bug#45069: Guix System: unprivileged user cannot create user namespaces?

[zimoun]

Hi Vagrant,

Sorry if I am naive, I am trying to understand and it appears that
pieces are missing in my bag. :-)


On Mon, 07 Dec 2020 at 09:55, Vagrant Cascadian <vagrant@debian.org> wrote:

> The /proc/sys/kernel_unprivileged_userns_clone file is specific to
> Debian and Ubuntu packaged linux kernel; it is a patchset not applied
> upstream, as far as I am aware. I'm not sure if other distros support
> disabling and enabling this feature using this mechanism.

Thanks.  I still do not understand the message from Guix System:

--8<---------------cut here---------------start------------->8---
~/co/guix (master)$ guix environment -C guix
guix environment: error: cannot create container: unprivileged user cannot 
create user namespaces
guix environment: error: please set /proc/sys/kernel/unprivileged_userns_clone 
to "1"
--8<---------------cut here---------------end--------------->8---

(see
<https://yhetil.org/guix/e5c86d238ca5174b745b8ea6cb0cb6ad6b20aa5e.camel@yasuaki.com>)

Why does this appear if «set /proc/sys/kernel/unprivileged_userns_clone to "1"» 
does not make sense on Guix System?


Then Tobias answered: (see <https://yhetil.org/guix/87k0tux63a.fsf@nckx>)

        yasu 写道：
        > Now, I don't use Debian at all (I use Guix System) and do you 
        > think
        > this is a Bug in Guix (in that this Debian specific word should 
        > never
        > even be mentioned in Guix?)

        It's not Debian-specific.  It is a bug in Guix.

        It should try to create a namespace and properly report an error 
        iff that fails, not prematurely abort after farting about in 
        /proc.

        A separate unprivileged-user-namespace-supported? is broken by 
        design.  Reverting commit 8bc5ca5 works around this but it wasn't 
        to blame.

so I miss why does a similar patch as,

>   
> https://salsa.debian.org/kernel-team/linux/-/blob/master/debian/patches/debian/add-sysctl-to-disallow-unprivileged-CLONE_NEWUSER-by-default.patch

is not applied to Guix System?  Is it because a technical or else reason
behind?  Or is it simply because no one takes the time to fix the
problem?



All the best,
simon