<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Hi Yann,<div class=""><div class=""><div><br class=""></div><div>Sorry for the long follow-up, I have committed a patch to 0.6.32 which I think will fix your issue here:</div><div><a href="https://github.com/lathiat/avahi/commit/4ae755f7c9fff9efc02a76ece42a9965eacb1fbd" class="">https://github.com/lathiat/avahi/commit/4ae755f7c9fff9efc02a76ece42a9965eacb1fbd</a></div><div><br class=""></div><div>This patch is currently being shipped in the Fedora 0.6.31 also.</div><div><br class=""></div><div>Thanks,</div><div>Trent</div><div><br class=""><blockquote type="cite" class=""><div class="">On 17 Jul 2015, at 11:55 PM, Yann Soubeyrand <<a href="mailto:ysoubeyrand@adeneo-embedded.com" class="">ysoubeyrand@adeneo-embedded.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">Hi Trent,<br class=""><br class="">Sorry for the (very) long delay…<br class=""><br class="">Inside the container I get a cred->uid value of 65534 which means (if<br class="">I'm not mistaken) an UID overflow. I'm not sure if this is due to the<br class="">fact that the UID 0 is mapped on the UID 755360 for this container.<br class="">Anyway, I think that the value of cred->uid should be 0 in this case<br class="">but I'm not sure.<br class=""><br class="">Here is the setup I used. My host system is a Debian Sid with LXC 1.0.7<br class="">-3. The container runs Ubuntu Utopic as I wasn't able to run Ubuntu<br class="">Vivid inside an unprivileged container. The commands I used to setup my<br class="">container to reproduce this bug are the following ones (executed under<br class="">the superuser account). The superuser account owns 65536 sub UIDs<br class="">starting at 755360.<br class=""><br class="">HTTP_PROXY=apt lxc-create -B btrfs -t ubuntu -n ubuntu-utopic -- -r utopic --packages lxc,avahi-daemon,avahi-autoipd,avahi-dnsconfd,libnss-mdns<br class="">uidmapshift -b /var/lib/lxc/ubuntu-utopic/rootfs 0 755360 65536<br class="">chown 755360:755360 /var/lib/lxc/ubuntu-utopic<br class="">cat > /var/lib/lxc/ubuntu-utopic/config << EOF<br class=""># Template used to create this container: /usr/share/lxc/templates/lxc-ubuntu<br class=""># Parameters passed to the template: -r utopic --packages lxc,avahi-daemon,avahi-autoipd,avahi-dnsconfd,libnss-mdns<br class=""># For additional config options, please look at lxc.container.conf(5)<br class=""><br class=""># Common configuration<br class="">lxc.include = /usr/share/lxc/config/ubuntu.common.conf<br class="">lxc.include = /usr/share/lxc/config/ubuntu.userns.conf<br class=""><br class=""># Container specific configuration<br class="">lxc.rootfs = /var/lib/lxc/ubuntu-utopic/rootfs<br class="">lxc.mount = /var/lib/lxc/ubuntu-utopic/fstab<br class="">lxc.utsname = ubuntu-utopic<br class="">lxc.arch = amd64<br class="">lxc.id_map = u 0 755360 65536<br class="">lxc.id_map = g 0 755360 65536<br class=""><br class=""># Network configuration<br class="">lxc.network.type = veth<br class="">lxc.network.link = lxcbr0<br class="">lxc.network.flags = up<br class="">EOF<br class="">lxc-start -n ubuntu-utopic<br class=""><br class="">Inside the container, I rebuilt the Avahi packages to make some tests :<br class=""><br class="">sudo -s<br class="">sed -ri 'p;s#^deb (.*)$#deb-src \1#' /etc/apt/sources.list<br class="">apt-get update<br class="">apt-get install dpkg-dev gdb<br class="">apt-get source avahi-daemon<br class="">apt-get build-dep avahi-daemon<br class="">cd avahi-0.6.31<br class="">…<br class="">dpkg-buildpackage -us -uc<br class="">dpkg -i ../*.deb<br class=""><br class="">Feel free to ask me if you need more informations.<br class=""><br class="">Cheers<br class=""><br class="">Yann<br class=""><br class=""><br class="">Le mercredi 01 avril 2015 à 11:25 +0800, Trent Lloyd a écrit :<br class=""><blockquote type="cite" class="">Hi Yann,<br class=""><br class="">Can you tell me what value of cred->uid you are actually getting <br class="">inside these containers? I wonder if somehow you are getting the <br class="">unmapped value.<br class="">I assume that inside the container running “Id” shows 0, but outside <br class="">the container you see it remapped to another id?<br class=""><br class="">If you can confirm the lxc version, and possibly supply a config (or <br class="">as much info as possible) I can reproduce with, that would be great.<br class=""><br class="">Cheers,<br class="">Trent<br class=""><br class=""><blockquote type="cite" class="">On 6 Feb 2015, at 4:23 pm, Yann Soubeyrand <<br class=""><a href="mailto:ysoubeyrand@adeneo-embedded.com" class="">ysoubeyrand@adeneo-embedded.com</a>> wrote:<br class=""><br class="">Hi,<br class=""><br class="">Avahi daemon doesn't work inside an unprivileged container, more<br class="">precisely inside a container where the uid 0 is mapped to an uid <br class="">other<br class="">than 0.<br class=""><br class="">I identified the line where the problem occurs in the Avahi <br class="">sources:<br class=""><a href="http://git.0pointer.net/avahi.git/tree/avahi-core/netlink.c#n85" class="">http://git.0pointer.net/avahi.git/tree/avahi-core/netlink.c#n85</a>.<br class=""><br class="">I don't know if it's a bug of Avahi or if it's a bug inside the <br class="">kernel.<br class="">My guess is that it's the latter one but I'm not sure. I think that <br class="">the<br class="">kernel passes the credentials mapped to zero when it's the sender <br class="">of the<br class="">message whereas it should pass all zero credentials in this case. <br class="">But I<br class="">didn't read the code of netlink and it's purely speculation. Also, <br class="">I<br class="">wonder if it could not introduce security flaws doing so.<br class=""><br class="">Feel free to ask me if you need further information or if you need <br class="">me to<br class="">be clearer in my explanations ;-)<br class=""><br class="">I'm using Debian Sid as my host system (I tried 3.16 and 3.18 <br class="">kernels)<br class="">and Ubuntu Vivid inside my container.<br class=""><br class="">Cheers<br class=""><br class=""><br class=""><br class=""></blockquote></blockquote><br class="">-- Linux software engineer<br class="">Adeneo Embedded4 chemin du Ruisseau69130 ÉcullyFrance<br class="">+33 4 72 18 08 40<br class="">_______________________________________________<br class="">avahi mailing list<br class=""><a href="mailto:avahi@lists.freedesktop.org" class="">avahi@lists.freedesktop.org</a><br class="">http://lists.freedesktop.org/mailman/listinfo/avahi<br class=""></div></div></blockquote></div><br class=""></div></div></body></html>