3

I currently try to get GPIO-access into an unprivileged LXC application container. In future this container shall execute an application. But for now (while development) I just start a normal bash in the container:

sudo lxc-execute -n gpio-client -f /var/proj/gpio-client/lxc.conf -- bin/bash

When I do this with a privileged container (means my lxc.conf doesn't contain any UID- or GID-mapping) I can use the GPIO's.
The GPIO's can be access over files in /sys/class/gpio (following output comes from a bash within a privileged container which was started with the command above):

bash-4.3# cd /sys/class/gpio/
bash-4.3# ls -l
total 0
-rwxrwx---    1 gpio-cli 1001          4096 Feb 20 12:41 export
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 12:41 gpiochip890 -> ../../devices/gpiochip2/gpio/gpiochip890
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 12:41 gpiochip898 -> ../../devices/gpiochip1/gpio/gpiochip898
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 12:41 gpiochip906 -> ../../devices/soc0/amba/e000a000.gpio/gpio/gpiochip906
-rwxrwx---    1 gpio-cli 1001          4096 Feb 20 12:41 unexport

For example I am able to export a GPIO:

bash-4.3# echo 898 > export
bash-4.3# ls -l
total 0
-rwxrwx---    1 gpio-cli 1001          4096 Feb 20 14:06 export
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 14:06 gpio898 -> ../../devices/gpiochip1/gpio/gpio898
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 12:41 gpiochip890 -> ../../devices/gpiochip2/gpio/gpiochip890
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 12:41 gpiochip898 -> ../../devices/gpiochip1/gpio/gpiochip898
lrwxrwxrwx    1 gpio-cli 1001             0 Feb 20 12:41 gpiochip906 -> ../../devices/soc0/amba/e000a000.gpio/gpio/gpiochip906
-rwxrwx---    1 gpio-cli 1001          4096 Feb 20 12:41 unexport

When I print the running processes on the host with "ps -a" I can see the running bash as root:

      587 root       0:00 lxc-execute -n gpio-client -f /var/proj/gpio-client/lxc.conf -- bin/bash
      598 root       0:00 /init.lxc.static -- bin/bash
      615 root       0:00 bin/bash

But when I insert a UID- and GID-mapping into the lxc.conf (and also the subuids and subgids in /etc/subuid and /etc/subgid) I always get a "Permission denied" when I try to access /sys/class/gpio:

bash-4.3# cd /sys/class/
bash-4.3# ls -l
total 0
drwxrwx---    2 65534    gpio             0 Feb 20 14:11 gpio
bash-4.3# cd gpio/
bash: cd: gpio/: Permission denied

This is my lxc.conf:

# *************************************************************************
# * general configuration
# *************************************************************************

# container name
lxc.utsname = gpio-client

# *************************************************************************
# * configure networking
# *************************************************************************

lxc.network.type          =   veth
lxc.network.flags         =   up
lxc.network.link          =   local_br0
lxc.network.name          =   lxcnet0
lxc.network.hwaddr        =   4a:49:43:49:79:ac
lxc.network.ipv4          =   10.10.0.98
lxc.network.ipv4.gateway  =   10.10.0.1

# *************************************************************************
# * configure container filesystem
# *************************************************************************

# set rootfs
lxc.rootfs = /var/proj/gpio-client/rootfs

# mount needed directories from host
lxc.mount.entry=/lib                lib             none    ro,bind     0   0
lxc.mount.entry=/sys/class/gpio     sys/class/gpio  none    rw,bind     0   0
lxc.mount.entry=/sys/devices        sys/devices     none    rw,bind     0   0
lxc.mount.entry=/usr/lib            usr/lib         none    ro,bind     0   0
lxc.mount.entry=/usr/bin            usr/bin         none    ro,bind     0   0
lxc.mount.entry=/bin                bin             none    ro,bind     0   0

# *************************************************************************
# * configure privileges of container
# *************************************************************************

# map user and group ids
lxc.include = /usr/share/lxc/config/userns.conf
# comment the following out for a privileged container:
lxc.id_map = u 0 1000000 65536
lxc.id_map = g 0 1000000 65536

This is the running linux-system:

zedboard-zynq7:/var/proj/gpio-client$ cat /proc/version 
Linux version 4.6.0-rt1-xilinx-v2016.3 (sebastian@ubuntu1604vm) (gcc version 6.2.0 (GCC) ) #5 SMP PREEMPT RT Fri Apr 7 13:43:09 CEST 2017

The system was build using Yocto for a AVNET-Zedboard (which has a Xilinx Zynq-SoC).

Does anyone have an idea or advise how to get this running or where to find the solution/information for this? I tried to get it running for a couple of hours but unfortunately I didn't managed it...

Best regards
Sebastian

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.