Bug 2144541
| Summary: | [container-tools:rhel8/toolbox] 'init-container' fails when /var/lib/flatpak, /var/lib/systemd/coredump or /var/log/journal on the host are mounted with nodev, noexec or nosuid | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Christophe GRENIER <grenier> |
| Component: | toolbox | Assignee: | Debarshi Ray <debarshir> |
| Status: | CLOSED ERRATA | QA Contact: | Petr Schindler <pschindl> |
| Severity: | high | Docs Contact: | |
| Priority: | medium | ||
| Version: | 8.7 | CC: | debarshir, desktop-qa-list, grenier, sbarcomb, tpelka, tpopela, vraghave |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | vraghave:
needinfo-
vraghave: needinfo- |
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | toolbox-0.0.99.4-5.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-14 15:27:28 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Christophe GRENIER
2022-11-21 15:37:56 UTC
I apologize for the late response. This one fell through the cracks. Sorry about that. > podman start --attach almalinux-toolbox-8 > ... > level=debug msg="Binding /var/lib/systemd/coredump to > /run/host/var/lib/systemd/coredump" > mount: /var/lib/systemd/coredump: filesystem was mounted, > but any subsequent operation failed: Unknown error 5005. > Error: failed to bind /var/lib/systemd/coredump to /run/host/var/lib/systemd/coredump Thanks a lot for the `podman start` logs! This is the all important line: mount: /var/lib/systemd/coredump: filesystem was mounted, but any subsequent operation failed: Unknown error 5005. It's coming from the container's entry point attempting this inside it's mount and user namespace: # mount --rbind -o ro /run/host/var/lib/systemd/coredump /var/lib/systemd/coredump mount: /var/lib/systemd/coredump: filesystem was mounted, but any subsequent operation failed: Unknown error 5005. Looking at the util-linux code [1] it becomes clear that 5005 is MNT_ERR_APPLYFLAGS. I suspect that on the host /var/lib/systemd/coredump is mounted with some restricted flags beyond 'ro' (like 'nodev', 'nosuid', 'noexec', etc.), and the kernel is unhappy that they are not being used inside the container's mount and user namespace. This wouldn't have failed if it was attempted inside the host's namespace. [1] https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/ Christophe, could you please show me the results from: $ df --output=target /var/lib/systemd/coredump Mounted on <mount-point> $ findmnt --output OPTIONS,PROPAGATION <mount-point> OPTIONS PROPAGATION ... ... Yes, /var is using nosuid Please find the requested information $ rpm -q toolbox toolbox-0.0.99.3-7.module_el8.8.0+3470+252b1910.x86_64 $ df --output=target /var/lib/systemd/coredump Mounted on /var $ findmnt --output OPTIONS,PROPAGATION /var OPTIONS PROPAGATION rw,nosuid,noatime,seclabel shared For what it's worth, I sent a pull request to get mount(8) to show a better error message: https://github.com/util-linux/util-linux/pull/2376 Toolbx pull request: https://github.com/containers/toolbox/pull/1340 (In reply to Debarshi Ray from comment #7) > Toolbx pull request: https://github.com/containers/toolbox/pull/1340 Christophe, would it be possible for you to test this pull request? Thanks for your patience and persistence. Where can I found the RPM for this pull request for RHEL/CentOS 8 ? (In reply to Christophe GRENIER from comment #13) > Where can I found the RPM for this pull request for RHEL/CentOS 8 ? You should be able to get them in https://kojihub.stream.centos.org/koji/taskinfo?taskID=2488636 (please keep in mind that these are only test builds) Thanks. With the new rpm, "toolbox enter almalinux-toolbox-8" now works correctly. I have also tested successfully toolbox create --image quay.io/toolbx-images/almalinux-toolbox:9 toolbox enter almalinux-toolbox-9 Let's use this bug for the 'rolling' stream of the container-tools module in RHELL 8. I filed bug 2231464 as the 4.0 stream counterpart. Built toolbox-0.0.99.4-5.el8: https://mbs.stream.rdu2.redhat.com/module-build-service/2/module-builds/649 https://kojihub.stream.rdu2.redhat.com/koji/taskinfo?taskID=2675260 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: container-tools:rhel8 security and bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:6939 |