fs.mqueue sysctl limits too low in rootless podman with IPC namespace

[LewisGaul]

Is it expected that with rootless podman the namespaced (when not using --ipc=host) mqueue sysctl limits are reduced from the values on the host?

[centos@localhost ~]$ sysctl fs.mqueue
fs.mqueue.msg_default = 65536
fs.mqueue.msg_max = 65536
fs.mqueue.msgsize_default = 8192
fs.mqueue.msgsize_max = 1048576
fs.mqueue.queues_max = 100000

[centos@localhost ~]$ podman run --rm --privileged busybox sysctl fs.mqueue
fs.mqueue.msg_default = 10
fs.mqueue.msg_max = 10
fs.mqueue.msgsize_default = 8192
fs.mqueue.msgsize_max = 8192
fs.mqueue.queues_max = 256

[centos@localhost ~]$ podman run --rm --privileged busybox sysctl fs.mqueue.msg_default=256
sysctl: error setting key 'fs.mqueue.msg_default': Permission denied

[centos@localhost ~]$ podman run --rm --privileged --ipc=host busybox sysctl fs.mqueue
fs.mqueue.msg_default = 65536
fs.mqueue.msg_max = 65536
fs.mqueue.msgsize_default = 8192
fs.mqueue.msgsize_max = 1048576
fs.mqueue.queues_max = 100000

Related issue: #5369

[LewisGaul]

I just came across https://docs.podman.io/en/v4.3/markdown/podman-run.1.html#sysctl-name-value, however this doesn't seem to work with rootless :(

[centos@localhost ~]$ podman run --rm --privileged --sysctl fs.mqueue.msg_default=256 busybox sysctl fs.mqueue
Error: runc: runc create failed: unable to start container process: error during container init: open /proc/sys/fs/mqueue/msg_default: permission denied: OCI permission denied

[LewisGaul]

I also just found existing discussion of this at https://lists.podman.io/archives/list/podman%40lists.podman.io/thread/M3HD6YLE24WSCP63OZ27ZUVNJMKTWNP5/

I have opened an internal discussion on this with the User Namespace maintainer of the kernel. We will see if anything comes of it.

@rhatdan Did anything come of it? :)

[rhatdan]

I never heard back.

[rhatdan]

According to Andrew Morton Yes.

commit dc55e35f9e810f23dd69cfdc91a3d636023f57a2
Author: Alexey Gladkov [email protected]
Date: Mon Feb 14 19:18:14 2022 +0100

ipc: Store mqueue sysctls in the ipc namespace

with a couple of later fixups, c579d60f0d0cd87552f64fdebe68b5d941d20309
and 12b677f2c697d61e5ddbcb6c1650050a39392f54

[LewisGaul]

Thanks for checking, that's helpful.