Bug 1995900
| Summary: | Podman does not honor the userns configuration | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Sameer <snangare> |
| Component: | podman | Assignee: | Jindrich Novy <jnovy> |
| Status: | CLOSED ERRATA | QA Contact: | Alex Jia <ajia> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.4 | CC: | bbaude, dwalsh, gscrivan, jligon, jnovy, jswensso, lsm5, mheon, pthomas, tsweeney, umohnani, ypu |
| Target Milestone: | beta | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | podman-4.0.0-0.29.el8 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2022-05-10 13:27:31 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Giuseppe can you take a look at this please? fixed upstream with: https://github.com/containers/podman/pull/12621 Assigning to Jindrich for any further BZ and packaging needs. This is merged into the main branch so leaving this in POST as it will appear packaged once podman-4.x is released. Can we get qa ack? This bug still exists on podman-4.0.0-0.20.module+el8.6.0+12939+aa33c90f.x86_64
with runc-1.0.2-1.module+el8.6.0+12698+b6644727.x86_64.
[root@kvm-05-guest07 ~]# grep 65536 /etc/subuid
test:100000:65536
storage:100000:65536
[root@kvm-05-guest07 ~]# grep 65536 /etc/subgid
test:100000:65536
storage:100000:65536
[root@kvm-05-guest07 ~]# vi /etc/containers/storage.conf
[root@kvm-05-guest07 ~]# grep root-auto-userns-user /etc/containers/storage.conf
root-auto-userns-user = "storage"
[root@kvm-05-guest07 ~]# vi /etc/containers/containers.conf
[root@kvm-05-guest07 ~]# grep containers -A5 /etc/containers/containers.conf
[containers]
userns = "auto"
[engine]
namespace = "storage"
[root@kvm-05-guest07 ~]# podman run --rm --name test -it ubi8 bash
[root@03abd13fa315 /]# cat /proc/self/uid_map
0 0 4294967295
Please don't test against super old development build of podman-4.x-0.x - it is super old. I will switch this bug state to MODIFIED once a release candidate or newer build of podman-4.x is available. A new issue is introduced by podman-4.0.0-0.25.el8, and the container can't be started w/
previous configuration in /etc/containers/containers.conf.
[root@kvm-08-guest18 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.6 Beta (Ootpa)
[root@kvm-08-guest18 ~]# rpm -q podman runc systemd kernel
podman-4.0.0-0.25.module+el8.6.0+14174+8e1b9b69.x86_64
runc-1.1.0-1.module+el8.6.0+14131+b9baa4cc.x86_64
systemd-239-56.el8.x86_64
kernel-4.18.0-364.el8.x86_64
[root@kvm-08-guest18 ~]# echo 'storage:100000:65536' >> /etc/subuid
[root@kvm-08-guest18 ~]# echo 'storage:100000:65536' >> /etc/subgid
[root@kvm-08-guest18 ~]# vi /etc/containers/storage.conf
[root@kvm-08-guest18 ~]# grep root-auto-userns-user /etc/containers/storage.conf
root-auto-userns-user = "storage"
[root@kvm-08-guest18 ~]# vi /etc/containers/containers.conf
[root@kvm-08-guest18 ~]# grep containers -A5 /etc/containers/containers.conf
[containers]
userns = "auto"
[engine]
namespace = "storage"
[root@kvm-08-guest18 ~]# podman run --rm --name test -it ubi8 bash
Resolved "ubi8" as an alias (/etc/containers/registries.conf.d/001-rhel-shortnames.conf)
Trying to pull registry.access.redhat.com/ubi8:latest...
Getting image source signatures
Checking if image destination supports signatures
Copying blob 8671113e1c57 done
Copying blob 5dcbdc60ea6b done
Copying config b81e86a2cb done
Writing manifest to image destination
Storing signatures
Error: runc: runc create failed: unable to start container process: error during container init: error mounting "cgroup" to rootfs at "/sys/fs/cgroup": mount /proc/self/fd/12:/sys/fs/cgroup/systemd (via /proc/self/fd/13), flags: 0x20502f: operation not permitted: OCI permission denied
it's okay if all of configuration is removed from /etc/containers/containers.conf,
but the result is still not expected.
[root@kvm-08-guest18 ~]# podman run --rm --name test -it ubi8 bash
[root@e5136331bc19 /]# cat /proc/self/uid_map
0 0 4294967295
Thanks Alex, can you please attach contents of your /etc/containers/containers.conf? Matt, should this be somehow handled when upgrading to podman-4 from older release? (In reply to Jindrich Novy from comment #11) > Thanks Alex, can you please attach contents of your > /etc/containers/containers.conf? The containers.conf is an empty file originally, I only added the following content into it. [root@kvm-08-guest18 ~]# cat /etc/containers/containers.conf [containers] userns = "auto" [engine] namespace = "storage" We think this may be a runc bug - we're seeing it in gating tests as well. Have not yet managed to track it down, but we are aware of it. Testing with crun works without issue. Alex, nice find in the testing. I'm going to set this back to Assigned and will hand it off to Matt. I am not sure that this is fixed. I think it is fixed upstream with 89ee302a9f98e71138da5fd80a0a004f2b40160b This bug has been verified on podman-4.0.0-0.29.module+el8.6.0+14295+adafbc4c.
