[PR #147] [MERGED] fix(lxc): make a mounted socket's parent dir traversable for non-root plugin UIDs #147

New issue

Closed

opened 2026-10-15 12:52:21 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 12:52:21 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/LXC2Docker/pull/147
Author: @JBailes
Created: 7/20/2026
Status: ✅ Merged
Merged: 7/20/2026
Merged by: @JBailes

Base: main ← Head: fix/socket-dir-traversable-for-nonroot-plugins

📝 Commits (1)

76bd841 fix(lxc): make a mounted socket's parent dir traversable for non-root plugin uids

📊 Changes

2 files changed (+45 additions, -0 deletions)

View changed files

📝 internal/lxc/config.go (+15 -0)
📝 internal/lxc/config_test.go (+30 -0)

📄 Description

appendSocketMount chmods a shared socket to 0777 so any UID inside an LXC container can connect() to it (each container has its own UID view). But it left the socket's parent directory alone. That parent is created under the daemon's service umask — systemd hardening commonly sets UMask=0027 — which strips group/other execute and leaves e.g. /run/smoothnas-runtime at 0750.

A plugin process running as a non-root UID then gets EACCES on the socket path even though the socket itself is world-accessible, because it cannot traverse the 0750 directory. Live symptom on a SmoothNAS host: the runtime docker socket became unreachable to the (non-root) aimee-server plugin after every runtime restart, needing a manual chmod o+rx each time.

Fix: add group+other r-x to the socket's parent (preserving owner bits; Chmod ignores the umask) alongside the existing socket chmod. It runs on every container (re)creation, so it self-heals across daemon restarts. Unit-tested (TestAppendSocketMountMakesParentDirTraversable).

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/LXC2Docker/pull/147 **Author:** [@JBailes](https://github.com/JBailes) **Created:** 7/20/2026 **Status:** ✅ Merged **Merged:** 7/20/2026 **Merged by:** [@JBailes](https://github.com/JBailes) **Base:** `main` ← **Head:** `fix/socket-dir-traversable-for-nonroot-plugins` --- ### 📝 Commits (1) - [`76bd841`](https://github.com/games-on-whales/LXC2Docker/commit/76bd8410e3a90d80291b33e2ae65e940c3b90b7e) fix(lxc): make a mounted socket's parent dir traversable for non-root plugin uids ### 📊 Changes **2 files changed** (+45 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `internal/lxc/config.go` (+15 -0) 📝 `internal/lxc/config_test.go` (+30 -0) </details> ### 📄 Description `appendSocketMount` chmods a shared socket to `0777` so any UID inside an LXC container can `connect()` to it (each container has its own UID view). But it left the socket's **parent directory** alone. That parent is created under the daemon's service umask — systemd hardening commonly sets `UMask=0027` — which strips group/other execute and leaves e.g. `/run/smoothnas-runtime` at `0750`. A plugin process running as a **non-root UID** then gets `EACCES` on the socket path even though the socket itself is world-accessible, because it cannot **traverse** the `0750` directory. Live symptom on a SmoothNAS host: the runtime docker socket became unreachable to the (non-root) aimee-server plugin after every runtime restart, needing a manual `chmod o+rx` each time. Fix: add group+other `r-x` to the socket's parent (preserving owner bits; `Chmod` ignores the umask) alongside the existing socket chmod. It runs on every container (re)creation, so it self-heals across daemon restarts. Unit-tested (`TestAppendSocketMountMakesParentDirTraversable`). --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-15 12:52:21 +00:00

closed this issue
added the
pull-request
label

No labels

pull-request

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

games-on-whales/LXC2Docker#147

No description provided.

Rows
Columns