4

I am running debian stretch on my host and I try to configure openvpn inside an Ubuntu xenial LXC guest.

Because openvpn needs a tun device, I followed guides such as http://heider.io/blog/2013/10/26/openvpn-in-a-lxc-container/ to allow tun device creation inside the container.

Unfortunately, setting lxc.cgroup.devices.allow = c 10:200 rwm in the container's config file gives me this error:

  lxc-start ERROR    lxc_cgfsng - cgroups/cgfsng.c:cgfsng_setup_limits:1949 - No such file or directory - Error setting devices.allow to c 10:200 rwm for ubuntu
  lxc-start ERROR    lxc_start - start.c:lxc_spawn:1236 - Failed to setup the devices cgroup for container "ubuntu".
  lxc-start ERROR    lxc_start - start.c:__lxc_start:1346 - Failed to spawn container "ubuntu".

Edit

I am trying to achieve this in an unpriviledged LXC container, here is the full configuration of this container:

# Distribution configuration
lxc.include = /usr/share/lxc/config/ubuntu.common.conf
lxc.include = /usr/share/lxc/config/ubuntu.userns.conf
lxc.arch = x86_64

# Container specific configuration
lxc.id_map = u 0 100000 65536
lxc.id_map = g 0 100000 65536
lxc.rootfs = /home/myuser/.local/share/lxc/ubuntu/rootfs
lxc.rootfs.backend = dir
lxc.utsname = ubuntu

# Network configuration
lxc.network.type = veth
lxc.network.flags = up
lxc.network.link = br0
lxc.network.hwaddr = 00:11:22:aa:bb:cc
lxc.network.ipv4 = 192.168.1.101/24
lxc.network.ipv4.gateway = 192.168.1.1

# trying to get /dev/net/tun inside container
lxc.cgroup.devices.allow = c 10:200 rwm

When I do not set the devices.allow option in order to be able to start the container, I can see processes inside the container are in the cgroup /sys/fs/cgroup/devices/user.slice (their PID, viewed from outside the container, are actually in the cgroup.procs file of this subdirectory), and from here :

$ cat devices.list 
a *:* rwm

but from inside the container

# mknod /dev/net/tun c 10 200
mknod: /dev/net/tun: Operation not permitted
omega
  • 91
  • 2
  • 7
  • You’re probably missing kernel support for “devices” control groups. – Daniel B Apr 24 '17 at 13:34
  • Why exactly do you want to do this in a container? It can be done more easily by setting up a second network namespace, which is the same thing the container does, except there is none of the container overhead. – MariusMatutiae Apr 24 '17 at 13:52
  • @MariusMatutiae : It's for test purposes, I want a fully functionnal linux container without having to run a virtual machine. – omega Apr 24 '17 at 18:49
  • @DanielB: How could I check that ? What could I do for ? – omega Apr 24 '17 at 18:50
  • So I installed the current Debian from scratch and the option works fine. Please verify that all cgroup filesystems (cpuset, cpu/cpuacct, devices, freezer, net_cls/net_prio, blkio and perf_event) are correctly mounted at `/sys/fs/cgroup`. If not, there may be an error somewhere in your boot configuration. Are you running systemd? Is your Debian installation old and upgrated? – Daniel B Apr 24 '17 at 20:41
  • @DanielB: Thanks for your time, all these cgroups are correctly mounted though. This is a clean debian installation, using systemd (4.9.0-2-amd64 #1 SMP Debian 4.9.18-1 (2017-03-30) x86_64 GNU/Linux). – omega Apr 26 '17 at 19:32
  • Hm. Are you perhaps trying to start the container while logged in to a non-root account? When I run a container (with or without said config option), its cgroup is available at `/sys/fs/cgroup/devices/lxc/`. `devices.allow` is there. – Daniel B Apr 26 '17 at 20:47
  • @DanielB I realize I didn't mention it, but I'm running unprivileged container, thus I start the container while logged as a non-root account. I do not have a device cgroup for it, but I do get a `freezer`, `memory` and `systemd` cgroup under `/sys/fs/cgroup/freezer/user/ghost/0/lxc/ubuntu`, `/sys/fs/cgroup/memory/user/ghost/0/lxc/ubuntu`, `/sys/fs/cgroup/systemd/user.slice/user-1000.slice/session-1.scope/lxc/ubuntu` – omega Apr 27 '17 at 19:37

1 Answers1

1

Adding

lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file

in the container's config file bind-mount the tun char device inside the container which solves the problem.

omega
  • 91
  • 2
  • 7
  • Thanks, this worked for me but don't forget to run openvpn as root inside of the container (I forgot to use sudo and thought the problem came from somewhere else). – baptx Jan 28 '19 at 19:36
  • Note that you have to add this in the container configuration, for example `.local/share/lxc/debian/config` (replace `debian` with your container name). I was wondering why it did not work because I added this line in `.config/lxc/default.conf` instead. By the way, I noticed a configuration like `lxc.mount.entry = /dev/net dev/net none bind,create=dir` (from https://wiki.archlinux.org/index.php/Openvpn_in_linux_containers#LXC_config) works also. Is this solution better than `lxc.mount.entry = /dev/net/tun dev/net/tun none bind,create=file` from your answer? Creating the file seems not needed. – baptx May 20 '20 at 17:14