<div dir="ltr">Here is my environment:<div>Linux kernel 4.11.3 with usernamespace set to YES</div><div><br></div><div><div style="color:rgb(33,33,33);font-size:13px"><div> % systemctl --version</div><div>systemd 233<br>+PAM -AUDIT -SELINUX -IMA -APPARMOR +SMACK -SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 -SECCOMP +BLKID +ELFUTILS +KMOD +IDN default-hierarchy=hybrid</div><div><br></div></div><span style="color:rgb(33,33,33);font-size:13px">% machinectl list</span><br style="color:rgb(33,33,33);font-size:13px"><div style="color:rgb(33,33,33);font-size:13px">MACHINE CLASS SERVICE OS VERSION ADDRESSES<br>poppy container systemd-nspawn fedora 26 192.168.1.94...</div><div style="color:rgb(33,33,33);font-size:13px"><br></div><span style="color:rgb(33,33,33);font-size:13px">% machinectl show poppy </span><br style="color:rgb(33,33,33);font-size:13px"><div style="color:rgb(33,33,33);font-size:13px">Name=poppy<br>Id=59b720b533834a4eafe07a62c2482266<br>Timestamp=Wed 2017-07-12 22:07:15 CEST<br>TimestampMonotonic=6928076<br>Service=systemd-nspawn<br>Unit=systemd-nspawn@poppy.service<br>Leader=648<br>Class=container<br>RootDirectory=/var/lib/machines/poppy<br>State=running</div></div><div style="color:rgb(33,33,33);font-size:13px"><br></div><div style="color:rgb(33,33,33)">Now first issue:</div><div style="color:rgb(33,33,33)">------------------</div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">On container</div><div><div><font color="#212121">% systemctl status user@1000.service</font></div><div><font color="#212121">● user@1000.service - User Manager for UID 1000</font></div><div><font color="#212121"> Loaded: loaded (/usr/lib/systemd/system/user@.service; static; vendor preset: disabled)</font></div><div><font color="#212121"> Active: failed (Result: protocol) since Wed 2017-07-19 01:59:29 CEST; 9h ago</font></div><div><font color="#212121"> Main PID: 264 (code=exited, status=237/KEYRING)</font></div><div><font color="#212121"><br></font></div><div><font color="#212121">Jul 19 01:59:29 <a href="http://thetradinghall.com">thetradinghall.com</a> systemd[1]: Starting User Manager for UID 1000...</font></div><div><font color="#212121">Jul 19 01:59:29 <a href="http://thetradinghall.com">thetradinghall.com</a> systemd[264]: user@1000.service: Failed at step KEYRING spawning /usr/lib/systemd/systemd: Permission denied</font></div><div><font color="#212121">Jul 19 01:59:29 <a href="http://thetradinghall.com">thetradinghall.com</a> systemd[1]: Failed to start User Manager for UID 1000.</font></div><div><font color="#212121">Jul 19 01:59:29 <a href="http://thetradinghall.com">thetradinghall.com</a> systemd[1]: user@1000.service: Unit entered failed state.</font></div><div><font color="#212121">Jul 19 01:59:29 <a href="http://thetradinghall.com">thetradinghall.com</a> systemd[1]: user@1000.service: Failed with result 'protocol'.</font></div><div><font color="#212121"><br></font></div><div><font color="#212121">Everything looks OK when running systemd binary out from unit file:</font></div><div><font color="#212121"><div>% ls -al /usr/lib/systemd/systemd</div><div>-rwxr-xr-x 1 root root 1.2M Jun 27 23:49 /usr/lib/systemd/systemd*</div><div><div>% /usr/lib/systemd/systemd --v </div><div>systemd 233</div><div>+PAM +AUDIT +SELINUX +IMA -APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD +IDN default-hierarchy=hybrid</div></div><div><br></div><div>Can anyone give me some hints why the unit file screams Permission denied?</div><div><br></div><div>Second issue:</div><div>-----------------</div><div><br></div><div>on host : $ mkdir ~/share ; $ touch ~/share/toto</div></font><font color="#212121"><div>on container: $ mkdir ~/share ; </div><div><br></div><div>I start the container with unit file:</div><div><div>% cat /etc/systemd/system/systemd-nspawn@.service.d/override.conf </div><div> </div><div>[Service]</div><div>ExecStart=</div><div>ExecStart=/usr/bin/systemd-nspawn --quiet --keep-unit --boot --link-journal=try-guest --network-bridge=br0 -U --settings=override --machine=%i --bind-ro=/home/gabx --bind=/home/gabx/share:/home/poisonivy/share</div></div><div><br></div><div>Now on container:</div></font></div><div><div style="color:rgb(33,33,33)"> % ls -al share </div><div style="color:rgb(33,33,33)">total 4.0K</div><div style="color:rgb(33,33,33)">drwxr-xr-x 2 nobody nobody 4.0K Jul 19 01:59 ./</div><div style="color:rgb(33,33,33)">drwx------ 1 poisonivy poisonivy 786 Jul 19 01:46 ../</div><div style="color:rgb(33,33,33)">-rw-r--r-- 1 nobody nobody 0 Jul 19 01:59 toto</div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">Why this nobody ? I can see this behavior a lot on my container. Example:</div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">$ ls -al /proc</div><div style="color:rgb(33,33,33)">.......................</div><div><div><font color="#212121">-r--r--r-- 1 nobody nobody 0 Jul 19 11:47 devices</font></div><div><font color="#212121">-r--r--r-- 1 nobody nobody 0 Jul 19 11:47 diskstats</font></div><div><font color="#212121">-r--r--r-- 1 nobody nobody 0 Jul 19 11:47 dma</font></div><div><font color="#212121">-r--r--r-- 1 nobody nobody 0 Jul 19 11:47 execdomains</font></div><div><font color="#212121">-r--r--r-- 1 nobody nobody 0 Jul 19 11:47 fb</font></div></div><div style="color:rgb(33,33,33)">.........................</div></div></div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">When looking at these folders from host:</div><div><div style="color:rgb(33,33,33)"># ls -al $POPPY/home/poisonivy/share</div><div style="color:rgb(33,33,33)">total 0</div><div style="color:rgb(33,33,33)">drwxrwxr-x 1 vu-poppy-1000 vg-poppy-1000 0 Jul 19 01:46 ./</div><div style="color:rgb(33,33,33)">drwx------ 1 vu-poppy-1000 vg-poppy-1000 786 Jul 19 01:46 ../</div><div style="color:rgb(33,33,33)">Please note that file toto is not seen</div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">Same user:group for /proc</div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">This comes certainly from my username space being set in Kernel. How can I deal with nobody as I can't change it?</div><div><div><font color="#212121">poisonivy@thetradinghall ➤➤ ~ % chown poisonivy:poisonivy share</font></div><div><font color="#212121">chown: changing ownership of 'share': Operation not permitted</font></div></div><div style="color:rgb(33,33,33)"><br></div></div><div style="color:rgb(33,33,33)"><br></div><div style="color:rgb(33,33,33)">Thank you for help/hints with these permissions issues. It starts to be difficult to run properly my container.</div><div style="color:rgb(33,33,33)"><br></div></div>