<div dir="ltr"><br><br><div class="gmail_quote"><div dir="ltr">On Thu, Sep 1, 2016 at 12:47 PM arnaud gaboury <<a href="mailto:arnaud.gaboury@gmail.com">arnaud.gaboury@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><div>I have been moving directories and files between my host and my container many times since more than one year with no issues. Host is Archlinux and container Fedora 24 (upgrade to 24 is quite recent: no more than 2 months).<br><br></div>I moved a directory today from host to container and this let me, for the first time, with a directory in the container owned by 65534:65534. <br><The UID 65534 is commonly reserved for <i>nobody</i>, a user with no system privileges, as opposed to an ordinary (i.e., <i>non-privileged</i>)
user. This UID is often used for individuals accessing the system
remotely via FTP or HTTP[0] ><br></div><div>From host, the directory is correctly seen as a root:root <br><br>----------------------------------------------<br># ls -al /var/lib/machines/poppy/storage/tth-blog/pelican-themes/material-TTH/static <br>drwxr-xr-x 1 root root 58 Sep 1 12:10 css/<br>----------------------------------------------<br><br></div><div>I can't change owner/group ID from inside the container, which is of course very annoying as my folders and their contents are unusable. <br><br><br></div>I didn't change anything in the way my container is mounted:<br><br></div>$ cat /etc/fstab<br>-------------------------<br><div><div>LABEL=poppy-root /var/lib/machines/poppy btrfs rw,noatime,autodefrag,compress=lzo,ssd,subvol=rootvol 0 0<br>---------------------------------<br>The container is started at boot time with systemd-nspawn@poppy.service (poppy is the container name)<br><br><br>$ systemctl status systemd-nspawn@poppy.service<br> <br>● systemd-nspawn@poppy.service - Container poppy<br> Loaded: loaded (/usr/lib/systemd/system/systemd-nspawn@.service; enabled; vendor preset: dis<br> Active: active (running) since Mon 2016-08-29 00:09:08 CEST; 3 days ago<br> Docs: man:systemd-nspawn(1)<br> Main PID: 612 (systemd-nspawn)<br> Status: "Container running."<br> CGroup: /machine.slice/systemd-nspawn@poppy.service<br> ├─612 /usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --<br> ├─init.scope<br> │ └─617 /usr/lib/systemd/...<br> ├─system.slice<br> │ ├─console-getty.service<br> │ │ └─991 /sbin/agetty --no...<br> │ ├─dbus.service<br> │ │ └─945 /usr/bin/dbus-dae...<br> │ ├─dovecot.service<br> │ │ ├─ 1016 /usr/sbin/dovecot<br> │ │ ├─ 1431 dovecot/lmtp<br> │ │ ├─ 1432 dovecot/anvil<br> │ │ ├─ 1433 dovecot/log<br> │ │ ├─ 1435 dovecot/config<br> │ │ ├─ 1436 dovecot/lmtp<br> │ │ ├─ 1437 dovecot/lmtp<br> │ │ ├─ 1438 dovecot/lmtp<br> │ │ ├─ 1439 dovecot/lmtp<br> │ │ ├─ 1440 dovecot/lmtp<br> │ │ ├─ 1441 dovecot/lmtp<br> │ │ ├─ 1442 dovecot/lmtp<br> │ │ ├─ 1443 dovecot/lmtp<br> │ │ ├─ 1444 dovecot/lmtp<br> │ │ ├─ 3222 dovecot/imap-login<br> │ │ ├─ 3226 dovecot/imap<br> │ │ ├─ 4129 dovecot/imap-login<br> │ │ ├─ 4167 dovecot/imap<br> │ │ ├─ 6412 dovecot/ssl-params<br> │ │ ├─14815 dovecot/imap-login<br> │ │ └─14819 dovecot/imap<br> │ ├─nginx.service<br> │ │ ├─1458 nginx: master pro...