Bug 1998037

Summary:	podman 3.2.3: unknown capability "CAP_BPF"
Product:	Red Hat Enterprise Linux 8	Reporter:	Sebastian Wagner <sewagner>
Component:	libcap	Assignee:	Zoltan Fridrich <zfridric>
Status:	CLOSED DUPLICATE	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	unspecified
Version:	CentOS Stream	CC:	bstinson, jligon, jnovy, jwboyer, lsm5, rsroka, tsweeney
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-08-27 09:29:16 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Sebastian Wagner 2021-08-26 10:24:25 UTC

This is super similar to https://bugzilla.redhat.com/show_bug.cgi?id=1946982 but this time, We have a different error message: 

bash[26804]: Error: OCI runtime error: container_linux.go:370: starting container process caused: unknown capability "CAP_BPF"
systemd[1]: ceph-783410ce-0504-11ec-8c25-001a4aab830c.service: Control process exited, code=exited status=126
systemd[1]: ceph-783410ce-0504-11ec-8c25-001a4aab830c.service: Failed with result 'exit-code'.
systemd[1]: Failed to start Ceph mon.a for 783410ce-0504-11ec-8c25-001a4aab830c.


This is the upstream run that failed: 

https://pulpito.ceph.com/pdonnell-2021-08-24_17:29:03-fs:workload-wip-pdonnell-testing-20210824.150835-distro-basic-smithi/6356265

Seems we tried running podman-3.2.3-0.10.module+el8.4.0+11989+6676f7ad.x86_64 on RHEL 8.4 and that combination seems to be broken. 

This is the podman run command that failed: 

/bin/podman run --rm --ipc=host --stop-signal=SIGTERM --net=host --entrypoint /usr/bin/ceph-mon --init -e CONTAINER_IMAGE=q
uay.ceph.io/ceph-ci/ceph:12c6370403d1ff9d4580beff2cfe964261fc5671 -e NODE_NAME=smithi023 -e CEPH_USE_RANDOM_NONCE=1 -v /var/log/ceph/783410ce-0504-11ec-8c25-001a4aab830c:/var/log/ceph:z -v /var/lib/ceph/783410ce
-0504-11ec-8c25-001a4aab830c/mon.a:/var/lib/ceph/mon/ceph-a:z -v /tmp/ceph-tmpymo1jjtl:/tmp/keyring:z -v /tmp/ceph-tmpq13q9m8_:/tmp/monmap:z quay.ceph.io/ceph-ci/ceph:12c6370403d1ff9d4580beff2cfe964261fc5671 --m
kfs -i a --fsid 783410ce-0504-11ec-8c25-001a4aab830c -c /dev/null --monmap /tmp/monmap --keyring /tmp/keyring --setuser ceph --setgroup ceph --default-log-to-file=false --default-log-to-journald=true --default-l
og-to-stderr=false --default-mon-cluster-log-to-file=false --default-mon-cluster-log-to-journald=true --default-mon-cluster-log-to-stderr=false

Unfortunately, I don't know which libcap version is installed on that host.

Comment 2 Zoltan Fridrich 2021-08-27 09:29:16 UTC

This is a duplicate of rhbz#1921576
in both cases the CAP_BPF is undefined.

*** This bug has been marked as a duplicate of bug 1921576 ***

Comment 3 Sebastian Wagner 2021-09-09 17:58:50 UTC

For the record, the fix is: https://github.com/ceph/ceph/blob/61be1d923d122a38f4cb4e4080f8521ae8b5a19b/qa/distros/podman/rhel_8.4_container_tools_rhel8.yaml#L12