Bug 1930552

Summary:	podman can not create user inside of container - regression introduced by fix for CVE-2021-20188
Product:	Red Hat Enterprise Linux 7	Reporter:	Joy Pu <ypu>
Component:	podman	Assignee:	Jindrich Novy <jnovy>
Status:	CLOSED ERRATA	QA Contact:	Martin Jenner <mjenner>
Severity:	high	Docs Contact:
Priority:	unspecified
Version:	7.9	CC:	bbaude, dwalsh, jligon, jnovy, lsm5, mheon, tsweeney, umohnani
Target Milestone:	rc	Keywords:	Extras, Regression
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	podman-1.6.4-29.el7_9 or newer	Doc Type:	No Doc Update
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-03-01 14:56:00 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Joy Pu 2021-02-19 06:51:33 UTC

Description of problem:
After fix https://bugzilla.redhat.com/show_bug.cgi?id=1918282, seems the permission inside container is not enough for create a new user correctly. The steps for setting up home directory always report Operation not permitted.

Version-Release number of selected component (if applicable):
podman-1.6.4-28.el7_9.x86_64 

How reproducible:
always

Steps to Reproduce:
1. Start a container
# podman run --name testctr -d docker.io/library/alpine:latest top
2. Use adduser to create a new user
# podman exec testctr adduser -S testuser
adduser: /home/testuser: Operation not permitted
adduser: /home/testuser: Operation not permitted
adduser: /home/testuser: Operation not permitted

3. Check the home directory
# podman exec -it testctr sh
/ # ls /home/ -l
total 0
drwxr-xr-x    2 root     root             6 Feb 19 06:38 testuser


Actual results:
adduser command failed to setup the home directory for new user


Expected results:
User can be created and used normally

Additional info:

Comment 21 Joy Pu 2021-02-23 17:34:09 UTC

Test with podman-1.6.4-29.el7_9.x86_64 and it works as expected now. So set this to verified.

Comment 23 errata-xmlrpc 2021-03-01 14:56:00 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Important: podman security update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2021:0681