Description of problem: RHEL images now contain two files with security capabilities that are being set, as described here: https://projects.engineering.redhat.com/browse/RHELBLD-4379 This results in failures during oc image extract because the extraction process can't set the capability on the extracted file (because the user doesn't have permission to do so): $ oc image extract registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 error: unable to extract layer sha256:53732dad4680ae165f569331357b89605c03583057db7193a7a4fabdf312f061 from registry-proxy.engineering.redhat.com/rh-osbs/iib:76743: operation not permitted RHEL has since reversed this change because of the impact on OCP, but will want to re-assert the change once OCP is patched to tolerate these files/capabilities. The fix to oc will need to be backported all the way to at least 4.6 to ensure customers have a working binary to consume. Version-Release number of selected component (if applicable): 4.8 but expectation is that all versions are affected. How reproducible: always (when using an image w/ these files/capabilities set) Actual results: permission failure extracting the image Expected results: files are extracted successfully Additional info:
verified with the payload below and i see that the issue has been fixed: [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ ./oc get clusterversion NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.8.0-0.nightly-2021-06-11-024306 True False 4h9m Cluster version is 4.8.0-0.nightly-2021-06-11-024306 [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ ./oc version -o yaml clientVersion: buildDate: "2021-06-10T07:01:41Z" compiler: gc gitCommit: 10cec43f6fce6df1f8f9d769b70640579c827355 gitTreeState: clean gitVersion: 4.8.0-202106100628.p0.git.10cec43.assembly.stream-10cec43 goVersion: go1.16.4 major: "" minor: "" platform: linux/amd64 openshiftVersion: 4.8.0-0.nightly-2021-06-11-024306 releaseClientVersion: 4.8.0-0.nightly-2021-06-11-024306 serverVersion: buildDate: "2021-06-10T13:52:39Z" compiler: gc gitCommit: a5ec692e05fadcc702bae6f655e000eb306f7924 gitTreeState: clean gitVersion: v1.21.0-rc.0+a5ec692 goVersion: go1.16.4 major: "1" minor: 21+ platform: linux/amd64 with 4.8: ===================== with root user: +++++++++++++++++++++++++++++++++ [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ sudo ./oc image extract registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 --confirm [sudo] password for knarra: W0611 17:17:49.964034 41190 manifest.go:440] Chose linux/amd64 manifest from the manifest list. non-root user: +++++++++++++++++++++++++++++++++++++ [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ ./oc image extract registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 --confirm W0611 16:54:22.067605 31361 manifest.go:440] Chose linux/amd64 manifest from the manifest list. [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ ls -l with 4.7: =========================== Hit below issue with root & non root user [knarra@knarra openshift-client-linux-4.7.0-0.nightly-2021-06-06-160728]$ ./oc image extract registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 --confirm W0611 17:07:53.407155 37813 manifest.go:440] Chose linux/amd64 manifest from the manifest list. error: unable to extract layer sha256:53732dad4680ae165f569331357b89605c03583057db7193a7a4fabdf312f061 from registry-proxy.engineering.redhat.com/rh-osbs/iib:76743: operation not permitted Based on the above moving bug to verified state.
(In reply to RamaKasturi from comment #2) > verified with the payload below and i see that the issue has been fixed: > > [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ > ./oc get clusterversion > NAME VERSION AVAILABLE PROGRESSING > SINCE STATUS > version 4.8.0-0.nightly-2021-06-11-024306 True False 4h9m > Cluster version is 4.8.0-0.nightly-2021-06-11-024306 > > [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ > ./oc version -o yaml > clientVersion: > buildDate: "2021-06-10T07:01:41Z" > compiler: gc > gitCommit: 10cec43f6fce6df1f8f9d769b70640579c827355 > gitTreeState: clean > gitVersion: 4.8.0-202106100628.p0.git.10cec43.assembly.stream-10cec43 > goVersion: go1.16.4 > major: "" > minor: "" > platform: linux/amd64 > openshiftVersion: 4.8.0-0.nightly-2021-06-11-024306 > releaseClientVersion: 4.8.0-0.nightly-2021-06-11-024306 > serverVersion: > buildDate: "2021-06-10T13:52:39Z" > compiler: gc > gitCommit: a5ec692e05fadcc702bae6f655e000eb306f7924 > gitTreeState: clean > gitVersion: v1.21.0-rc.0+a5ec692 > goVersion: go1.16.4 > major: "1" > minor: 21+ > platform: linux/amd64 > > > with 4.8: > ===================== > with root user: > +++++++++++++++++++++++++++++++++ > [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ > sudo ./oc image extract > registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 --confirm > [sudo] password for knarra: > W0611 17:17:49.964034 41190 manifest.go:440] Chose linux/amd64 manifest > from the manifest list. > > non-root user: > +++++++++++++++++++++++++++++++++++++ > [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ > ./oc image extract registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 > --confirm > W0611 16:54:22.067605 31361 manifest.go:440] Chose linux/amd64 manifest > from the manifest list. > [knarra@knarra openshift-client-linux-4.8.0-0.nightly-2021-06-11-024306]$ ls > -l > > with 4.7: > =========================== > Hit below issue with non-root user, for root user it worked well in 4.7 as well > > [knarra@knarra openshift-client-linux-4.7.0-0.nightly-2021-06-06-160728]$ > ./oc image extract registry-proxy.engineering.redhat.com/rh-osbs/iib:76743 > --confirm > W0611 17:07:53.407155 37813 manifest.go:440] Chose linux/amd64 manifest > from the manifest list. > error: unable to extract layer > sha256:53732dad4680ae165f569331357b89605c03583057db7193a7a4fabdf312f061 from > registry-proxy.engineering.redhat.com/rh-osbs/iib:76743: operation not > permitted > > > Based on the above moving bug to verified state.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Moderate: OpenShift Container Platform 4.8.2 bug fix and security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2021:2438