containers / containers/toolbox

'systemd-tmpfiles --create' in Toolbx container gives lots of errors/warnings

Open
#1,294 0 comments 5 reactions 0 assignees View on GitHub
1. Bug
Dominant language
Go
Stars
3.5k
Forks
262
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**

Originally filed downstream for Fedora:
https://bugzilla.redhat.com/show_bug.cgi?id=2188304

Running `systemd-tmpfiles --create` inside a Toolbx container gives lots of errors and warnings:
```
$ sudo systemd-tmpfiles --create
fchownat() of /run/systemd/sessions failed: Operation not permitted
fchownat() of /run/systemd/users failed: Operation not permitted
fchownat() of /var/lib/systemd/coredump failed: Read-only file system
fchownat() of /tmp failed: Operation not permitted
Setting access ACL "u::rwx,g::r-x,g:adm:r-x,g:wheel:r-x,g:4294967295:r-x,g:4294967295:r-x,m::r-x,o::r-x" on /var/log/journal failed: Read-only file system
Failed to re-open '/var/log/journal': Operation not permitted
fchownat() of /var/log/journal failed: Read-only file system
Setting access ACL "u::rwx,g::r-x,g:adm:r-x,g:wheel:r-x,g:4294967295:r-x,g:4294967295:r-x,m::r-x,o::r-x" on /var/log/journal/3a9d668b4db749398a4a5e78a03bffa5 failed: Read-only file system
Failed to re-open '/var/log/journal/3a9d668b4db749398a4a5e78a03bffa5': Operation not permitted
fchownat() of /var/log/journal/3a9d668b4db749398a4a5e78a03bffa5 failed: Read-only file system
Failed to re-open '/var/log/journal/remote': Operation not permitted
fchownat() of /dev/snd/seq failed: Operation not permitted
fchownat() of /dev/snd/timer failed: Operation not permitted
fchownat() of /dev/loop-control failed: Operation not permitted
fchownat() of /dev/kvm failed: Operation not permitted
fchownat() of /dev/vhost-net failed: Operation not permitted
fchownat() of /dev/vhost-vsock failed: Operation not permitted
Setting access ACL "u::rw-,g::r-x,g:adm:r--,g:wheel:r--,g:4294967295:r--,g:4294967295:r--,m::r--,o::---" on /var/log/journal/3a9d668b4db749398a4a5e78a03bffa5/system.journal failed: Read-only file system
fchownat() of /var/log/journal/3a9d668b4db749398a4a5e78a03bffa5/system.journal failed: Read-only file system
fchownat() of /sys/kernel/security/tpm0/binary_bios_measurements failed: Operation not permitted
fchownat() of /sys/kernel/security/ima/binary_runtime_measurements failed: Operation not permitted
```

This is caused by some of the locations that are bind mounted into the container from the host operating system. These are those locations that are owned by a group or user other than `$USER` on the host. Since those group and user IDs are not available inside the container's user namespace, they are owned by `nobody:nobody` inside the container. For example:
```
$ ls -ld /run/systemd/sessions
drwxr-xr-x 2 nobody nobody 80 Apr 20 16:38 /run/systemd/sessions
```

Fedora's [systemd](https://src.fedoraproject.org/rpms/systemd) RPM contains a [file trigger](https://rpm-software-management.github.io/rpm/manual/file_triggers.html) that invokes `systemd-tmpfiles --create`:
```
%transfiletriggerin -P 1000600 -- /usr/lib/tmpfiles.d
if test -d "/run/systemd/system"; then
systemd-tmpfiles --create || :
fi
```

Therefore, these errors/warnings show up in any RPM transaction that contains a `tmpfiles.d(5)` snippet, or this trigger itself if there are already `tmpfiles.d(5))` snippets in the RPM database. eg., `dnf install systemd`.

**Expected behaviour**
These errors/warnings from `systemd-tmpfiles --create` inside a Toolbx container shouldn't occur.

**Info about your OS**
e.g., Fedora Silverblue and Workstation >= 37

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.