@ogra — I found time to test QEMU.
Alas, I still have the sudo problem. It’s replicated on QEMU, Multipass and VirtualBox.
At this point, I’m completely stuck. Why you should have a different experience from mine, I have no idea.
2 Likes
I decided to use a different approach!
I did as before, but this time with 24.04. I installed Ubuntu Core 24.04, and used LXC to launch 24.04.
I still had a problem with sudo, but the error message is different.
angus@panther:~$ id
uid=1001(angus) gid=1001(angus) groups=1001(angus),27(sudo),100(users)
angus@panther:~$ type sudo
sudo is /usr/bin/sudo
angus@panther:~$ ls -l /usr/bin/sudo
-rwsr-xr-x 1 root root 277936 Mar 2 12:56 /usr/bin/sudo
angus@panther:~$ sudo true
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
This made me think, hmm…
root@panther:~# lsblk --output=NAME,FSTYPE,FSVER,PARTLABEL,LABEL,UUID,FSAVAIL,FSUSE%,MOUNTPOINTS | grep -Ev '^loop|sr0'
NAME FSTYPE FSVER PARTLABEL LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1
├─sda2
├─sda3
├─sda4
└─sda5
Look at that. There’s no /dev/sda; just sda by itself. No file system on any partition. Commands blkid, findmnt, df and file don’t recognise it.
I returned to my 26.04 installation, and I see the same results.
@ogra — As your non-root users within LXC can use sudo, what does lsblk in your LXC installation show you?
Most likely the same set of virtual disks you see 
these are emulated on top of the lxd storage pool (if you actually run the sudo lxd init interactively you can see it setting up that emulated file space, there are not actually any disks)…
But that you see the same issue as well in 24.xx containers just underlines that it has nothing to do with the container itself but rather something with your environment outside of the container …
Do you actually run your VMs and containers on an external disk ?
https://discuss.linuxcontainers.org/t/can-not-use-sudo-command-in-the-container/7745/4
The container storage pool inherits any mount options from the actual disk it is living on, so if your physical disk is mounted with the nosuidoption this would apply inside the container as well …
1 Like
If you get a chance, please check. Something is different between your setup and mine, and I’m itching to discover it.
No. Everything is on my normal disk, which is a NVMe containing my one-and-only root partition (apart from EFI and boot).
That’s true of containers, but it’s not true of virtual machines such as QEMU and VirtualBox. That’s because containers share software resources (like the kernel) with the host, whereas virtual machines don’t.
In QEMU and VirtualBox, the virtual machine is 100% independent of the host. The machine shares physical hardware (physical RAM, physical disk space), obviously, but everything in the machine is virtual (the TPM, BIOS, RAM, CPU, hard disk, DVD, …). For example, if you change the contents of the TPM in VirtualBox, you can revert to a previous snapshot to undo the change. Running VirtualBox with the virtual drive physically stored on an external drive would make zero difference (apart from speed, which I have experienced).
Yes, but again, this is not a difference inside the container, have you checked your mount options outside, if you have any nosuid mounts ?
Note that the error message is exactly what you will get when trying to run sudo on a device that has the nosuid mount option used …
1 Like
Only the usual suspects. Here are all of my mounts, with the nosuid ones first:
nosuid
$ mount | grep -F nosuid
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,nosuid,relatime,size=7915292k,nr_inodes=1978823,mode=755,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1592120k,mode=755,inode64)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k,inode64)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
none on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1592120k,mode=755,inode64)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=1592116k,nr_inodes=398029,mode=700,uid=1000,gid=1000,inode64)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
16:14:42 ~
Others
$ mount | grep -Fv nosuid
/dev/mapper/vgubuntu-root on / type ext4 (rw,noatime,errors=remount-ro)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=32,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=6135)
/var/lib/snapd/snaps/acrordrdc_62.snap on /snap/acrordrdc/62 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/bare_5.snap on /snap/bare/5 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/canonical-livepatch_406.snap on /snap/canonical-livepatch/406 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/chromium-ffmpeg_112.snap on /snap/chromium-ffmpeg/112 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/chromium-ffmpeg_118.snap on /snap/chromium-ffmpeg/118 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/color-picker_26.snap on /snap/color-picker/26 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core_17292.snap on /snap/core/17292 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core18_2999.snap on /snap/core18/2999 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core20_2866.snap on /snap/core20/2866 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core22_2411.snap on /snap/core22/2411 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/cups_1225.snap on /snap/cups/1225 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/firefox_8585.snap on /snap/firefox/8585 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core24_1643.snap on /snap/core24/1643 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/firefox_8595.snap on /snap/firefox/8595 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/firmware-updater_226.snap on /snap/firmware-updater/226 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/fwupd_8528.snap on /snap/fwupd/8528 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gnome-3-28-1804_198.snap on /snap/gnome-3-28-1804/198 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gnome-42-2204_263.snap on /snap/gnome-42-2204/263 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gtk2-common-themes_13.snap on /snap/gtk2-common-themes/13 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gnome-46-2404_164.snap on /snap/gnome-46-2404/164 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/gtk-common-themes_1535.snap on /snap/gtk-common-themes/1535 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/htop_6110.snap on /snap/htop/6110 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/localpdf-studio_14.snap on /snap/localpdf-studio/14 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/mediainfo_46.snap on /snap/mediainfo/46 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/mpv_239.snap on /snap/mpv/239 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/mesa-2404_1165.snap on /snap/mesa-2404/1165 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/qt5-core20_24.snap on /snap/qt5-core20/24 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/shellcheck_1848.snap on /snap/shellcheck/1848 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snap-store_1367.snap on /snap/snap-store/1367 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snap-tpmctl_96.snap on /snap/snap-tpmctl/96 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapcraft_18124.snap on /snap/snapcraft/18124 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapcraft_18514.snap on /snap/snapcraft/18514 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapd-desktop-integration_387.snap on /snap/snapd-desktop-integration/387 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/snapd_27406.snap on /snap/snapd/27406 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/thunderbird_1170.snap on /snap/thunderbird/1170 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/wine-platform-6-stable_19.snap on /snap/wine-platform-6-stable/19 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/wine-platform-runtime_409.snap on /snap/wine-platform-runtime/409 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/xournalpp_116.snap on /snap/xournalpp/116 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/zellij_65.snap on /snap/zellij/65 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/dev/nvme0n1p2 on /boot type ext4 (rw,noatime)
/dev/nvme0n1p1 on /boot/efi type vfat (rw,noatime,fmask=0077,dmask=0077,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
nsfs on /run/snapd/ns/cups.mnt type nsfs (rw)
nsfs on /run/snapd/ns/canonical-livepatch.mnt type nsfs (rw)
nsfs on /run/snapd/ns/snapd-desktop-integration.mnt type nsfs (rw)
nsfs on /run/snapd/ns/fwupd.mnt type nsfs (rw)
nsfs on /run/snapd/ns/firmware-updater.mnt type nsfs (rw)
Although, as stated, that would make no difference whatsoever within VirtualBox, as VirtualBox’s system (and therefore sudo) is 100% independent of the host. Otherwise, you wouldn’t be able to run Linux as a guest in VirtualBox on a Windows host! Remember that VirtualBox isn’t a container.
But the lxd you run on top of it 
The LXD is inside the virtual machine, and therefore runs on top of the virtual machine, not on top of the host. Huge difference.
I can give you the mounts for the virtual machine (Ubuntu Core 26.04), if that helps.
nosuid
[redacted]@localhost:~$ mount | grep -F nosuid
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=1208304k,nr_inodes=819200,mode=755,inode64)
/dev/sda2 on /run/mnt/ubuntu-seed type vfat (rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /run/mnt/data type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-save-65f1c5b0-da33-4844-90ac-53c5307c577e on /run/mnt/ubuntu-save type ext4 (rw,nosuid,nodev,noexec,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /writable type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/chrony type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/cloud type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/dbus-1 type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/default/swapfile type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/environment type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/hosts type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/iproute2 type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/machine-id type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/modprobe.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/modules-load.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/motd.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/network/if-up.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/polkit-1/actions type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/polkit-1/rules.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/security/pwquality.conf type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/netplan type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/ssh type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/sudoers.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/systemd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/sysctl.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/udev/rules.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/update-motd.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/writable type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /snap type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/snapd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/snap type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /usr/lib/firmware type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /usr/lib/modules type ext4 (rw,nosuid,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=2463016k,nr_inodes=615754,mode=755,inode64)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64,usrquota)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot,memory_hugetlb_accounting)
none on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
none on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
