我一直在尝试让 OpenVPN 在 Ubuntu 16.04 上由 LXD 管理的 LXC 容器中运行。我已tun通过以下方式将设备添加到容器配置中lxc config edit container，并且已正确创建。我已运行
lxc config set mycontainer raw.lxc 'lxc.cgroup.devices.allow = c 10:200 rwm'
它会显示在容器配置中，但是当我运行
systemctl start [email protected]
我的错误日志中出现了这个：
Jul 13 09:52:56 lb systemd[1]: Failed to reset devices.list on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Failed to set devices.allow on /system.slice/system-openvpn.slice/[email protected]: Operation not permitted
Jul 13 09:52:56 lb systemd[1]: Starting OpenVPN connection to server...
-- Subject: Unit [email protected] has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit [email protected] has begun starting up.
Jul 13 09:52:56 lb systemd[1]: Failed to reset devices.list on /system.slice/ondemand.service: Operation not permitted
这是我的容器配置：
$ lxc config show --expanded lb
name: lb
profiles:
- default
config:
raw.lxc: lxc.cgroup.devices.allow = c 10:200 rwm
volatile.base_image: f452cda3bccb2903e56d53e402b9d35334b4276783d098a879be5d74b04e62e2
volatile.eth0.hwaddr: xx:xx:xx:xx:xx:xx
volatile.eth1.name: eth1
volatile.last_state.idmap: '[{"Isuid":true,"Isgid":false,"Hostid":231072,"Nsid":0,"Maprange":65536},{"Isuid":false,"Isgid":true,"Hostid":165536,"Nsid":0,"Maprange":65536}]'
devices:
eth0:
name: eth0
nictype: bridged
parent: lxdbr0
type: nic
eth1:
hwaddr: xx:xx:xx:xx:xx:xx
nictype: bridged
parent: lxdbr1
type: nic
root:
path: /
type: disk
tun:
path: /dev/net/tun
type: unix-char
ephemeral: false
/dev/net 中的文件如下：
$ ll /dev/net
total 0
drwxr-xr-x 2 root root 60 Jul 13 09:36 ./
drwxr-xr-x 9 root root 480 Jul 13 09:36 ../
crw-rw-rw- 1 root root 10, 200 Jul 13 09:36 tun
答案1
你仍然有一个 raw.lxc 对象。并且根据海报 (参见 Edit1)他做了完全相同的事情，没有用，使用“设备添加”才有效。试试看……