3

Can someone please explain this weird behaviour to me:

I have an unpriviliged LXC container with firefox inside.

If firefox is running on the host outside of the container, /usr/bin/firefox inside the container launches a new firefox window outside on the host with the UID of the host user.

If firefox is NOT running outside of the container, /usr/bin/firefox inside the container launches firefox with the (SUB)UID of the container user like it should be.

The reverse is also true: If firefox is running inside the container (but not on the host), and firefox is started on the host, the firefox which is started has the UID of the container user.

?!?! How is that ?!?!

EDIT: Confirmed that the same issue emerges when using a default unprivileged Ubuntu container with default configuration file.

EDIT: asked the same question in the arch forums https://bbs.archlinux.org/viewtopic.php?pid=1622174#p1622174

config file:

lxc.devttydir = lxc 
lxc.pts = 1024
lxc.tty = 4 
lxc.cap.drop = mac_admin mac_override sys_time sys_module
lxc.pivotdir = lxc_putold
lxc.hook.clone = /usr/share/lxc/hooks/clonehostname
lxc.cgroup.devices.deny = a 
lxc.cgroup.devices.allow = c *:* m
lxc.cgroup.devices.allow = b *:* m
lxc.cgroup.devices.allow = c 1:3 rwm 
lxc.cgroup.devices.allow = c 1:5 rwm 
lxc.cgroup.devices.allow = c 1:7 rwm 
lxc.cgroup.devices.allow = c 5:0 rwm 
lxc.cgroup.devices.allow = c 5:1 rwm 
lxc.cgroup.devices.allow = c 5:2 rwm 
lxc.cgroup.devices.allow = c 1:8 rwm 
lxc.cgroup.devices.allow = c 1:9 rwm 
lxc.cgroup.devices.allow = c 136:* rwm 
lxc.cgroup.devices.allow = c 10:229 rwm 
lxc.mount.auto = cgroup:mixed proc:mixed sys:mixed
lxc.mount.entry = /sys/fs/fuse/connections sys/fs/fuse/connections   none bind,optional 0 0 
lxc.seccomp = /usr/share/lxc/config/common.seccomp
lxc.hook.mount = /usr/share/lxcfs/lxc.mount.hook
lxc.hook.post-stop = /usr/share/lxcfs/lxc.reboot.hook
lxc.mount.entry = /sys/kernel/debug sys/kernel/debug none bind,optional 0 0 
lxc.mount.entry = /sys/kernel/security sys/kernel/security none bind,optional 0 0 
lxc.mount.entry = /sys/fs/pstore sys/fs/pstore none bind,optional 0 0 
lxc.mount.entry = mqueue dev/mqueue mqueue rw,relatime,create=dir,optional 0 0 
lxc.cgroup.devices.allow = c 254:0 rm
lxc.cgroup.devices.allow = c 10:200 rwm 
lxc.cgroup.devices.allow = c 10:228 rwm 
lxc.cgroup.devices.allow = c 10:232 rwm 
lxc.cgroup.devices.deny =
lxc.cgroup.devices.allow =
lxc.devttydir =
lxc.mount.entry = /dev/console dev/console none bind,create=file 0 0 
lxc.mount.entry = /dev/full dev/full none bind,create=file 0 0 
lxc.mount.entry = /dev/null dev/null none bind,create=file 0 0 
lxc.mount.entry = /dev/random dev/random none bind,create=file 0 0 
lxc.mount.entry = /dev/tty dev/tty none bind,create=file 0 0 
lxc.mount.entry = /dev/urandom dev/urandom none bind,create=file 0 0 
lxc.mount.entry = /dev/zero dev/zero none bind,create=file 0 0 
lxc.mount.entry = /sys/firmware/efi/efivars sys/firmware/efi/efivars  none bind,optional 0 0 
lxc.mount.entry = /proc/sys/fs/binfmt_misc proc/sys/fs/binfmt_misc none bind,optional 0 0 
lxc.arch = x86_64
lxc.cgroup.devices.allow = c 226:* rwm 
lxc.mount.entry = tmpfs tmp tmpfs defaults
lxc.mount.entry = /dev/dri dev/dri none bind,optional,create=dir
lxc.mount.entry = /tmp/.X11-unix tmp/.X11-unix none ro,bind,create=dir 0 0

The container is started like this:

lxc-start -n c1 -F -f /path/to/above/conf -s 'lxc.id_map = u 0 100000 65536' -s 'lxc.id_map = g 0 100000 65536' -s 'lxc.rootfs = /path/to/rootfs' -s 'lxc.init_cmd = /usr/bin/bash'

EDIT: Distribution Arch Linux

$ uname -r
4.6.0-rc4-customGIT+

# lxc-checkconfig
--- Namespaces ---
Namespaces: enabled
Utsname namespace: enabled
Ipc namespace: enabled
Pid namespace: enabled
User namespace: enabled
Network namespace: enabled
Multiple /dev/pts instances: enabled

--- Control groups ---
Cgroup: enabled
Cgroup clone_children flag: enabled
Cgroup device: enabled
Cgroup sched: enabled
Cgroup cpu account: enabled
Cgroup memory controller: enabled
Cgroup cpuset: enabled

--- Misc ---
Veth pair device: enabled
Macvlan: enabled
Vlan: enabled
Bridges: enabled
Advanced netfilter: enabled
CONFIG_NF_NAT_IPV4: enabled
CONFIG_NF_NAT_IPV6: enabled
CONFIG_IP_NF_TARGET_MASQUERADE: enabled
CONFIG_IP6_NF_TARGET_MASQUERADE: enabled
CONFIG_NETFILTER_XT_TARGET_CHECKSUM: enabled
FUSE (for use with lxcfs): enabled

--- Checkpoint/Restore ---
checkpoint restore: enabled
CONFIG_FHANDLE: enabled
CONFIG_EVENTFD: enabled
CONFIG_EPOLL: enabled
CONFIG_UNIX_DIAG: enabled
CONFIG_INET_DIAG: enabled
CONFIG_PACKET_DIAG: enabled
CONFIG_NETLINK_DIAG: enabled
File capabilities: enabled
5
  • 1
    try firefox -no-remote to not connect to a running firefox.
    – meuh
    Apr 22, 2016 at 6:36
  • 1
    thanks for that suggestion, but I think the real issue, is that it seems possible at all to start some program on the host when inside the container - i want to forbid that globally
    – MCH
    Apr 22, 2016 at 12:13
  • 2
    If you are sharing an X display with the container, then programs in the container will be able to communicate with programs outside the container. This is what firefox is doing, and @meuh's solution is correct. The container is not "launching some program on the host", it is sending a notification to a program that is already running on the host.
    – larsks
    Apr 22, 2016 at 14:09
  • @larsks Is it possible to forbid programs to 'send a notification to a program that is already running on the host'?
    – MCH
    Apr 23, 2016 at 19:31
  • In the case of applications that have access to your X display, I don't think so, but I am not an X11 expert.
    – larsks
    Apr 24, 2016 at 0:39

1 Answer 1

2

It connects to the running instance of Firefox on the same X display and asks it to simply open a new window.

The same behavior can be observed when trying to start Firefox under ssh -Y (even to another host). (However, not under su - SOME_USER for some reason. That's a puzzle for me.)

This behavior can be turned off with an option:

firefox --new-instance
1
  • 1
    su probably resets the environment variables. Try sudo --preserve-env ....
    – Billy
    Aug 16, 2018 at 22:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .