systemd-logind failed after upgrade to version 242

odror · 2019-05-26 00:47:00

After upgrading systemd from version 241 to 242 My system (in lxc container) fail during boot.
systemd-logind service failed.

Does anyone know a fix or how to debug it. Any help will be appreciated.

# systemctl status systemd-logind.service

● systemd-logind.service - Login Service
Loaded: loaded (/usr/lib/systemd/system/systemd-logind.service; static; vendor preset: disabled)
Active: failed (Result: exit-code) since Sat 2019-05-25 17:15:15 PDT; 2min 48s ago
Docs: man:systemd-logind.service(8)
man:logind.conf(5)
https://www.freedesktop.org/wiki/Softwa … emd/logind
https://www.freedesktop.org/wiki/Softwa … /multiseat
Process: 155 ExecStart=/usr/lib/systemd/systemd-logind (code=exited, status=226/NAMESPACE)
Main PID: 155 (code=exited, status=226/NAMESPACE)

Lone_Wolf · 2019-05-26 12:59:49

The 226/NAMESPACE error is rather generic, but dmesg / journal should have additional lines that clarify what happened.

please post full dmesg and/or journalctl -b .

Last edited by Lone_Wolf (2019-05-26 13:00:15)

odror · 2019-05-26 14:52:50

The relevant info that I get from journalctl -b

is

May 25 16:51:15 arch systemd[119]: systemd-logind.service: Failed to set up mount namespacing: Permission denied
May 25 16:51:15 arch systemd[119]: systemd-logind.service: Failed at step NAMESPACE spawning /usr/lib/systemd/systemd-logind: Permission denied

I found additional info when running dmsg

[ 122.769106] audit: type=1400 audit(1558828275.240:75): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=10053 comm="(d-logind)" srcname="/" flags="rw, rbind"
[ 122.780096] audit: type=1400 audit(1558828275.252:76): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=10061 comm="(d-logind)" srcname="/" flags="rw, rbind"
[ 122.821259] audit: type=1400 audit(1558828275.292:77): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=10064 comm="(d-logind)" srcname="/" flags="rw, rbind"
[ 122.832618] audit: type=1400 audit(1558828275.304:78): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=10077 comm="(colord)" srcname="/" flags="rw, rbind"
[ 122.833491] audit: type=1400 audit(1558828275.304:79): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=10078 comm="(d-logind)" srcname="/" flags="rw, rbind"
[ 122.836421] audit: type=1400 audit(1558828275.308:80): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=10083 comm="(d-logind)" srcname="/" flags="rw, rbind"
[ 147.823658] audit: type=1400 audit(1558828300.301:81): apparmor="DENIED" operation="mount" info="failed flags match" error=-13 profile="lxc-container-default-with-nesting" name="/run/systemd/unit-root/" pid=12550 comm="(colord)" srcname="/" flags="rw, rbind"

Last edited by odror (2019-05-26 15:42:45)

odror · 2019-05-26 15:58:38

I "fixed" the issue by changing
guest arch config file.

from
lxc.apparmor.profile = lxc-container-default-with-nesting
to
lxc.apparmor.profile = unconfined

Somehow this does not right to me. Mostly because I do not know what it means.

I'd appreciate any comment.

Lone_Wolf · 2019-05-27 08:22:18

https://linuxcontainers.org/lxc/manpage … onf.5.html

APPARMOR PROFILE
If lxc was compiled and installed with apparmor support, and the host system has apparmor enabled, then the apparmor profile under which the container should be run can be specified in the container configuration.

emphasis mine

Did you configure archlinux to use apparmor or verify whether lxc on archlinux is built with apparmor support ?

odror · 2019-05-27 14:46:26

got the arch lxc container 4 years ago. It has current updates. It even runs graphics with passthrough nNvidia card. The host computer supports apparmor (kernel + lxc). I was not able to find any apparmor settings in the arch container. /etc/apparmor.d has only lightdm settings, which I am not using. I am using gdm.

My issue was that the new version of systemd (242) (of the guest arch container) fails unless I changed its apparmor profile
from:
lxc-container-default-with-nesting
to:
unconfined

I'd like to know if this is a bug in systemd or if some settings in the container needs to be changed to support the new version of systemd.

Lone_Wolf · 2019-05-28 10:11:05

So the host does support apparmor.
The rest of your answer confuses me more though.

I'd like to know if this is a bug in systemd or if some settings in the container needs to be changed to support the new version of systemd.

Not enough info available to troubleshoot.

Is the host running an uptodate archlinux system ?
If not, what OS/Distro is it running ?

Atm we know systemd-logind denies permission for something when you start the container.
If you post full dmesg and/or journalctl -b outputs (as i asked, but maybe you overlooked the word full) , maybe we'd have an idea what the something is and could troubleshoot.

N.B. we = forum posters and readers

Last edited by Lone_Wolf (2019-05-28 10:11:33)

odror · 2019-05-28 20:22:05

The host is running ubuntu 19.04 with apparmor support.

All I did to fix the issue was to change the config of the arch container
from
lxc.apparmor.profile = lxc-container-default-with-nesting
to
lxc.apparmor.profile = unconfined

Something has changed in systemd from version 241 to 242, where only a less restricted (privileged) contained is supported. I do not know if this is a bug, or a new feature in systemd. May be something needs to be modified in the systemd setup. I do not know enough about systemd to answer.

Lone_Wolf · 2019-05-29 08:39:55

Something has changed in systemd from version 241 to 242, where only a less restricted (privileged) contained is supported.

You're drawing conclusions based on one workaround.
With available info it's impossible to determine if there are better solutions.

We need more info.

The minimal info needed is the command used to start the container and the log from executing that command until logind denies permission.

Last edited by Lone_Wolf (2019-05-29 08:40:11)

Arch Linux

#1 2019-05-26 00:47:00

systemd-logind failed after upgrade to version 242

#2 2019-05-26 12:59:49

Re: systemd-logind failed after upgrade to version 242

#3 2019-05-26 14:52:50

Re: systemd-logind failed after upgrade to version 242

#4 2019-05-26 15:58:38

Re: systemd-logind failed after upgrade to version 242

#5 2019-05-27 08:22:18

Re: systemd-logind failed after upgrade to version 242

#6 2019-05-27 14:46:26

Re: systemd-logind failed after upgrade to version 242

#7 2019-05-28 10:11:05

Re: systemd-logind failed after upgrade to version 242

#8 2019-05-28 20:22:05

Re: systemd-logind failed after upgrade to version 242

#9 2019-05-29 08:39:55

Re: systemd-logind failed after upgrade to version 242

Board footer