Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1741364

Summary: Subscriptions not readable in rootless podman
Product: Red Hat Enterprise Linux 7 Reporter: Mike Rochefort <mroche>
Component: subscription-managerAssignee: Jiri Hnidek <jhnidek>
Status: CLOSED WONTFIX QA Contact: Red Hat subscription-manager QE Team <rhsm-qe>
Severity: medium Docs Contact:
Priority: medium    
Version: 7.7CC: csnyder, jhnidek, jsefler, pvlasin, qianzhan, smccarty, wpoteat
Target Milestone: rcKeywords: Triaged
Target Release: ---   
Hardware: x86_64   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-01 18:28:23 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Mike Rochefort 2019-08-14 22:03:09 UTC
Description of problem:

Podman is not seeing entitlements in rootless mode due to default permissions on the /etc/pki/entitlement/<value>-key.pem certificate.


Version-Release number of selected component (if applicable):

subscription-manager: 1.24.13-1
podman: 1.4.4-3


How reproducible: Tested on multiple RHEL virtual machines with 100% reproducibility


Steps to Reproduce:
1. Install RHEL

As root:
2. Register and attach instance (currently using Developer license)
3. Enable extras/optional repos
4. Update to RHEL 7.7 if using RHEL 7.6 and below.
5. Install podman and slirp4netns
6. echo "user.max_user_namespaces=15064" >> /etc/sysctl.d/00-namespaces.conf
7. sysctl --system

As user:
9. (Optional) podman login registry.redhat.io # if skipped, use registry.access.redhat.com/ubi#/ubi in the following command
10. podman run --rm -it ubi#/ubi yum repolist


Actual results:

yum reports that there are no current active entitlements and to use subscription-manager to register the container. Only UBI repositories are accessible.


Expected results:

yum will enable rhel-7-server-rpms or the RHEL 8 AppStream/BaseOS repos by default.


Additional info:

The current workaround is to change the permissions on /etc/pki/entitlement/<value>-key.pem from 600 (root:root) to 604. <value>.pem is already set to 644 (root:root) by default.

Comment 2 Mike Rochefort 2019-08-15 00:10:18 UTC
I should clarify that this only occurs on systems that have been updated to RHEL 7.7 from 7.6 and below. A fresh 7.7 installation handles the rootless subscription passthrough by default as it uses 644 permissions. Should subscription-manager be changed to automatically check and alter this during the update?

Comment 3 qianzhan 2019-09-30 10:16:47 UTC
There is a similar issue on RHEL-7.8-20190927.1 container:

subscription-manager-1.24.21-1.el7.x86_64
subscription-manager-cockpit-1.24.21-1.el7.noarch
subscription-manager-rhsm-1.24.21-1.el7.x86_64
subscription-manager-rhsm-certificates-1.24.21-1.el7.x86_64
tfm-rubygem-katello-3.12.0.26-1.el7sat.noarch
katello-3.12.0-2.el7sat.noarch
candlepin-2.6.9-1.el7sat.noarch

1. Register RHEL-7.8-20190927.1 against Satellite6.6-snapshot-23.0, and auto-attach:
[root@kvm-03-guest01 ~]# subscription-manager status
+-------------------------------------------+
   System Status Details
+-------------------------------------------+
Overall Status: Current

System Purpose Status: Not Specified



[root@kvm-03-guest01 ~]# yum repolist
Loaded plugins: product-id, search-disabled-repos, subscription-manager
global name 'warnOrGiveUsageMessage' is not defined
repo id                                                                                            repo name                                                                                                 status
!rhel-7-server-rpms/7Server/x86_64                                                                 Red Hat Enterprise Linux 7 Server (RPMs)                                                                  26,313
repolist: 26,313


[root@kvm-03-guest01 ~]# ll /etc/pki/entitlement/
total 8
-rw-r--r--. 1 root root 3243 Sep 30 05:55 6148061022297726067-key.pem
-rw-r--r--. 1 root root 3537 Sep 30 05:55 6148061022297726067.pem

2. Check repos on a container run on RHEL-7.8-20190927.1.

[root@kvm-03-guest01 ~]# podman run --rm -ti brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/ubi7 /bin/bash -c 'yum repolist'
Loaded plugins: ovl, product-id, search-disabled-repos, subscription-manager
global name 'warnOrGiveUsageMessage' is not defined
https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi/server/7.8Server/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
To address this issue please refer to the below knowledge base article 

https://access.redhat.com/articles/1320623

If above article doesn't help to resolve this issue please open a ticket with Red Hat Support.

https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi/server/7.8Server/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi/atomic/7.8Server/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi/server/7.8Server/x86_64/extras/os/repodata/repomd.xml: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi/server/7.8Server/x86_64/optional/os/repodata/repomd.xml: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi/server/7.8Server/x86_64/rhscl/1/os/repodata/repomd.xml: [Errno 14] HTTPS Error 404 - Not Found
Trying other mirror.
repo id                                                                          repo name                                                                                                                   status
ubi-7/x86_64                                                                     Red Hat Universal Base Image 7 Server (RPMs)                                                                                0
ubi-7-rhah/x86_64                                                                Red Hat Universal Base Image Atomic Host (RPMs)                                                                             0
ubi-7-server-extras-rpms/x86_64                                                  Red Hat Universal Base Image 7 Server - Extras (RPMs)                                                                       0
ubi-7-server-optional-rpms/x86_64                                                Red Hat Universal Base Image 7 Server - Optional (RPMs)                                                                     0
ubi-server-rhscl-7-rpms/x86_64                                                   Red Hat Software Collections RPMs for Red Hat Universal Base Image 7 Server                                                 0
repolist: 0
[root@kvm-03-guest01 ~]#

Comment 7 Scott McCarty 2020-09-01 18:27:57 UTC
Michael, hey I'm the product manager for podman on RHEL 7 and RHEL 8. We were definitely aware of the upgrade problem, and I'm sorry you ran into it. Unfortunately, it's too late in the RHEL 7 life cycle to make any changes to fix a bug like this. We did get one last update of container tools into RHEL 7.9, and I would recommend trying to start with 7.8+ when we pushed rootless Generally Available. Anything before that is just a preview (7.6, like an experiment) or tech preview (7.7 official experiment). RHEL 7.8 it went generally available, and we did one final update in RHEL 7.9 to pick up podman 1.6.4.

I'm going to close this bug, but feel free to ping me if you have further questions, at smccarty at redhat.com.

Comment 8 Scott McCarty 2020-09-01 18:28:23 UTC
Closing per my last comment.

Comment 9 Mike Rochefort 2020-09-03 02:00:57 UTC
No worries on my end, Scott! I'm not deploying anything pre-7.7 and I've personally moved on to 8.x, so this is not a big deal to me. Only came up during the migratory period.

Cheers,
Mike