/proc/kmsg: Permission denied.

[Keyinator]

Hello, I have the following problem on an Ubuntu 21.10 LXC:
``
Apr 27 17:48:40 game-dev rsyslogd: imklog: cannot open kernel log (/proc/kmsg): Permission denied.
Apr 27 17:48:40 game-dev rsyslogd: activation of module imklog failed [v8.2102.0 try https://www.rsyslog.com/e/2145 ]
``

I found it while trying to enable logging for iptables.
Any idea how this could be fixed?

I can't even open the file as root

 

[Dunuin]

For access to /proc and /sys you need to enable the "nesting" flag in the LXCs options.

 

[Keyinator]

For access to /proc and /sys you need to enable the "nesting" flag in the LXCs options.

Nesting is already activated.
Is the only other option to make the container privileged?

 

[Keyinator]

I have just looked and seen that other files ``/proc`` can be opened. Example ``/proc/uptime``.

Edit:
The permissions between kmsg and keys are different but should be readable by root. I am able to open keys however and not kmsg.
View attachment 36303
Imgur-Link if the attachment does not open: https://i.imgur.com/AavYxrG.png

 

[Dunuin]

Keep the user remapping of unprivileged LXC in mind. UID/GID 0 to 65535 on the host are mapped to UID/GID 100000 to 165535 inside the LXC. So your LXCs root (shown as UID 0 inside the LXC) is in reality just a unprivileged user with UID 100000 on the host. If something is owned by nobody:nogroup your unprivileged root doesn't always has access to it. If you for example bind-mount a folder owned by UID 1000 from the host into the LXC without editing the user remapping it will be shown as owned by nobody:nogroup and even your LXCs root won't be able to access it.

 

[Keyinator]

Keep the user remapping of unprivileged LXC in mind. UID/GID 0 to 65535 on the host are mapped to UID/GID 100000 to 165535 inside the LXC. So your LXCs root (shown as UID 0 inside the LXC) is in reality just a unprivileged user with UID 100000 on the host. If something is owned by nobody:nogroup your unprivileged root doesn't always has access to it. If you for example bind-mount a folder owned by UID 1000 from the host into the LXC without editing the user remapping it will be shown as owned by nobody:nogroup and even your LXCs root won't be able to access it.

Ah. That makes sense.
I am not sure what the right way to "fix" this would be.
Using ``chmod 444 /proc/kmsg`` and would this pose any security risks?

Edit:
``chmod 444 /proc/kmsg`` on the node did not help