Bug 1693961
| Summary: | Unable to install packages in non-root podman container | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Steffen Froemer <sfroemer> | ||||
| Component: | skopeo | Assignee: | Giuseppe Scrivano <gscrivan> | ||||
| Status: | CLOSED ERRATA | QA Contact: | atomic-bugs <atomic-bugs> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 7.6 | CC: | ajia, bkhomuts, dornelas, dwalsh, gscrivan, jligon, lsm5, mheon, ofalk, smccarty, umohnani, yujiang | ||||
| Target Milestone: | rc | Keywords: | Extras | ||||
| Target Release: | --- | ||||||
| Hardware: | x86_64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-08-06 17:32:59 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1719452 | ||||||
| Bug Blocks: | 1186913, 1688348, 1718378 | ||||||
| Attachments: |
|
||||||
|
Description
Steffen Froemer
2019-03-29 07:44:11 UTC
Fixing this involves multiple packages. skopeo-containers needs to be updated to skopeo-0.1.35-2 or greater. You can change the defaults now by executing chmod o+x -R /usr/share/rhel/secrets updated to skopeo-0.1.35-2.git404c5bd.el7.x86_64, re-fetched container but still getting the issue about missing repo-information.
Is there anything else required?
[fatherlinux@localhost ~]$ podman run -it rhel7 bash
Trying to pull registry.access.redhat.com/rhel7:latest...Getting image source signatures
Copying blob sha256:da59b306fcf51d4fe2f11ef4660a9b72a48788d81a3685c57687ab8e22295229
72.31 MB / ? [-----------------------=-----------------------------------] 40s
Copying blob sha256:e23b0afac3fa3bc3736efa2a2f7b05f810ecc499278d804c4d531b1ec52842b2
1.23 KB / ? [--------------------------------------=----------------------] 0s
Copying config sha256:b8fffd14574a044315ebd7afb12cedde603bcf1e03f97b08e8a30d7a462f3144
6.31 KB / 6.31 KB [========================================================] 0s
Writing manifest to image destination
Storing signatures
[root@eb830e990de8 /]# yum update
Loaded plugins: ovl, product-id, search-disabled-repos, subscription-manager
This system is not registered with an entitlement server. You can use subscription-manager to register.
There are no enabled repos.
Run "yum repolist all" to see the repos you have.
To enable Red Hat Subscription Management repositories:
subscription-manager repos --enable <repo>
To enable custom repositories:
yum-config-manager --enable <repo>
Found out, the `/run/secrets` is empty in container [fatherlinux@localhost ~]$ podman run -it -rm rhel7 bash [root@5d76e61519b1 /]# ls -la /run/secrets total 0 drwxr-xr-x. 2 root root 6 Mar 6 02:36 . drwxr-xr-x. 13 root root 184 Mar 29 14:17 .. [root@5d76e61519b1 /]# Adding appropriate mount into mounts.conf of non-root user, but the result is same as above. # cat /home/fatherlinux/.config/containers/mounts.conf /usr/share/rhel/secrets:/run/secrets [fatherlinux@localhost ~]$ ll /usr/share/rhel/secrets total 0 lrwxrwxrwx. 1 root root 20 Mar 29 14:53 etc-pki-entitlement -> /etc/pki/entitlement lrwxrwxrwx. 1 root root 28 Mar 29 14:53 rhel7.repo -> /etc/yum.repos.d/redhat.repo lrwxrwxrwx. 1 root root 9 Mar 29 14:53 rhsm -> /etc/rhsm Inside of the container, I believe you still can not read all of the content in those directories. As a non root user run ls -l /etc/rhsm /etc/yum.repos.d/redhat.repo /etc/pki/entitlement Do you get permission denied? looks good to me for the user. But seems the entitlement-key needs to be readable by *all*.
[fatherlinux@localhost ~]$ ls -l /etc/rhsm /etc/yum.repos.d/redhat.repo /etc/pki/entitlement
-rw-r--r--. 1 root root 358 Mar 29 21:34 /etc/yum.repos.d/redhat.repo
/etc/pki/entitlement:
total 28
-rw-------. 1 root root 1675 Apr 1 10:48 6418711507922983105-key.pem <<==== only accessible by root
-rw-r--r--. 1 root root 24548 Apr 1 10:48 6418711507922983105.pem
/etc/rhsm:
total 8
drwxr-xr-x. 2 root root 68 Mar 22 16:44 ca
drwxr-xr-x. 2 root root 6 Nov 7 20:14 facts
-rw-r--r--. 1 root root 1662 Nov 7 20:14 logging.conf
drwxr-xr-x. 2 root root 59 Mar 22 16:44 pluginconf.d
-rw-r--r--. 1 root root 2599 Apr 1 10:47 rhsm.conf
I've changed the permission to 644
[root@localhost ~]# chmod 0644 /etc/pki/entitlement/*key.pem
And checking the secrets in container. It works now.
[root@16168e1fe895 /]# ll /run/secrets/
total 96
drwx------. 2 root root 72 Apr 1 08:59 etc-pki-entitlement
-rwx------. 1 root root 96758 Apr 1 08:59 rhel7.repo
drwx------. 4 root root 73 Apr 1 08:59 rhsm
Can you confirm?
Are those chmod-actions all required for non-root container? How can this be automated?
Fixes exists for containers-common. Now we have a requiest for subscription manager to change the defaults for the key material. But they have not responded yet if this is a potential security issue. If it is I asked them to give group access to the file, and then the users who would do builds could be added to the groups. (In reply to Daniel Walsh from comment #8) > Fixes exists for containers-common. Now we have a requiest for subscription > manager to change the defaults for the key material. But they have not > responded yet if this is a potential security issue. If it is I asked them > to give group access to the file, and then the users who would do builds > could > be added to the groups. Dan, any update on this? The entitlement people have agreed to make the file world readable in rhel8.1 I am not sure of the change making its way back to rhel7.7. Lokesh can you ship updated versions of container-common that fix the permissions in RHEL7.7 and RHEL 8.* so that we can have the only breakage be in subscription-manager and then we can wait for them to provide the fix. This change introduced bug: #1720665 Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2019:2389 |