[root@hpe-dl380pgen8-02-vm-9 ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 8.6 Beta (Ootpa)
[root@hpe-dl380pgen8-02-vm-9 ~]# rpm -q podman runc systemd kernel
podman-4.0.0-0.29.module+el8.6.0+14295+adafbc4c.x86_64
runc-1.0.3-1.module+el8.6.0+14295+adafbc4c.x86_64
systemd-239-58.el8.x86_64
kernel-4.18.0-367.el8.x86_64
[root@hpe-dl380pgen8-02-vm-9 ~]# echo 'storage:100000:65536' >> /etc/subuid
[root@hpe-dl380pgen8-02-vm-9 ~]# echo 'storage:100000:65536' >> /etc/subgid
[root@hpe-dl380pgen8-02-vm-9 ~]# vi /etc/containers/storage.conf
[root@hpe-dl380pgen8-02-vm-9 ~]# grep root-auto-userns-user /etc/containers/storage.conf
root-auto-userns-user = "storage"
[root@hpe-dl380pgen8-02-vm-9 ~]# vi /etc/containers/containers.conf
[root@hpe-dl380pgen8-02-vm-9 ~]# grep containers -A5 /etc/containers/containers.conf
[containers]
userns = "auto"
[engine]
namespace = "storage"
[root@hpe-dl380pgen8-02-vm-9 ~]# podman run --rm --name test -it ubi8 bash
Resolved "ubi8" as an alias (/etc/containers/registries.conf.d/001-rhel-shortnames.conf)
Trying to pull registry.access.redhat.com/ubi8:latest...
Getting image source signatures
Checking if image destination supports signatures
Copying blob 8671113e1c57 done
Copying blob 5dcbdc60ea6b done
Copying config b81e86a2cb done
Writing manifest to image destination
Storing signatures
[root@c9798282612a /]# cat /proc/self/uid_map
0 100000 1024
This bug has been verified on podman-4.0.0-3.module+el8.6.0+14305+6b14f34e.
[root@ibm-x3650m4-01-vm-14 ~]# rpm -q podman runc systemd kernel
podman-4.0.0-3.module+el8.6.0+14305+6b14f34e.x86_64
runc-1.0.3-2.module+el8.6.0+14276+008f0e37.x86_64
systemd-239-58.el8.x86_64
kernel-4.18.0-369.el8.x86_64
[root@ibm-x3650m4-01-vm-14 ~]# grep containers -A5 /etc/containers/containers.conf
[containers]
userns = "auto"
[engine]
namespace = "storage"
[root@ibm-x3650m4-01-vm-14 ~]# grep root-auto-userns-user /etc/containers/storage.conf
root-auto-userns-user = "storage"
[root@ibm-x3650m4-01-vm-14 ~]# podman run --rm --name test -it ubi8 cat /proc/self/uid_map
0 100000 1024
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: container-tools:rhel8 security, bug fix, and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2022:1762 |
Description of problem: The "userns" parameter in /usr/share/containers/containers.conf set to "auto" but it has no effect by running the container. Also, "root-auto-userns-user" in /etc/containers/storage.conf is set to a valid user with mappings in /etc/subuid and /etc/subgid file but still no luck. However, it works expected by exporting environment variable Version-Release number of selected component (if applicable): RHEL 8 Podman latest version (3.2.3) How reproducible: - Reproducible 100% Steps to Reproduce: 1. Add some subuid and subguid echo 'storage:100000:65536' >> /etc/subuid echo 'storage:100000:65536' >> /etc/subgid 2.In /etc/containers/storage.conf uncomment below paramenter # root-auto-userns-user = "storage" 3. Add /etc/containers/containers.conf and/or uncommnent below parameters in /usr/share/containers/containers.conf [containers] userns = "auto" [engine] namespace = "storage" 4. Run the container using root user and check uid mappings # podman run --rm --name test -it ubi8 bash [root@f55bdea6dcae /]# cat /proc/self/uid_map 0 0 4294967295 Actual results: # podman run --rm --name test -it ubi8 bash [root@f55bdea6dcae /]# cat /proc/self/uid_map 0 0 4294967295 Expected results: # podman run --rm --name test1 --userns=auto -it ubi8 bash [root@f7a6504535b9 /]# cat /proc/self/uid_map 0 100000 1024 Check Uid mapping in both cases Additional info: This works well as expected using "--userns=auto" parameter in podman run command and also works well by exporting "PODMAN_USERNS=auto" and run the container later on. 1) root@servername# podman run --rm --name test1 --userns=auto -it ubi8 bash 2) root@servername# export PODMAN_USERNS=auto root@servername# podman run --rm --name test -it ubi8 bash