Rootless, Device, USB Audio

[andrewgdunn]

Looking at #12125 and #16855 this may not be possible, but wanted to seek clarification: I'm trying to play audio on a USB DAC but from within a rootless container. I'm wondering what set of arguments is required (if this is even possible).

Host is Centos Stream 9, with SELinux enabled:

[root@muckle ~]# setsebool -P container_use_devices=true

The user I'd like to run rootless containers as (tune):

[root@muckle ~]# id tune
uid=3100(tune) gid=3100(tune) groups=3100(tune),63(audio)

Audio device:

[tune@muckle ~]$ lsusb | grep Schiit
Bus 003 Device 011: ID 30be:1000 Schiit Audio Schiit Bifrost 2 Unison USB

Invoking the container (testing with https://github.com/GioF71/mpd-alsa-docker):

podman run --name=mpd --group-add keep-groups --privileged --device /dev/snd --device /dev/bus/usb --env ALSA_OUTPUT_CREATE=yes giof71/mpd-alsa

Examine from container context

[tune@muckle ~]$ podman exec -it mpd /bin/aplay -l
aplay: device_list:274: no soundcards found...

Disable selinux on host:

[root@muckle ~]# setenforce 0

podman run --name=mpd --group-add keep-groups --privileged --device /dev/snd --device /dev/bus/usb --env ALSA_OUTPUT_CREATE=yes giof71/mpd-alsa

Examine from container context

[tune@muckle ~]$ podman exec -it mpd /bin/aplay -l
**** List of PLAYBACK Hardware Devices ****
card 0: USB [Schiit Bifrost 2 Unison USB], device 0: USB Audio [USB Audio]
  Subdevices: 1/1
  Subdevice #0: subdevice #0

So, with SELinux enabled is this possible to do rootless?

[Stoiker]

I am currently struggling with something similar, but for me only root-containers work.
Did you see #15930 (comment) ?

[Stoiker]

I would like to join this discussion, with a similar topic. I want to mount my cd-drive in a container rootless but can't get it to work.

Here is a minimal (not working) example:

- Dockerfile
FROM debian:bullseye

-Build & Run
podman build ./ -t device_test

podman run -it --device=/dev/sr0 --group-add keep-groups --privileged --entrypoint=sh device_test

-In the container
cd mnt
mkdir cdrom
mount -t iso9660 -o ro /dev/sr0 /mnt/cdrom
mount: /mnt/cdrom: permission denied.

ls -la /dev/sr0
brw-rw----+ 1 nobody nogroup 11, 0 Mar 26 20:32 /dev/sr0

id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)

-On the host
ls -la /dev/sr0
rw-rw----+ 1 root cdrom 11, 0 Mar 26 21:32 /dev/sr0

id
*not important* groups=....11(cdrom) `...

Fedora with SELinux enabled. Using the container as sudo fixes the issue.

Applying #15930 (comment) doesn't seem to work.
What am I missing?

(disclaimer: I also asked this question on fedora discussion, but I think this is the more appropriate place)

[Luap99]

You cannot mount most filesystems in a user namesapce, see user_namespaces(7)

Holding CAP_SYS_ADMIN within the user namespace that owns a
process's mount namespace allows that process to create bind
mounts and mount the following types of filesystems:

       •  /proc (since Linux 3.8)
       •  /sys (since Linux 3.8)
       •  devpts (since Linux 3.9)
       •  tmpfs(5) (since Linux 3.9)
       •  ramfs (since Linux 3.9)
       •  mqueue (since Linux 3.9)
       •  bpf (since Linux 4.4)
       •  overlayfs (since Linux 5.11)

iso9660 isn't one of them so you cannot mount it in a rootless container

[Stoiker]

Ah okay, learned something new, thx.
Can you comment on the difference to something like a GPU? During my research I also stumbled upon this: https://www.redhat.com/sysadmin/files-devices-podman and now I am puzzled. I would have guessed that stuff like a GPU is not as easily "shared" with user-space than drives

[andrewgdunn]

I got my hands on podman 5.x and wanted to confirm that I can access my DAC from container but require the following:

• setsebool -P container_use_devices=true
• the user to have membership to the audio group
• --device /dev/snd
• --group-add keep-groups