login fails with "FATAL: bad tty" inside LXC container

[ava1ar]

This is related to security restrictions inside the container and well known for while. login from util-linux checks the output of ttyname(fd) and doesn't accept null value (which is valid value for tty inside the unprivileged tty container). As a result on any Linux distribution, which use login from util-linux following command fails:
lxc exec <container_name> -- /bin/login -f <user_name>
with "FATAL: bad tty" inside container's log. However, debian and ubuntu are using login implementation from shadow project, which works fine for this case (login from shadow doesn't espect tty name is not null and simply assign it to UNKNOWN in this case).

[karelzak]

I don't understand how NULL could be a valid value from ttyname().

Anyway, login(1) calls vhangup() and re-opens the tty. We need the name to initialize the session. The name is also used for PAM, etc.

So, I don't think we can change the current behaviour. Maybe we can add extra option (e.g. --keep-tty) for special use-cases like containers.

[ava1ar]

This comment actually describes how it happens that tty has NULL name. This problem looks complex, assosiated with 3 big projects at a time: util-linux, lxc and glibc and I am not sure where the proper fix should be (most likely, something need to be addressed in all of this projects). I entered the bug with the following reasoning:

• lxc exec <container_name> -- /bin/login -f <user_name> fails for ArchLinux and Fedora but works for Debian and Ubuntu
• Debian and Ubuntu work since they are using login from shadow project, when Arch and Fedora are using util-linux version
• replacing login on Arch with version from shadow works
• get_terminal_name from ttyutils.c currently reports name, path and number for tty inside lxc as null, null, null, most likely since it dereferences the symlink, which points to the tty not created in container's namespace, however tty itself is fully workable.

I have some time for hacking this or testing possible fixes, but I am asking for direction to look for possible fix.