1

I test a Docker container (created from Nvidia CUDA image) started with the command:

docker run -i -t xxxxxx /bin/bash

I can see the root prompt, but still don't have privileges for some operations; for example, when I execute:

dmesg

I see "Permission denied". Why?

  • How did you install the image etc etc? – Tommiie Feb 13 at 9:44
  • docker pull nvcr.io/nvidia/cuda:9.0-devel-ubuntu16.04 ( newbie to container, just follow the steps. ) – Mark Feb 14 at 1:40
1

In modern Linux, being root does not necessarily mean having ultimate permissions. Capabilities mechanism provides more fine-grained control over permissions by breaking root's power in parts which may be granted/revoked to/from specific task individually, and Docker uses this mechanism.

By default, Docker drops many dangerous capabilities when it starts the containerized process, even if this process runs on behalf of root user. This is because the host kernel is shared between all containers and the host system, thus, some system calls from the privileged containerized process may reveal information about (your case) or even affect the "outer world". That is why you see "Permission denied" even while you run dmesg(1) as root.

Internally, dmesg(1) calls syslog(2) system call to obtain the kernel log. As per man capabilities, this system call requires specific capability - CAP_SYSLOG:

CAP_SYSLOG (since Linux 2.6.37)
    * Perform privileged syslog(2) operations.
      See syslog(2) for information on which operations require privilege.

This capability is dropped in Docker containers by default, so, dmesg(1) in your container fails.

If you trust the vendor of the image, or just don't care a lot about security, you may start the container with additional capability (--cap-add syslog):

docker run -it --cap-add syslog nvcr.io/nvidia/cuda:9.0-devel-ubuntu16.04

This will solve your issue.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.