Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement /proc/sys/user/max_user_namespaces ? #11210

Open
Evolto2019 opened this issue Nov 22, 2024 · 2 comments
Open

Implement /proc/sys/user/max_user_namespaces ? #11210

Evolto2019 opened this issue Nov 22, 2024 · 2 comments
Labels
type: enhancement New feature or request

Comments

@Evolto2019
Copy link

Description

Bubblewrap with option "--disable-userns" enabled fails to run in gvisor due to lack of /proc/sys/user/max_user_namespaces (relevant code). The option "--disable-userns" is set as default by flatpak, so adding /proc/sys/user/max_user_namespaces will make it possible to build and run flatpak in container with gvisor.

Is this feature related to a specific bug?

No response

Do you have a specific solution in mind?

No response

@Evolto2019 Evolto2019 added the type: enhancement New feature or request label Nov 22, 2024
@EtiennePerot
Copy link
Contributor

Have you confirmed that this is the only thing that prevents flatpak from working? You can check by doing something like echo 1234 > /tmp/max_user_namespaces.txt && docker run --rm -it -v /tmp/max_user_namespaces.txt:/proc/sys/user/max_user_namespaces:rw --runtime=runsc ubuntu bash.

@Evolto2019
Copy link
Author

Have you confirmed that this is the only thing that prevents flatpak from working? You can check by doing something like echo 1234 > /tmp/max_user_namespaces.txt && docker run --rm -it -v /tmp/max_user_namespaces.txt:/proc/sys/user/max_user_namespaces:rw --runtime=runsc ubuntu bash.

Well confirmed. Bubblewrap will complain "creation of new user namespaces was not disabled as requested" in this case. This is because it checks whether it's possible to create new user namespace after setting "1" for /proc/sys/user/max_user_namespaces. Mounting a fake max_user_namespaces file will work only if bubblewrap performs the check by simply reading the corresponding sysctl value, which is not the case here.

copybara-service bot pushed a commit that referenced this issue Dec 4, 2024
Some application require that these files exist.
Fixes #11210

PiperOrigin-RevId: 702511700
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type: enhancement New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants