Bug 1053485
| Summary: | Changing GID_MIN in login.defs prevents app creation | ||||||
|---|---|---|---|---|---|---|---|
| Product: | OpenShift Container Platform | Reporter: | Josep 'Pep' Turro Mauri <pep> | ||||
| Component: | Containers | Assignee: | Brenton Leanhardt <bleanhar> | ||||
| Status: | CLOSED ERRATA | QA Contact: | libra bugs <libra-bugs> | ||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 2.0.0 | CC: | cpelland, gpei, libra-onpremise-devel | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2014-05-15 14:41:02 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
|
Description
Josep 'Pep' Turro Mauri
2014-01-15 10:29:42 UTC
Created attachment 871493 [details]
possible patch
AFAICT the cause of this problem is that the selinux container assumes that useradd will create a group with gid==uid, which is not necessarily true. e.g. a GID_MIN higher than the lowest available uid would trigger that problem.
Attaching a sample change that first creates the group and specifies the gid in the useradd invocation, which fixes the problem in my test env.
(In reply to Josep 'Pep' Turro Mauri from comment #0) > Steps to Reproduce: > 1. edit /etc/login.defs in the node, set GID_MIN to 1001 > 2. try 'rhc app create ...' from a client A simpler reproducer, on a fresh node install this should reproduce the problem: # sed -i.bak -e 's/^GID_MIN.*/GID_MIN 10000/' /etc/login.defs # oo-devel-node app-create -c testing123 --with-namespace deleteme --with-app-uuid testing123 --with-app-name testing123 results in: Shell command '/sbin/runuser -s /bin/sh testing123 -c "exec /usr/bin/runcon 'unconfined_u:system_r:openshift_t:s0:c0,c1000' /bin/sh -c \"/usr/bin/ssh-keygen -N '' -f /var/lib/openshift/testing123/.openshift_ssh/id_rsa\""' returned an error. rc=1 Generating public/private rsa key pair. Saving the key failed: /var/lib/openshift/testing123/.openshift_ssh/id_rsa. open /var/lib/openshift/testing123/.openshift_ssh/id_rsa failed: Permission denied. This change looks reasonable. I'll sync with upstream to see what their thoughts are and if there was any reason the code assumed uid==gid. On a related note, it definitely seems like we need an oo-diagnostics check to make sure UID_MIN/MAX and GID_MIN/MAX in /etc/login.defs are compatible with GEAR_MIN/MAX_UID in /etc/openshift/node.conf. That seems like another way for things to be misconfigured. I'm digging into this a bit more. It seems like there are other places in the code that expect uid==gid. Actually the patch proposed in comment #1 just makes sure that the expected gid is applied - so in practice it actually makes sure that uid == gid and the code that assumes this will just work. However there's a different (but related) problem: 'next_uid' only checks local passwd/groupo files for duplicity so you get into similar problems if the system has external user info configured (e.g. NIS, LDAP). Just reproduced it, will create a separate bug. You're correct. I was confused at first because of a DNS problem in my environment that was causing ssh logins to fail on my patched Node. I was assuming there was something wrong with the patch. I'm submitting this PR upstream @ https://github.com/openshift/origin-server/pull/4933. Commit pushed to master at https://github.com/openshift/origin-server https://github.com/openshift/origin-server/commit/2dc7732175c19c7f27362f909fc687127872ce8b Bug 1053485 - Changing GID_MIN in login.defs prevents app creation This patch was originally submitted by Josep 'Pep' Turro Mauri <pep> Retest this bug with rubygem-openshift-origin-container-selinux-0.7.1-1.git.0.4244282.el6op.noarch on puddle 2.1/2014-03-14.1. It still failed with sshkey permission issue, checked the code, the related patch has not been merged in, so assign back this bug. Verify this bug on puddle 2.1/2014-03-17.2. Setup an ose env with htpasswd authentication enabled, modify the GID_MIN to 6000 in login.defs on node. Could create app and ssh into the app successfully. |