#1052934 plocate: Error running inside LXC container using systemd service (timer) with PrivateNetwork=true set

Package:
lxc
Source:
lxc
Description:
Linux Containers userspace tools
Submitter:
Alastair Sherringham
Date:
2023-09-26 23:09:03 UTC
Severity:
normal
Tags:
#1052934#5
Date:
2023-09-26 13:45:43 UTC
From:
To:
Dear Maintainer,

I have an LXC container with plocate installed. Both host and container
run Debian 12 Bookworm. The LXC container was created using basic LXC
and the root filesystem using Debian "mmdebstrap".

Plocate runs on a systemd timer. I saw that it had not run.

Looking at the system logs using journalctl, I saw a plocate run error
reported :

Sep 26 10:22:34 eos (.plocate)[82]: plocate-updatedb.service: Failed to
set up network namespacing: Permission denied
Sep 26 10:22:34 eos systemd[1]: Starting plocate-updatedb.service -
Update the plocate database...
Sep 26 10:22:34 eos (.plocate)[82]: plocate-updatedb.service: Failed at
step NETWORK spawning /usr/sbin/updatedb.ploc>
Sep 26 10:22:34 eos systemd[1]: plocate-updatedb.service: Main process
exited, code=exited, status=225/NETWORK
Sep 26 10:22:34 eos systemd[1]: plocate-updatedb.service: Failed with
result 'exit-code'.

If I run plocate from the CLI (per systemd unit ExecStart) :

/usr/sbin/updatedb.plocate

It runs OK.

So a problem with plocate running from systemd inside a container.

To Fix :

I edit the systemd unit file :

/usr/lib/systemd/system/plocate-updatedb.service

Change :

PrivateNetwork=true

to (comment out)  :

#PrivateNetwork=true

Reload systemd and re-run :

systemctl daemon-reload
systemctl start plocate-updatedb

This now works, and I see in the logs :

Sep 26 10:23:58 eos systemd[1]: Reloading.
Sep 26 10:24:01 eos systemd[1]: Starting plocate-updatedb.service -
Update the plocate database...
Sep 26 10:24:01 eos systemd[1]: plocate-updatedb.service: Deactivated
successfully.
Sep 26 10:24:01 eos systemd[1]: Finished plocate-updatedb.service -
Update the plocate database.

I put my own version of the "plocate-updatedb.service" (without the
"PrivateNetwork" line) in the directory :

/etc/systemd/system

So there seems to be a problem with the systemd "PrivateNetwork" and
plocate inside an LXC container - which might not surprise due to LXC
using namespace magic as well.

Rather than adjusting the security of the plocate systemd unit, it might
be sufficient to document this problem in a README perhaps.

Many Thanks,

Alastair
#1052934#10
Date:
2023-09-26 14:21:44 UTC
From:
To:
Hi,

Thanks for tracking this down.

To me, this sounds like a bug in either systemd or LXC; plocate isn't
involved at all? I mean, there's nothing I can change in plocate to fix
this issue, short of just not using the not-working systemd option.

/* Steinar */
#1052934#15
Date:
2023-09-26 15:11:12 UTC
From:
To:
Thanks Steinar.

Yes, probably something somewhere else. Maybe a library plocate uses breaks with "PrivateNetwork" on. I do not know enough about the internals of containers, namespaces or systemd to know.

I am not sure what to do but thought it worth adding to the system.

I think it is reasonable to expect the timer to work in an LXC container - maybe it is at least worth a "README" mentioning this problem? Like a "known issues" document? e.g.

Debian 12 Bookworm
LXC 5.0.2-1
systemd 252.12-1~deb12u1
plocate 1.1.18-1

Note: If the Systemd unit setting "PrivateNetwork" is set as "true",  plocate may fail to run via the systemd unit file (from a systemd timer) inside an LXC container with an error :

Failed to set up network namespacing: Permission denied

This is due to the default setting "PrivateNetwork=true" in the unit file :

/usr/lib/systemd/system/plocate-updatedb.service

To avoid this, either :

1) Modify systemd unit

Copy the unit file to the directory :

/etc/systemd/system

and override the setting to "false" (or remove it). You will then need to re-load the systemd daemon :

systemctl daemon-reload

or :

2) Use cron

Instead of a systemd timer, use standard cron. You can remove the systemd check and "exit" in the plocate cron file "/etc/cron.daily/plocate".

Cheers, Alastair
#1052934#20
Date:
2023-09-26 16:05:12 UTC
From:
To:
No, my point is; I don't see that this is plocate-specific at all.
Every service or timer that uses PrivateNetwork=yes will be affected
by this. So plocate is the wrong place to fix it, and also the wrong
place to document it.

I guess a good place to start would be to reassign the bug to LXC
and see if they can work something out with systemd.

/* Steinar */
#1052934#25
Date:
2023-09-26 16:57:03 UTC
From:
To:
Thanks, that's fine.

Is a re-assignment to LXC something you do, or I do?

Cheers,

Alastair
#1052934#30
Date:
2023-09-26 17:02:48 UTC
From:
To:
Anyone can do it; you probably know better than me what the package name is.

/* Steinar */
#1052934#35
Date:
2023-09-26 17:10:22 UTC
From:
To:
I'll sort it out. The debian bug system seems a bit arcane compared with what I'm used to but I'll manage it.

Thanks for your help.

Alastair
#1052934#46
Date:
2023-09-26 23:07:16 UTC
From:
To:
Hi Alastair and Steinar,

  The root cause of this issue was found to be a bug in apparmor that
was fixed in kernel 6.2, but not yet backported to the 6.1 LTS tree for
bookworm. Lots of details are in bug #1050256. For now I won't reassign
this to src:linux, so hopefully it's easier to find by anyone else who
runs into the issue. I also updated the LXC/LXD wiki.d.o pages.

  For now, possible workarounds include modifying the service
definitions, installing a kernel from bookworm-backports on the host,
or disabling apparmor protections for the container.

  We were hoping a fix would be ready in time for the 12.2 point
release, but it's looking like that probably won't happen.

Mathias