NOFOLLOW) = 6
[pid 30378] read(6, “4294967295”, 24) = 10
[pid 30378] read(6, “”, 14) = 0
[pid 30378] lseek(6, 0, SEEK_SET) = 0
[pid 30378] ftruncate(6, 0) = 0
[pid 30378] write(6, “33”, 2) = 2
Have been able to reproduce the issue using both debian:9.9 and ubuntu:18.04 images.
Have tried many tweaks to lxc and apparmor to no avail, mostly as I can’t seem to reproduce the issue in a lxc container and no changes have had any effect on the docker containers either.
Any thoughts on ideas on where to go next ?