Result of ps aux on a LXC host is quite messy! But that can be improved, with the benefit of having each LXC container using a specific namespace: for instance « having a process is unprivileged for operations outside the user namespace but with root privileges inside the namespace ». Easier to check on and likely to be more secure.

A reply to the question « what is an unpriviledged LXC container » provides a working howto. The following is a proposal to implement it even more easily.

For each LXC container, you need to pick a UID/GID range. For instance, for container test1, let’s pick 100000 65536. It means that root in test1, will actually be 100000 on the main host. User 1001 in test1 will be 101001 on the main host and so on.

So you must add the map on the main host:

usermod --add-subuids 100000-165535 root usermod --add-subgids 100000-165535 root

Then you must configure the relevant LXC container configuration file whose location varies according to you lxc.lxcpath.

# require userns.conf associated to the distribution used lxc.include = /usr/share/lxc/config/debian.userns.conf # specific user map lxc.id_map = u 0 100000 65536 lxc.id_map = g 0 100000 65536

Then you need to update files ownership according to the new mapping. Original poster proposed a few shell commands but that would only be enough to start the container. Files within the container would not get inappropriate ownership: most likely, files that belongs to root/0 on the host would show up as owned by nobody/65534. For proper ownership to root/0 within the LXC container, they need to belong to 100000 on the the host.

Here comes my increase-uid-gid.pl script: it’ll take as argument your LXC container name (or alternatively a path, useful for mounts that are residing outside of it) and value to increment. In the first case, it’ll be 100000:

# shutting down the container before touching it lxc-stop --name test1 # obtain the script cd wget https://gitlab.com/yeupou/stalag13/raw/master/usr/local/bin/increase-uid-gid.pl chmod +x ~/increase-uid-gid.pl # chown files +100000 ~/increase-uid-gid.pl --lxc=test1 --increment=100000 # start the container lxc-start --name test1

That’s all. Obviously, you should check that every daemon is still functionning properly. If not, either it means a file owership changed was missed (happened once to a container with transmission-daemon) or maybe its mode was not properly set beforehand (happened once to a container with exim4 that was not setuid – it led to failure with procmail_pipe).

Next container test2? Edit `lxc-config lxc.lxcpath`/test2/config:

# require userns.conf associated to the distribution used lxc.include = /usr/share/lxc/config/debian.userns.conf # specific user map lxc.id_map = u 0 200000 65536 lxc.id_map = g 0 200000 65536

Then run:

lxc-stop --name test2 usermod --add-subuids 200000-165535 root usermod --add-subgids 200000-165535 root ~/increase-uid-gid.pl --lxc=test2 --increment=200000 lxc-start --name test2

I tested the script on 16 LXC containers with no problem so far.

If you need to deal with extra mounted directories (lxc.mount.entry=…), use –path option.

If you need to deal with a container that was already mapped (for instance already 100000 65536 but you would like it to be 300000 65536), you’ll need to raise the –limit that is by default equal to increment value: that would be –increment=200000 –limit=300000. This limit exists so you can re-run the script on the same container with no risk of having files getting out of range.

For the record:

For the record, follows the script as it is today (but it always best to get latest version from gitlab – because I wont update any bugfixes/improvements on this page) :

#!/usr/bin/perl use strict; use File::Find; use Getopt::Long; ### options my ($getopt, $help, $path, $lxc, $increase, $limit); eval { $getopt = GetOptions("help" => \$help, "lxc=s" => \$lxc, "path=s" => \$path, "increase=i" => \$increase, "limit=i" => \$limit); }; if ($help or !$increase or (!$path and !$lxc)) { # increase is mandatory # either path or lxc also # print help if missing print STDERR " Usage: $0 [OPTIONS] --lxc=name --increase=100000 or $0 [OPTIONS] --path=/directory/ --increase=100000 Will increase all files UID/GID by the value set. --lxc=name LXC container name, will be used to determine path --path=/dir No LXC assumption, just work on a given path --increase=n How much to increment --limit=n Increase limit, by default equal to increase Useful for instance when you add to a LXC container such config: lxc.id_map = u 0 100000 65536 lxc.id_map = g 0 100000 65536 And the host system having the relevant range set: usermod --add-subuids 100000-165535 root usermod --add-subgids 100000-165535 root It would update UID/GID within rootfs to match the proper range. Note that additional configured mount must also be updated accordingly, using --path for instance. By default, limit is set to increase value so you can run it several time on the same container, the increase will be effective only once. You can set the limit to something else, for instance if you want to increase by 100000 a container already within the 100000-165536 range, you would have to use --increase=100000 --limit=200000. This script is primitive: it should work in most case, but if some service fail to work after the LXC container restart, it is probably because one or several files were missed. Author: yeupou\@gnu.org https://yeupou.wordpress.com/ "; exit; } # limit set to increase by default $limit = $increase unless $limit; # if lxc set, use it to define path if ($lxc) { my $lxcpath = `lxc-config lxc.lxcpath`; chomp($lxcpath); $path = "$lxcpath/$lxc/rootfs"; } # in any case, path must be given and found die "path $path: not found, exit" unless -e $path; print "path: $path

"; ### run find(\&wanted, $path); # if lxc, check main container config if ($lxc) { my $lxcpath = `lxc-config lxc.lxcpath`; chomp($lxcpath); # https://unix.stackexchange.com/questions/177030/what-is-an-unprivileged-lxc-container # directory for the container chown(0,0, "$lxcpath/$lxc"); chmod(0775, "$lxcpath/$lxc"); # container config chown(0,0, "$lxcpath/$lxc/config"); chmod(0644, "$lxcpath/$lxc/config"); # container rootfs - chown will be done during the wanted() chmod(0775, "$lxcpath/$lxc/rootfs"); } exit; sub wanted { print $File::Find::name; # find out current UID/GID my $originaluid = (lstat $File::Find::name)[4]; my $newuid = $originaluid; my $originalgid = (lstat $File::Find::name)[5]; my $newgid = $originalgid; # increment but only if we are below the new range $newuid += $increase if ($originaluid < $increase); $newgid += $increase if ($originalgid < $increase); # update if there is at least one change if ($originaluid ne $newuid or $originalgid ne $newgid) { chown($newuid, $newgid, $File::Find::name); print " set to UID:$newuid GID:$newgid

"; } else { print " kept to UID:$originaluid GID:$originalgid

"; } } # EOF