From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 4349D1FF0B3 for ; Wed, 11 Nov 2026 22:58:02 +0100 (CET) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id D6D472163D; Wed, 11 Nov 2026 22:57:59 +0100 (CET) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20260707; t=1794434265; x=1795039065; darn=lists.proxmox.com; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Ra9lpBft959Zsw1WZgizg7om9spHUQqZ1/+eUGQfYWQ=; b=liXL17QNWlkqUFHFxKN2nulKz/zGMrXvEY0xP1OgpLbxzhSEzCFNccaj0OXHfFcK/d gk8xNJ2JEEAjdtkNMSbHQXd4MMMFRixXcVMwPIxiK5GDI7eoJGL9xvBCBxVpdF8GRj6E QAxFhFnJUWEEZivlruvwTDOIO2AFXedtzLCG9ZwTLOww8dtn+Cut4XUKPDg+ZHkxnxgv PRSBHUPX+n3mDnx9TyYByrYpnd2PbiQ0K9hkIQIw0KE4odLVAhMDkS5WyXvtpmRWEWhK mTmlqHFezYH0VhzpD3JtxnV3RAEsPNBvxOpGigilmbSQ7AFEzqBu1+oz5sRrOMoqGSd8 IEDg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1794434265; x=1795039065; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=Ra9lpBft959Zsw1WZgizg7om9spHUQqZ1/+eUGQfYWQ=; b=lH1XJoOkWAZ/7UYuh2FBwU+9Fdd6j+DppdbAxwx5DT7XSKxaatFW9/D8xPjmQbd/Wz KBRAEI/yaQwwGFacFieRbwPBquDmMBEiOxvloH6ZNdbMZCSPC3SNKPTfKj0ChJrGZ3dx nGcpOrThq+aOHDjUcFuOu+azAlXAFL9D9sCXFOcXELdsPSTyX9bXlJbdS19/HUbMpzK9 blB1Y3KKbMJ0/gpkYopCTQeyIzSnn3OmD7Nk1qSc29L0tuw9ZOLDJV3iBKzggCZi+fdB 3vJepY2qp4JBfKr5nZ3mXpCLAo/aKHyeQuf0/3YEprBhgN2PNxmV1eLftuMqJaOp6ksX dKFQ== X-Gm-Message-State: APuU4Z8RN+TGXsOsJWqKgWRqxrY0jUQE9RnyXsi+TCmyiGw1HsdbDDYS 7CHoULZzHcRvyCcmx+L3IjNfIUwpZ/AOvY9jOwEW3Pygt1jHcyAXXvBq+1IU1wCy X-Gm-Gg: AYBFou0Xn1PjHUv73WUhT9WkuExTlaidUgn/hi1tiMNFR+2ezA9ADT5nRvF1+ZXFttU MkykHg5cP4sOSp9rxUgCOQN5JhCcP2iDs0Tg7r7uSU6ZJmbfthvwNojSKiY4rCUqydu29uIMiMo dKJfpGX5hDWPVCovrY8gOCvkvxYLPZa3C7Za8kKoApoPbgssyb+SufeUz7nqP40az7efSujWd50 gR9pfOdegwLGWlWBgOD+e9C2IVIH72NLrZ1EBW9kNi5vV4ePtTnFUyNNWus9rNp9fpNRrq+RgaQ rYREMJ0z+G8Danbx+VUUC1JlQ6OS4X1HpQl4R8/SfF/Y8yH34OgITDmCO5RscHEFDL1B9fTknFN DgoqW5RysxXTxdiByywNyZZaG0L4GlhfIEZ6aE2n6UYulPp/gX3VkZViUY2aRQU2LcbIwfERQaN gMKZFTY3hMKN6vXsjfExRnnEEWa7fu4jvW9/5UO1gGsecALYG83nDWWC0djHArTWBFiB9srhiub 0AVMXWZ3FaYvddbBFPaZsj1+7WvfM0OUe9mUwYB9W5kNgBnTSwIKS88axDpCrBtvc1PgzdM5k3j tZ6UzKCTgf76d5yK/ZMmUwd66FCn/rwtKxjZMlQvDi7Zu50NiggWfkLnKPRQM3UxtZVwzFLRlNU IImc9Jw+SiBo2/nTzSGYtc3ho5AZd X-Received: by 2002:a05:690c:3181:b0:8ab:41a5:63c with SMTP id 00721157ae682-8b3a823368cmr20031457b3.108.1794434264571; Wed, 11 Nov 2026 13:57:44 -0800 (PST) From: Lucas Barros To: pve-devel@lists.proxmox.com Subject: [PATCH container] fix #8295: mount all: do not let umask restrict the rootfs directories Date: Wed, 11 Nov 2026 18:57:39 -0300 Message-ID: <20261111215739.8325-1-lucasbarros.kam@gmail.com> X-Mailer: git-send-email 2.50.