<br> │ │ ├─1459 nginx: worker proces<br> │ │ ├─1460 nginx: worker proces<br> │ │ ├─1461 nginx: worker proces<br> │ │ ├─1462 nginx: worker proces<br> │ │ ├─1463 nginx: worker proces<br> │ │ ├─1464 nginx: worker proces<br> │ │ ├─1465 nginx: worker proces<br> │ │ └─1466 nginx: worker proces<br> │ ├─opendkim.service<br> │ │ └─10182 /usr/sbin/opendki...<br> │ ├─php-fpm.service<br> │ │ ├─ 984 php-fpm: master p...<br> │ │ ├─1445 php-fpm: pool own...<br> │ │ ├─1446 php-fpm: pool own...<br> │ │ ├─1447 php-fpm: pool own...<br> │ │ ├─1448 php-fpm: pool own...<br> │ │ ├─1449 php-fpm: pool own...<br> │ │ ├─1450 php-fpm: pool www...<br> │ │ ├─1451 php-fpm: pool www...<br> │ │ ├─1452 php-fpm: pool www...<br> │ │ └─1454 php-fpm: pool www...<br> │ ├─polkit.service<br> │ │ └─10026 /usr/lib/polkit-1...<br> │ ├─postfix.service<br> │ │ ├─ 1096 /usr/libexec/post...<br> │ │ ├─ 1098 qmgr -l -t unix -u<br> │ │ ├─ 1817 tlsmgr -l -t unix -u<br> │ │ └─20925 pickup -l -t unix -u<br> │ ├─postgresql.service<br> │ │ ├─1009 /usr/bin/postgres...<br> │ │ ├─1049 postgres: checkpo...<br> │ │ ├─1050 postgres: writer ...<br> │ │ ├─1051 postgres: wal wri...<br> │ │ ├─1052 postgres: autovac...<br> │ │ └─1053 postgres: stats c...<br> │ ├─redis.service<br> │ │ └─976 /usr/bin/redis-se...<br> │ ├─saslauthd.service<br> │ │ ├─970 /usr/sbin/saslaut...<br> │ │ ├─971 /usr/sbin/saslaut...<br> │ │ ├─972 /usr/sbin/saslaut...<br> │ │ ├─973 /usr/sbin/saslaut...<br> │ │ └─974 /usr/sbin/saslaut...<br> │ ├─spamassassin.service<br> │ │ └─27341 /usr/bin/perl -T ...<br> │ ├─system-clamd.slice<br> │ │ └─clamd@amavisd.service<br> │ │ └─27332 /usr/sbin/clamd -...<br> │ ├─systemd-journald.service<br> │ │ └─904 /usr/lib/systemd/...<br> │ ├─systemd-logind.service<br> │ │ └─936 /usr/lib/systemd/...<br> │ ├─systemd-networkd.service<br> │ │ └─969 /usr/lib/systemd/...<br> │ ├─vsftpd.service<br> │ │ └─1430 /usr/sbin/vsftpd ...<br> │ └─xinetd.service<br> │ └─997 /usr/sbin/xinetd ...<br> └─user.slice<br> └─user-1000.slice<br> ├─session-c1.scope<br> │ ├─4974 login -- poisoniv...<br> │ └─4998 -zsh<br> ├─session-c2.scope<br> │ ├─ 6067 login -- poisoniv...<br> │ ├─ 6086 -zsh<br> │ └─24742 /usr/bin/python3 ...<br> └─user@1000.service<br> └─init.scope<br> ├─4991 /usr/lib/systemd/...<br> └─4993 (sd-pam) ...<br><br>Aug 29 00:09:12 hortensia systemd-nspawn[612]: See 'systemctl status amavisd.service' for details.<br>Aug 29 00:09:13 hortensia systemd-nspawn[612]: [ OK ] Stopped Amavisd-new is an interface between MTA and content checkers..