[Bug 1064] iptables-save fails silently in unprivileged lxc/lxd container
bugzilla-daemon at netfilter.org
bugzilla-daemon at netfilter.org
Tue May 3 21:07:29 CEST 2016
https://bugzilla.netfilter.org/show_bug.cgi?id=1064
--- Comment #7 from Philipp Gassmann <phiphi at phiphi.ch> ---
Tested it in Virtualbox on Ubuntu 16.04 with Kernel 4.5.2 from
http://kernel.ubuntu.com/~kernel-ppa/mainline/v4.5.2-wily
Unfortunately I get the same results.
Had to add configuration because of incomplete apparmor support in the mainline
kernel.
root at lxd1:~# lxc launch ubuntu:xenial iptables-test
ubuntulxd at lxd1:~$ lxc config set iptables-test raw.lxc 'lxc.aa_allow_incomplete
= 1'
ubuntulxd at lxd1:~$ lxc start iptables-test
ubuntulxd at lxd1:~$ lxc list
+---------------+---------+------+------+------------+-----------+
| NAME | STATE | IPV4 | IPV6 | TYPE | SNAPSHOTS |
+---------------+---------+------+------+------------+-----------+
| iptables-test | RUNNING | | | PERSISTENT | 0 |
+---------------+---------+------+------+------------+-----------+
ubuntulxd at lxd1:~$ lxc exec iptables-test -- bash
root at iptables-test:~# iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT
root at iptables-test:~# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root at iptables-test:~# iptables-save
root at iptables-test:~# strace iptables-save
execve("/sbin/iptables-save", ["iptables-save"], [/* 12 vars */]) = 0
brk(NULL) = 0x1687000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f7d9358d000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=20483, ...}) = 0
mmap(NULL, 20483, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7d93587000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libip4tc.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\26\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=27424, ...}) = 0
mmap(NULL, 2122496, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f7d93163000
mprotect(0x7f7d93169000, 2093056, PROT_NONE) = 0
mmap(0x7f7d93368000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f7d93368000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libip6tc.so.0", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\360\27\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=27456, ...}) = 0
mmap(NULL, 2122528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f7d92f5c000
mprotect(0x7f7d92f62000, 2093056, PROT_NONE) = 0
mmap(0x7f7d93161000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x5000) = 0x7f7d93161000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libxtables.so.11", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\200/\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=51872, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f7d93586000
mmap(NULL, 2148792, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f7d92d4f000
mprotect(0x7f7d92d5a000, 2097152, PROT_NONE) = 0
mmap(0x7f7d92f5a000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f7d92f5a000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0P\t\2\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1864888, ...}) = 0
mmap(NULL, 3967488, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f7d92986000
mprotect(0x7f7d92b46000, 2093056, PROT_NONE) = 0
mmap(0x7f7d92d45000, 24576, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1bf000) = 0x7f7d92d45000
mmap(0x7f7d92d4b000, 14848, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f7d92d4b000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\240\r\0\0\0\0\0\0"...,
832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14608, ...}) = 0
mmap(NULL, 2109680, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0x7f7d92782000
mprotect(0x7f7d92785000, 2093056, PROT_NONE) = 0
mmap(0x7f7d92984000, 8192, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d92984000
close(3) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f7d93585000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f7d93584000
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) =
0x7f7d93583000
arch_prctl(ARCH_SET_FS, 0x7f7d93584700) = 0
mprotect(0x7f7d92d45000, 16384, PROT_READ) = 0
mprotect(0x7f7d92984000, 4096, PROT_READ) = 0
mprotect(0x7f7d92f5a000, 4096, PROT_READ) = 0
mprotect(0x7f7d93161000, 4096, PROT_READ) = 0
mprotect(0x7f7d93368000, 4096, PROT_READ) = 0
mprotect(0x613000, 4096, PROT_READ) = 0
mprotect(0x7f7d9358f000, 4096, PROT_READ) = 0
munmap(0x7f7d93587000, 20483) = 0
brk(NULL) = 0x1687000
brk(0x16a8000) = 0x16a8000
open("/proc/net/ip_tables_names", O_RDONLY|O_CLOEXEC) = -1 EACCES (Permission
denied)
exit_group(0) = ?
+++ exited with 0 +++
root at iptables-test:~# uname -a
Linux iptables-test 4.5.2-040502-generic #201604200335 SMP Wed Apr 20 07:37:26
UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20160503/2f60a39e/attachment.html>
More information about the netfilter-buglog
mailing list