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy FREEMAIL_FROM 0.001 Sender email is commonly abused enduser mail provider SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: Y376WM4GUPQQNVQ75HKBIJE3MPL34ALU X-Message-ID-Hash: Y376WM4GUPQQNVQ75HKBIJE3MPL34ALU X-MailFrom: lucasbarros.kam@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: mount_all() creates /var/lib/lxc//rootfs with make_path(), which honors the umask of the calling process. When 'pct restore' or 'pct create' is run from a root shell with a restrictive umask like 0077, both /var/lib/lxc/ and its rootfs directory end up with mode 0700. For unprivileged containers, the archive is then extracted by the mapped root user via lxc-usernsexec, which cannot traverse /var/lib/lxc/ anymore, so the extraction fails with "Permission denied", the restore or creation is aborted and the new volume is removed again. Create the directories with mode 0755 independent of the umask, which is what they get with the default umask anyway. Signed-off-by: Lucas Barros --- Reproduced on a PVE 9 node (pve-container 6.1.18) with a local vzdump archive of an unprivileged Debian 13 container; the reporter used a PBS archive, which goes through the same mount_all() call in the create/restore API before extracting: before: $ (umask 0077; pct restore 9911 vzdump-lxc-9910-....tar.zst \ --storage local --unprivileged 1); echo "exit=$?" tar: /var/lib/lxc/9911/rootfs: Cannot open: Permission denied ... exit=255 $ stat -c '%A %U %n' /var/lib/lxc/9911 /var/lib/lxc/9911/rootfs drwx------ root /var/lib/lxc/9911 drwx------ root /var/lib/lxc/9911/rootfs $ (umask 0077; pct create 9912 local:vztmpl/debian-13-... \ --rootfs local:1 --unprivileged 1); echo "exit=$?" tar: /var/lib/lxc/9912/rootfs: Cannot open: Permission denied exit=255 after: restore with umask 0077: exit=0 drwxr-xr-x root /var/lib/lxc/9911 drwxr-xr-x root /var/lib/lxc/9911/rootfs create from template with umask 0077: exit=0 A privileged restore with umask 0077 worked before and still does. With the default umask nothing changes, as the directories already get mode 0755 there. The 'chmod' option of make_path() only applies to directories it creates, so the mode of an already existing /var/lib/lxc/ is not touched. I did not test with a PBS archive, as the lab node has no PBS. The pve-container test suite passes before and after. proxmox-perltidy reports no changes. This patch was prepared with the help of an LLM based coding assistant; I reviewed the change and ran the tests mentioned above myself. src/PVE/LXC.pm | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/PVE/LXC.pm b/src/PVE/LXC.pm index 59d803d..41258b6 100644 --- a/src/PVE/LXC.pm +++ b/src/PVE/LXC.pm @@ -1780,7 +1780,9 @@ sub mount_all { my ($vmid, $storage_cfg, $conf, $ignore_ro) = @_; my $rootdir = "/var/lib/lxc/$vmid/rootfs"; - File::Path::make_path($rootdir); + # The mapped root user of an unprivileged container needs to traverse these directories, for + # example when extracting an archive, so do not let a restrictive umask get in the way. + File::Path::make_path($rootdir, { chmod => 0755 }); my $volid_list = PVE::LXC::Config->get_vm_volumes($conf); PVE::Storage::activate_volumes($storage_cfg, $volid_list); -- 2.47.3