<br>Aug 29 00:09:13 hortensia systemd-nspawn[612]: Starting Amavisd-new is an interfac...een MTA and content checkers....<br>Aug 29 00:09:14 hortensia systemd-nspawn[612]: [2B blob data]<br>Aug 29 00:09:14 hortensia systemd-nspawn[612]: Fedora 24 (Server Edition)<br>Aug 29 00:09:14 hortensia systemd-nspawn[612]: Kernel 4.7.2-1-hortensia on an x86_64 (console)<br>Aug 29 00:09:14 hortensia systemd-nspawn[612]: [1B blob data]<br>Aug 29 00:09:14 hortensia systemd-nspawn[612]: Admin Console: <a href="https://192.168.1.94:9090/" target="_blank">https://192.168.1.94:9090/</a> or https://[fe80::c7f:c3ff:fefb:25b1]:9090/<br>Aug 29 00:09:14 hortensia systemd-nspawn[612]: [1B blob data]<br>Aug 29 08:29:20 hortensia systemd-nspawn[612]: thetradinghall login: Generating systemd units for vsftpd<br>lines 65-122/122 (END)<br><br></div><div>Please can someone help me to deal with this issue?<br></div></div></div></blockquote><div><br></div><div>EDIT:<br><br></div><div>$ls -al /<br> dr-xr-xr-x 1 root root 242 Aug 28 13:47 ./<br>dr-xr-xr-x 1 root root 242 Aug 28 13:47 ../<br>dr-xr-xr-x 1 root root 0 Feb 3 2016 boot/<br>drwxrwxr-x 1 root root 62 Aug 26 19:59 db/<br>drwxr-xr-x 7 root root 440 Aug 29 00:09 dev/<br>drwxr-xr-x 1 root root 4.1K Aug 29 08:19 etc/<br>drwxr-xr-x 1 root root 76 Feb 3 2016 home/<br>drwxrwxrwx 1 root root 0 Aug 28 13:47 keybase/<br>drwxr-xr-x 1 root root 0 Feb 3 2016 media/<br>drwxr-xr-x 1 root root 0 Feb 3 2016 mnt/<br>drwxr-xr-x 1 root root 56 Aug 26 20:02 opt/<br>dr-xr-xr-x 412 65534 65534 0 Aug 29 00:09 proc/<br>dr-xr-x--- 1 root root 378 Aug 29 08:28 root/<br>drwxr-xr-x 21 root root 560 Aug 29 08:29 run/<br>drwxr-xr-x 1 65534 65534 6 Mar 3 17:43 share/<br>drwxr-xr-x 1 root root 0 Feb 3 2016 srv/<br>drwxrwxr-x 1 root wheel 230 Sep 1 12:11 storage/<br>drwxr-xr-x 9 root root 180 Aug 29 00:09 sys/<br>drwxrwxrwt 12 root root 240 Sep 1 12:51 tmp/<br>drwxr-xr-x 1 root root 100 Dec 14 2015 usr/<br>drwxr-xr-x 1 root root 194 Mar 19 18:29 var/<br>-rw-r--r-- 1 65534 65534 0 May 9 10:01 .autorelabel<br>lrwxrwxrwx 1 root root 7 Feb 3 2016 bin -> usr/bin/<br>-rw-r--r-- 1 65534 65534 739 Jul 3 02:00 certbot.log<br>lrwxrwxrwx 1 root root 7 Feb 3 2016 lib -> usr/lib/<br>lrwxrwxrwx 1 root root 9 Feb 3 2016 lib64 -> usr/lib64/<br>-rw-r--r-- 1 65534 65534 220 Jul 5 13:24 .pearrc<br>-rw------- 1 65534 65534 1.0K May 15 2015 .rnd<br>lrwxrwxrwx 1 65534 65534 8 Feb 3 2016 sbin -> usr/sbin/<br><br></div><div>?? Doesn't sounds good all these 65534:65534. Any possibility there have been an intrusion in my container (it servers many web apps) ?<br><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div><div><br></div><div>Thank you<br></div><div><br><br>[0]<a href="http://www.linfo.org/uid.html" target="_blank">http://www.linfo.org/uid.html</a></div></div></div></blockquote></div></div>