/dev/sda2 on /boot/efi type vfat (rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /home type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /root type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/cache/apparmor type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/cache/snapd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/cloud type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/console-conf type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/dbus type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/dhcp type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/dhcpcd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/extrausers type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/misc type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/private/systemd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-save-65f1c5b0-da33-4844-90ac-53c5307c577e on /var/lib/snapd/save type ext4 (rw,nosuid,nodev,noexec,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/systemd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/waagent type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/log type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/tmp type ext4 (rw,nosuid,relatime)
none on /run/credentials/systemd-resolved.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,inode64)
none on /run/credentials/systemd-networkd.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,nodev,size=1208304k,nr_inodes=819200,mode=755,inode64)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=604148k,nr_inodes=151037,mode=700,uid=1000,gid=1000,inode64)
Others
[redacted]@localhost:~$ mount | grep -F nosuid
tmpfs on /run type tmpfs (rw,nosuid,nodev,size=1208304k,nr_inodes=819200,mode=755,inode64)
/dev/sda2 on /run/mnt/ubuntu-seed type vfat (rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /run/mnt/data type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-save-65f1c5b0-da33-4844-90ac-53c5307c577e on /run/mnt/ubuntu-save type ext4 (rw,nosuid,nodev,noexec,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /writable type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/chrony type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/cloud type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/dbus-1 type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/default/swapfile type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/environment type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/hosts type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/iproute2 type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/machine-id type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/modprobe.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/modules-load.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/motd.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/network/if-up.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/polkit-1/actions type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/polkit-1/rules.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/security/pwquality.conf type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/netplan type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/ssh type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/sudoers.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/systemd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/sysctl.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/udev/rules.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/update-motd.d type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /etc/writable type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /snap type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/snapd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/snap type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /usr/lib/firmware type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /usr/lib/modules type ext4 (rw,nosuid,relatime)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=2463016k,nr_inodes=615754,mode=755,inode64)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev,inode64,usrquota)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=600,ptmxmode=000)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,nosuid,nodev,relatime,pagesize=2M)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot,memory_hugetlb_accounting)
none on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
efivarfs on /sys/firmware/efi/efivars type efivarfs (rw,nosuid,nodev,noexec,relatime)
bpf on /sys/fs/bpf type bpf (rw,nosuid,nodev,noexec,relatime,mode=700)
debugfs on /sys/kernel/debug type debugfs (rw,nosuid,nodev,noexec,relatime)
tracefs on /sys/kernel/tracing type tracefs (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,nosuid,nodev,noexec,relatime)
fusectl on /sys/fs/fuse/connections type fusectl (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
none on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
/dev/sda2 on /boot/efi type vfat (rw,nosuid,nodev,noexec,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /home type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /root type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/cache/apparmor type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/cache/snapd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/cloud type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/console-conf type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/dbus type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/dhcp type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/dhcpcd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/extrausers type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/misc type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/private/systemd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-save-65f1c5b0-da33-4844-90ac-53c5307c577e on /var/lib/snapd/save type ext4 (rw,nosuid,nodev,noexec,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/systemd type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/lib/waagent type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/log type ext4 (rw,nosuid,relatime)
/dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a on /var/tmp type ext4 (rw,nosuid,relatime)
none on /run/credentials/systemd-resolved.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,relatime,inode64)
none on /run/credentials/systemd-networkd.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /run/snapd/ns type tmpfs (rw,nosuid,nodev,size=1208304k,nr_inodes=819200,mode=755,inode64)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,size=604148k,nr_inodes=151037,mode=700,uid=1000,gid=1000,inode64)
paddy-landau@localhost:~$ mount | grep -Fv nosuid
/dev/sda3 on /run/mnt/ubuntu-boot type ext4 (rw,relatime)
/run/mnt/data/system-data/var/lib/snapd/snaps/pc_227.snap on /run/mnt/gadget type squashfs (ro,relatime,errors=continue,threads=single)
/run/mnt/data/system-data/var/lib/snapd/snaps/core26_403.snap on / type squashfs (ro,relatime,errors=continue,threads=single)
/run/mnt/data/system-data/var/lib/snapd/snaps/pc-kernel_3589.snap on /writable/system-data/snap/pc-kernel/3589 type squashfs (ro,nodev,relatime,errors=continue,threads=single)
/run/mnt/data/system-data/var/lib/snapd/snaps/pc-kernel_3589.snap on /snap/pc-kernel/3589 type squashfs (ro,nodev,relatime,errors=continue,threads=single)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=35,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=1605)
/dev/sda3 on /boot/grub type ext4 (rw,relatime)
/run/mnt/data/system-data/var/lib/snapd/snaps/core26_403.snap on /snap/core26/403 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core24_1643.snap on /snap/core24/1643 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/core26_380.snap on /snap/core26/380 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/console-conf_88.snap on /snap/console-conf/88 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/run/mnt/data/system-data/var/lib/snapd/snaps/pc_227.snap on /snap/pc/227 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/pc-kernel_3419.snap on /snap/pc-kernel/3419 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/var/lib/snapd/snaps/lxd_40074.snap on /snap/lxd/40074 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/dev/sda2 on /var/lib/snapd/seed type vfat (ro,relatime,fmask=0022,dmask=0022,codepage=437,iocharset=iso8859-1,shortname=mixed,errors=remount-ro)
/run/mnt/ubuntu-seed/snaps/snapd_26865.snap on /snap/snapd/26865 type squashfs (ro,nodev,relatime,errors=continue,threads=single,x-gdu.hide,x-gvfs-hide)
/run/mnt/ubuntu-seed/snaps/snapd_26865.snap on /usr/lib/snapd type squashfs (ro,nodev,relatime,errors=continue,threads=single)
tmpfs on /media type tmpfs (rw,relatime,mode=755,inode64)
tmpfs on /mnt type tmpfs (rw,relatime,mode=755,inode64)
tmpfs on /var/lib/sudo type tmpfs (rw,relatime,mode=700,inode64)
nsfs on /run/snapd/ns/lxd.mnt type nsfs (rw)
tmpfs on /var/snap/lxd/common/ns type tmpfs (rw,relatime,size=1024k,mode=700,inode64)
nsfs on /var/snap/lxd/common/ns/shmounts type nsfs (rw)
nsfs on /var/snap/lxd/common/ns/mntns type nsfs (rw)
Given what you’ve been saying about the container, are you running LXD on your host machine instead of in your virtual machine? I haven’t tried that, because the whole point of my test is to try to understand, and get working, Ubuntu Core 26.04. In other words, I’m running Ubuntu Core 26.04 as if it were on my physical server next to my router.
My host machine is, of course, a desktop.
In case I’m being unclear (because I’m struggling to explain):
- Host: Ubuntu 24.04 Desktop
- Guest: Ubuntu Core 26.04…
- … which in turn is the Host for…
- Container: LXC.
That is, LXC is a container nested inside a virtual machine acting as its host. I’m not running LXC on my Desktop.
Interesting … /var/snap is where all snap daemons store their variable data …
The lxd storage pool should actually live in:
/var/snap/lxd/common/mntns/var/snap/lxd/common/lxd/storage-pools
So the top level FS is nosuid which indeed will block sudo from functioning in anything underneath …
You could try if:
sudo mount -o remount,suid /dev/mapper/ubuntu-data-479619f8-b27d-48d0-b0a8-af80f872d31a
Actually fixes the sudo behavior inside the container then …
1 Like
Interestingly, the UUID changes when I start the machine afresh. I used the new UUID with your command, and it made no difference, unfortunately.
I figured that as I have four virtual machines in addition to my desktop, I should test the hypothesis of the suid at the host level.
On each machine:
- Install LXD
- Create an LXC container
- Inside the LXC container, add a user with sudo privileges (the way you told me to)
- Go to the user (
su angus) - Check whether sudo works or fails
Here are the results.
| Machine | Type | sudo for user | |
|---|---|---|---|
| 1. | 24.04 Desktop | Bare metal | Works |
| 2. | 26.04 Desktop | VirtualBox | Works |
| 3. | 26.04 Server | VirtualBox | Works |
| 4. | 24.04 Core | VirtualBox | Fails |
| 5. | 26.04 Core | VirtualBox | Fails |
So, it’s nothing to do with the Desktop host being a problem, otherwise sudo wouldn’t have worked in the VirtualBox Desktop or the VirtualBox Server (columns 2 and 3).
This is clearly showing that Core itself is the problem.
In other words, it seems that your hypothesis is correct… when Core is the host (as it is, virtually, in VirtualBox).
At this point, considering that you cannot add a new user in Core anyway, this might be by design. You can’t add a new user (Admin or not) in Core, and therefore you can’t add an Admin user in LXC in Core.
I would love to be able to ask the devs whether this is deliberate or an accidental side effect. But, I wouldn’t know where to ask.
There’s only one test that I haven’t been able to run, and that’s installing Core on bare metal.
I have a spare 16 GB USB stick. Tomorrow, I’m going to try to install Core on the USB stick and boot directly from it. It’ll be as slow as molasses, but it will at least give one more data point.
I’ll let you know how it goes.
