Bug 2118231

Giuseppe, can you look at this one too please?

I think this one is fixed upstream with:

commit d370e3c04660201e72ba6968342ce964c31a2d7f
Author: Kir Kolyshkin <kolyshkin>
Date:   Tue Jun 14 17:19:10 2022 -0700

    libct: fix mounting via wrong proc fd
    
    Due to a bug in commit 9c444070ec7, when the user and mount namespaces
    are used, and the bind mount is followed by the cgroup mount in the
    spec, the cgroup is mounted using the bind mount's mount fd.
    
    This can be reproduced with podman 4.1 (when configured to use runc):
    
    $ podman run --uidmap 0:100:10000 quay.io/libpod/testimage:20210610 mount
    Error: /home/kir/git/runc/runc: runc create failed: unable to start container process: error during container init: error mounting "cgroup" to rootfs at "/sys/fs/cgroup": mount /proc/self/fd/11:/sys/fs/cgroup/systemd (via /proc/self/fd/12), flags: 0x20502f: operation not permitted: OCI permission denied
    
    or manually with the spec mounts containing something like this:
    
        {
          "destination": "/etc/resolv.conf",
          "type": "bind",
          "source": "/userdata/resolv.conf",
          "options": [
            "bind"
          ]
        },
        {
          "destination": "/sys/fs/cgroup",
          "type": "cgroup",
          "source": "cgroup",
          "options": [
            "rprivate",
            "nosuid",
            "noexec",
            "nodev",
            "relatime",
            "ro"
          ]
        }
    
    The issue was not found earlier since it requires using userns, and even then
    mount fd is ignored by mountToRootfs, except for bind mounts, and all the bind
    mounts have mountfd set, except for the case of cgroup v1's /sys/fs/cgroup
    which is internally transformed into a bunch of bind mounts.
    
    This is a minimal fix for the issue, suitable for backporting.
    
    A test case is added which reproduces the issue without the fix applied.
    
    Fixes: 9c444070ec7 ("Open bind mount sources from the host userns")
    Signed-off-by: Kir Kolyshkin <kolyshkin>

It works well for runc-1.1.3-2.module+el8.7.0+15895+a6753917.

[root@ibm-x3650m4-01-vm-16 ~]# podman run quay.io/olmqe/interview:v1
10
21
22
25
26
28
20
23
24
27
29

[root@ibm-x3650m4-01-vm-16 ~]# podman run --uidmap 0:100:10000 quay.io/libpod/testimage:20210610 mount|grep proc
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
proc on /proc/asound type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/acpi type tmpfs (ro,context="system_u:object_r:container_file_t:s0:c624,c969",relatime,uid=100,gid=100)
devtmpfs on /proc/kcore type devtmpfs (rw,seclabel,nosuid,size=1890704k,nr_inodes=472676,mode=755)
devtmpfs on /proc/keys type devtmpfs (rw,seclabel,nosuid,size=1890704k,nr_inodes=472676,mode=755)
devtmpfs on /proc/timer_list type devtmpfs (rw,seclabel,nosuid,size=1890704k,nr_inodes=472676,mode=755)
devtmpfs on /proc/sched_debug type devtmpfs (rw,seclabel,nosuid,size=1890704k,nr_inodes=472676,mode=755)
tmpfs on /proc/scsi type tmpfs (ro,context="system_u:object_r:container_file_t:s0:c624,c969",relatime,uid=100,gid=100)

[root@ibm-x3650m4-01-vm-16 ~]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.7 Beta (Ootpa)

[root@ibm-x3650m4-01-vm-16 ~]# rpm -q runc podman systemd kernel
runc-1.1.3-2.module+el8.7.0+15895+a6753917.x86_64
podman-4.1.1-6.module+el8.7.0+15895+a6753917.x86_64
systemd-239-62.el8.x86_64
kernel-4.18.0-418.el8.x86_64

This bug has been verified on runc-1.1.4-1.module+el8.7.0+16493+89f82ab8.x86_64.

[root@hpe-dl380pgen8-02-vm-7 interview]# cat /etc/redhat-release 
Red Hat Enterprise Linux release 8.7 Beta (Ootpa)

[root@hpe-dl380pgen8-02-vm-7 interview]# rpm -q runc podman systemd kernel
runc-1.1.4-1.module+el8.7.0+16493+89f82ab8.x86_64
podman-4.2.0-1.module+el8.7.0+16493+89f82ab8.x86_64
systemd-239-65.el8.x86_64
kernel-4.18.0-422.el8.x86_64

[root@hpe-dl380pgen8-02-vm-7 interview]# podman run quay.io/olmqe/interview:v1
10
21
23
25
29
28
20
22
24
26
27
[root@hpe-dl380pgen8-02-vm-7 interview]# podman run --uidmap 0:100:10000 quay.io/libpod/testimage:20210610 mount|grep proc
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
proc on /proc/asound type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/acpi type tmpfs (ro,context="system_u:object_r:container_file_t:s0:c47,c896",relatime,uid=100,gid=100)
devtmpfs on /proc/kcore type devtmpfs (rw,seclabel,nosuid,size=1890744k,nr_inodes=472686,mode=755)
devtmpfs on /proc/keys type devtmpfs (rw,seclabel,nosuid,size=1890744k,nr_inodes=472686,mode=755)
devtmpfs on /proc/timer_list type devtmpfs (rw,seclabel,nosuid,size=1890744k,nr_inodes=472686,mode=755)
devtmpfs on /proc/sched_debug type devtmpfs (rw,seclabel,nosuid,size=1890744k,nr_inodes=472686,mode=755)
tmpfs on /proc/scsi type tmpfs (ro,context="system_u:object_r:container_file_t:s0:c47,c896",relatime,uid=100,gid=100)

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: container-tools:rhel8 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2022:7457