Lxc file push of symbolic link fails

votsalo · October 21, 2019, 10:46am

with snap lxd, I cannot push a file that has a symbolic link in its path
Client version: 3.18
Server version: 3.18

steps to reproduce:

touch /opt/a.txt
cd $HOME
ln -s /opt/a.txt .
lxc file push a.txt {container}/root/

result:
Error: open /var/lib/snapd/hostfs/home/{user}/a.txt: no such file or directory

This happens if the symbolic link points to an absolute path.
It is not a problem for some relative symlinks, like: ln -s a.txt b.txt; lxc file push b.txt …

Is this known? Fixable? A snapd issue or an LXD issue?
I ran into it while pushing my ~/.ssh/authorized_keys to the container. I forgot that I had ~/.ssh linked somewhere else, and I was baffled until I figured out that the link caused the problem.

gpatel-fr · October 21, 2019, 11:44am

You would get a similar result with any snap application, restrictions for file access outside of the home directory apply.

votsalo · October 21, 2019, 12:43pm

But I can push /opt/a.txt just fine. The problem does not seem to be the location outside of the home directory, but the symbolic link from home to somewhere outside of home.

gpatel-fr · October 21, 2019, 1:00pm

Nonetheless it is working fine with non snap lxd. Possibly snap is nixing symbolic links because it’s an easy workaround of it’s security ‘features’.

simos · October 21, 2019, 1:14pm

Indeed, if you use the non-snap LXD client (i.e. go get github.com/lxc/lxd/lxc and then use executable from ~/go/bin/), then it works.

The affected code should be at or around:

github.com

lxc/lxd/blob/master/lxc/file.go#L314




		var targetPath string
		if targetIsDir {
			targetPath = path.Join(target, path.Base(pathSpec[1]))
		} else {
			targetPath = target
		}


		logger.Infof("Pulling %s from %s (%s)", targetPath, pathSpec[1], resp.Type)


		if resp.Type == "symlink" {
			linkTarget, err := ioutil.ReadAll(buf)
			if err != nil {
				return err
			}


			// Follow the symlink
			if targetPath == "-" || c.file.flagRecursive {
				for {
					newPath := strings.TrimSuffix(string(linkTarget), "\n")
					if !strings.HasPrefix(newPath, "/") {

Since lxc file push /opt/myfile.txt ... works but not the symlink to that file, then it is likely that the client is reading the file in the first case, and in the second it sends the file path so that the server performs the copy (and cannot find the file due to mount namespaces).

gpatel-fr · October 21, 2019, 1:36pm

while I agree generally with what you say, it’s unlikely you have linked to the relevant code since the message included in the quoted part is:

and here it’s pushing
relevant code is probably more around this part
Now I have seen this, I’m not sure anymore that’s not a bug with snap lxd.