Home / server / Questions / 720623
In Process
gucki
Asked: 2015-09-08 05:32:01 +0800 CST

Deny usage of host consoles/ tty to lxc container

  • 772

I'm running Ubuntu 12.04.5 LTS (lxc package 0.7.5-3ubuntu69) with a single lxc guest. Everything works fine, except the lxc container seems to use/ mess with the hosts tty devices.

As soon as the container is started I can no longer login into the host using its consoles because after entering the username it always shows me "Unable to determine your tty name." and then just hangs. Syslog on the host slowly fills up with "init: tty1 main process (17911) terminated with status 1" and "init: tty1 main process ended, respawning".

Is there any way to deny lxc access to the hosts consoles/ ttys? Is there any way to fix the host without having to reboot it?

Here's my current lxc container config:

lxc.utsname = guest1
lxc.rootfs = /var/lib/lxc/guest1/rootfs

lxc.devttydir = lxc
lxc.tty = 4
lxc.pts = 1024
lxc.mount  = /var/lib/lxc/guest1/fstab
lxc.arch = amd64
lxc.cap.drop = sys_module mac_admin mac_override
lxc.pivotdir = lxc_putold

# Interface for public network
lxc.network.type=veth
lxc.network.link=br0
lxc.network.flags=up
lxc.network.hwaddr = 00:16:3e:d6:01:04

# Interface for private network
lxc.network.type=veth
lxc.network.link=br1
lxc.network.flags=up
lxc.network.hwaddr = 00:16:3e:d6:01:05

# Deny access to all devices by default
lxc.cgroup.devices.deny = a

# Allow any mknod (but not using the node)
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m

# /dev/null and /dev/zero
lxc.cgroup.devices.allow = c 1:3 rwm
lxc.cgroup.devices.allow = c 1:5 rwm

# /dev/full
lxc.cgroup.devices.allow = c 1:7 rwm

# consoles
#lxc.cgroup.devices.allow = c 5:1 rwm
#lxc.cgroup.devices.allow = c 5:0 rwm
#lxc.cgroup.devices.allow = c 4:0 rwm
#lxc.cgroup.devices.allow = c 4:1 rwm

# /dev/{,u}random
lxc.cgroup.devices.allow = c 1:9 rwm
lxc.cgroup.devices.allow = c 1:8 rwm
lxc.cgroup.devices.allow = c 136:* rwm
lxc.cgroup.devices.allow = c 5:2 rwm

# rtc
lxc.cgroup.devices.allow = c 254:0 rwm

# fuse
#lxc.cgroup.devices.allow = c 10:229 rwm

# tun
#lxc.cgroup.devices.allow = c 10:200 rwm

# hpet
lxc.cgroup.devices.allow = c 10:228 rwm

# kvm
#lxc.cgroup.devices.allow = c 10:232 rwm
lxc

2 Answers

  1. It seems the solution to get back the hosts' TTYs was to remove the existing /dev/tty[1-4] devices on the host and recreate them using mknod.

    I didn't yet test if lxc breaks them again after restarting the container, but at least the above fixes it.

    • 0

  2. Try this option as part of config 

         lxc.devttydir = lxc

    This will create a directory rootfs/dev/lxc for tty1 and console for the specific container; In this case tty1 is the next freely available terminal that can be used by the container;

    • 0