Based on my understanding of the way things work, I've created this PR upstream to address this issue: https://github.com/containers/podman/pull/7075.

However, Matt Heon and Giuseppe Scrivano may adjust the verbiage to have it better reflect reality if I'm off base.

As https://github.com/containers/podman/pull/7075 has merged, I'm setting this BZ to POST and assigning to Jindrich for any packaging/BZ needs.  This fix will go out when upstream Podman is rolled into RHEL again, most likely RHEL 8.4.

Yes we should get this in RHEL8.3.

This bug has been verified on podman-2.0.4-3.module+el8.3.0+7716+ce654703.


[ajia@hpe-dl380pgen8-02-vm-15 ~]$ rpm -q podman podman-catatonit
podman-2.0.4-3.module+el8.3.0+7716+ce654703.x86_64
podman-catatonit-2.0.4-3.module+el8.3.0+7716+ce654703.x86_64

[ajia@hpe-dl380pgen8-02-vm-15 ~]$ man podman-run | grep -A5 "Without this argument"
       Without this argument, the command will run as the user specified in the container image. Unless overridden by a USER command in the Containerfile or by a value passed to this
       option, this user generally defaults to root.

       When a user namespace is not in use, the UID and GID used within the container and on the host will match. When user namespaces are in use, however, the UID and GID in the
       container may correspond to another UID and GID on the host. In rootless containers, for example, a user namespace is always used, and root in the container will by default
       correspond to the UID and GID of the user invoking Podman.
[ajia@hpe-dl380pgen8-02-vm-15 ~]$ man podman-run | grep -A1 "Set the user namespace mode"
       Set the user namespace mode for the container.  It defaults to the PODMAN_USERNS environment variable.  An empty value ("") means user namespaces are disabled unless an
       explicit mapping is set with they --uidmapping and --gidmapping options.
[ajia@hpe-dl380pgen8-02-vm-15 ~]$ man podman-run | grep -A1 "user namespace of the caller"
       · host: run in the user namespace of the caller. The processes running in the container will have the same privileges on the host as any other process launched by the calling
         user (default).

[ajia@hpe-dl380pgen8-02-vm-15 ~]$ man podman-run | grep -B2 "private: create a new namespace"|grep -v default
       · ns:path: path to a network namespace to join;

--
       · host: use the host's PID namespace for the container. Note the host mode gives the container full access to local PID and is therefore considered insecure;

--
       · ns: run the container in the given existing user namespace.

       · private: create a new namespace for the container.
--
       · host: use the host's UTS namespace inside the container.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (Moderate: container-tools:rhel8 security, bug fix, and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2020:4694