On container storage drivers where CAP_DAC_OVERRIDE is not effective
(e.g. fuse-overlayfs in rootless mode, or VMs like Docker Desktop /
Colima on macOS), root cannot read files with mode 000 despite having
the capability in its effective set. This causes pam_unix.so account
management to fail with "Authentication service cannot retrieve
authentication info" when calling getspnam(), because glibc's NSS
files backend cannot open /etc/shadow.
Fedora and Arch ship /etc/shadow and /etc/gshadow as mode 000, relying
on CAP_DAC_OVERRIDE to grant root access. Set them to 0400 (owner-read)
after password setup so that standard POSIX owner checks suffice.
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
On macOS, Docker Desktop mounts all paths as private (rprivate) in its
Linux VM via VirtioFS, so rslave/rshared bind propagation is rejected.
Strip these propagation options from the generated docker create command
when running on Darwin.
Also fix a bug in distrobox-init where the socket path prefix stripping
used `sed 's|/run/host||g'` with the global flag, causing paths like
`/run/host/run/host-services/ssh-auth.sock` (a Docker Desktop socket)
to be mangled into `-services/ssh-auth.sock`. The leading `-` was then
parsed as a flag by `rm`, crashing the init script. Replace with shell
parameter expansion `${host_socket#/run/host}` which strips the prefix
exactly once.
distrobox-init detects "rootful" mode by checking if /run/host/etc/shadow
is accessible and owned by root. On macOS with Docker Desktop, all containers
run as root inside the Linux VM, so this check always succeeds even for
containers created without --root, causing a spurious first-shell password
prompt.
Fix this by having distrobox-create mount /dev/null:/run/.distrobox.rootless:ro
for every rootless container. distrobox-init now checks for this marker first
and skips the shadow heuristic when it is present.
This is backward-compatible: existing containers without the marker continue
to use the shadow-file heuristic as before.
Signed-off-by: Eric Curtin <eric.curtin@docker.com>
I had mounted my Docker at `/run/home/docker`. Docker then mounted my
home folder somewhere under an overlayfs folder there. Distrobox had
appeared frozen at "Setting up host's sockets integration..." as it
tried to traverse my entire home directory on a slow hard disk.
No relevant socket was found on any submount, so excluding the submounts
should be OK.
* fix: use mkdir -p to prevent error on existing user tcb directory
Use mkdir -p in setup_aptrpm() to prevent command failure if
/etc/tcb/$user already exists.
Signed-off-by: Andrey Limachko <liannnix@altlinux.org>
* fix: disable pam_mktemp for PAM stack compatibility
Private tmp directory is not needed as /tmp is mounted from host system.
Using pam_mktemp would break the PAM stack.
Signed-off-by: Andrey Limachko <liannnix@altlinux.org>
* fix: ALT Linux --init compatibility via runuser wrapper
ALT Linux ships its own su(1) implementation incompatible with util-linux
su flags. distrobox-enter passes -m, --pty, -s, -c when unshare_groups is
enabled (--init containers). These flags are rejected by ALT's su, causing
instant failure.
Add /usr/local/bin/su wrapper that delegates to /usr/sbin/runuser (from
util-linux, always present in ALT). The wrapper is placed in /usr/local/bin
to survive package updates, and the existing generic --pty-stripping wrapper
is guarded to not overwrite it.
Fix PATH ordering in distrobox-enter to ensure /usr/local/bin precedes
/usr/bin when host PATH is passed through. This follows FHS conventions
and guarantees the wrapper is found first.
Signed-off-by: Andrey Limachko <liannnix@altlinux.org>
---------
Signed-off-by: Andrey Limachko <liannnix@altlinux.org>
This fix ensures that the printed command in dry-run mode is the same
as the one that would be executed without the --dry-run flag.
The container command, either default or custom, is always appended to
the command in both normal and dry-run execution.
The inspect command to fetch the container status is now executed only
when not in dry-run mode.
* docs: update VSCode integration documentation
There are still some problems but it's the best I could test on my own
* docs: added a screenshot to better illustrate the process
* chore: fix lint errors
* fix: typo
Co-authored-by: Alessio Biancalana <alessio@dottorblaster.it>
* fix: typo
Co-authored-by: Alessio Biancalana <alessio@dottorblaster.it>
* fix: typo
Co-authored-by: Alessio Biancalana <alessio@dottorblaster.it>
---------
Co-authored-by: Alessio Biancalana <alessio@dottorblaster.it>
Modify user attributes (username, shell, GID, groups, UID) separately
with individual checks and fallbacks for each, rather than using a
single usermod call. This improves reliability by only modifying
attributes that differ from the expected values and provides more
granular error handling.
This also includes a fix in /etc/group that would make usermod fail if
it does not end with a newline.
Fix#1991Fix#1979
Signed-off-by: Luca Di Maio <luca.dimaio1@gmail.com>
The manual write of a user via printf to /etc/passwd and /etc/group
is missing a newline at the end of file.
That results in a failure in useradd parsing the content of the file
in the __getdelim function.
Introduced in #1932 as part of an effort to speed up the distrobox
start. Erroring is too much, we noticed a lot of errors in the CI that
were actually skippable, so removing the newly introduced error is an
attempt to ease the pain on that side.
Only install base packages and additional packages
at the first `distrobox enter`. The caveat is
that if the installation fails the distrobox
container is not created.
Add a check to not use su with --pty on su version
before 2.34 because a buggy implementation witch
cause control characters to be printed on the screen.
Also not use su implementation other from util-linux.
Closes#1830
When podman runs a container that prints stdout with no input, this is
appended to the return of the generate_create_command output, resulting
in an invalid command
Luca Di Maio
distrobox-docs-bot
Eric Curtin
Daniel Tang
Andrey A. Limachko
Gerhard de ClercqandAlessio Biancalana
dannyhpy
ludrolandAlessio Biancalana
renner
tblume
Pedro Rabello Sato
Taylor C. Richberger
Nils-Hero Lindemann
dependabot[bot]
Miau Lightouch
Yedaya Katsman
Yehor Borkov
Brandon Sutherland