The user you add via console-conf (the first start wizard) has sudo permission by default (without password obviously since you are logging in via ssh key) and you can add an admin user just fine in lxd too but definitely not if there is a nosuid mount involved anywhere in the filesystem stack underneath lxd…
Well, you are talking to one, I’m one of the original devs of UbuntuCore but moved out of actual development into field engineering a few years ago… since I left the system has changed quite a bit (the last version I was involved with on a developer level was UbuntuCore 22 (Btw, we do not call Core 26.04 but only 26 as there are no non-LTS releases the month doesn’t really matter), before TPM/FDE showed up)
I have already asked internally about the fact that you see the nosuid mount of /var/snap, it might be related to how TPM//FDE handles the mounting… though it is Friday evening, not sure anyone is still around to answer, we might have to wait…
Lxd is rarely used with non-root users, so I guess nobody noticed before (but it would indeed be a regression) and other snaps are generally not allowed to ship suid binaries, lxd is a special case here since it dynamically installs a rootfs image for its container (which indeed ships a bunch of suid binaries)
EDIT: one more thing, lxd actually mounts it’s storage pool in a namespace, it could well be that the remount only works if you remove lxd and re-install it afterwards (verify with the mount command that the nosuid option is actually gone, then remove (with –purge) and reinstall lxd) so that the the namespace is cleared too.
2 Likes
In LXD, yes, but in the underlying Core, you can’t, admin or not. Core seems to allow just root, and nothing else.
Thank you! Please let us know when you get an answer.
As the mount is a temporary one that’s recreated each time you boot, wouldn’t that cause it to fail when you next reboot the computer?
I’ve just realised that when you boot from Core on a stick, it doesn’t ask you where to install it. That means that it will overwrite the computer’s hard drive, which is exactly what I don’t want!
So, I won’t be able to test on bare metal after all, because I don’t have a spare machine to play around with.
Err, in core a default user is created with your SSO credentials that you type into the first start wizard after you configured the network, that is an admin user by default with full sudo credentials… the root account is locked (like on every Ubuntu)
It should only use the media it was booted from for installation (i.e. create all its partitions on the USB Stick) but you could indeed unplug your harddisk to be safe (I simply tend to use an RPi for such tests, not sure if you have something like that lying around though)
2 Likes
Not everything. Your CPU, as most any recent one, probably has hardware virtualization features, which allow running VM code on bare metal, to an extent. When you run a QEMU VM on linux, you are probably acutally running QEMU/KVM, unless you have disabled said HW virtualization in your host’s EFI (AMD-V, Intel VT-x). There are also device pass-through extensions (VT-d).
Virtualbox will also make use of those extensions. Without them VM performance is quite a lot worse.
I don’t know how relevant this is, though, in the context of nosuid affecting your VM’s.
1 Like
Oops, sorry! Yes, of course, you are correct.
Unplugging my hard disk could be a problem. I don’t know enough about hardware to be confident of doing this without breaking something. I’d better not proceed with this.
Sorry, I don’t have a Raspberry Pi. Or any spare computer, for that matter.
I think that this is a red herring. The problem is happening at the software level, not the hardware level. If it were at the hardware level, it wouldn’t work on the non-Core platforms. It really wouldn’t make any sense for the hardware to affect the authorisation of sudo on the host or within a guest.
I didn’t mean that it’s at the hardware level. Those extensions are prerequisites for the whole of virtio, which does include sharing the host’s filesystem among many other things. But I seem to remember that you don’t use that type of VM storage, so you are probably correct that this is not the cause of the issue at hand.
1 Like
I’ve only just realised that in LXC, there is already a default Admin user ubuntu.
root@abercorn:~# id ubuntu
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),24(cdrom),27(sudo),30(dip),102(lxd)
However, the same problem arises when trying to use sudo.
[redacted]@localhost:~$ lxc exec abercorn -- su --login ubuntu
ubuntu@abercorn:~$ sudo true
sudo: sudo must be owned by uid 0 and have the setuid bit set
Let’s circle back to this one then.
Perhaps the type of storage pool is of interest here?
1 Like
Yes. I think that Oliver hit the nail on the head there.
Therefore, to use root commands in LXC in Ubuntu Core 26, you have no choice but to use root itself instead of sudo.
As it happens, I’ve been spending today figuring out ways to harden security around this limitation, and I think that I’ve done OK. Not perfectly by any means, but OK.
Perhaps it also makes a difference how su is invoked? exec replaces the shell. Try this:
lxc shell abercon
su - ubuntu
(su - is shorthand for su --login)
or, as, I think, Oliver suggested earlier:
lxc exec abercon sh -c 'su - ubuntu'
However, I believe that to be but a fancy way of doing the former. Also, findmnt should be able to help:
$ findmnt .
TARGET SOURCE FSTYPE OPTIONS
/home/peter/tmp tmp_peter tmpfs rw,nosuid,nodev,size=33554432k,mode=750,uid=1000,gid=1000,inode64,huge=within_size
Question is, if it’s available; may need to install util-linux first.