public/pipglr
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: public:v2.0.0
Branches Tags
public:main public:quadlet
public:v4.3.0 public:v4.2.0 public:v4.1.0 public:v4.0.0 public:v3.0.1 public:v3.0.0 public:v2.0.3 public:v2.0.2 public:v2.0.1 public:v2.0.0 public:v1.4.2 public:v1.4.1 public:v1.4.0 public:v1.3.0 public:v1.2.1 public:v1.2.0 public:v1.1.2 public:v1.1.1 public:v1.1.0 public:v1.0.1 public:v1.0.0 public:v0.0.0-f36
...
compare: public:v2.0.3
Branches Tags
public:main public:quadlet
public:v4.3.0 public:v4.2.0 public:v4.1.0 public:v4.0.0 public:v3.0.1 public:v3.0.0 public:v2.0.3 public:v2.0.2 public:v2.0.1 public:v2.0.0 public:v1.4.2 public:v1.4.1 public:v1.4.0 public:v1.3.0 public:v1.2.1 public:v1.2.0 public:v1.1.2 public:v1.1.1 public:v1.1.0 public:v1.0.1 public:v1.0.0 public:v0.0.0-f36

3 Commits
v2.0.0 ... v2.0.3

Author SHA1 Message Date
Chris Evich
f44e9891d1 Merge branch 'fix_idmaps' into 'main' 
Fix newuidmap...`: newuidmap: open of uid_map failed: Permission denied

See merge request qontainers/pipglr!15
 2022-12-08 12:05:44 +00:00
Chris Evich
bf242e8a52 Fix newuidmap...`: newuidmap: open of uid_map failed: Permission denied 
Within a container, caps need to be set on /usr/bin/new{uid,gid}map
which reflect the (inner) podman user's root namespaced ID of 10000.

Signed-off-by: Chris Evich <chris_gitlab@icuc.me>
 2022-12-08 06:59:02 -05:00
Chris Evich
db6f2bceb9 Attempt fix v2.0.0 newuidmap permission denied 
Recently, I believe an update or packaging problem has been causing
podman to throw errors like:

```
level=error msg="running `/usr/bin/newuidmap ...`: newuidmap: open of
uid_map failed: Permission denied\n"
```

This seems to have something to do with the shadow-utils package, which
owns this binary.  I've examined the file attribuites and permissions
along with /etc/sub{uid,gid} contents.  The only thing that seems to
resolve the issue is reinstalling shadow-utils.  Attempt that fix here
and hope it clears up the problem (present in v2.0.0)

Signed-off-by: Chris Evich <chris_gitlab@icuc.me>
 2022-12-07 06:14:45 -05:00
1 changed files with 4 additions and 1 deletions
Expand all files Collapse all files

5
Containerfile
View File

@@ -57,6 +57,7 @@ RUN for rpm in ${EXCLUDE_PACKAGES}; do x+="--exclude=$rpm "; done && \
$DNFCMD update && \ $DNFCMD update && \
$DNFCMD install $x $RUNNER_RPM_URL && \ $DNFCMD install $x $RUNNER_RPM_URL && \
$DNFCMD upgrade && \ $DNFCMD upgrade && \
$DNFCMD reinstall shadow-utils && \
if [[ "${DNFCMD}" == "${_DNFCMD}" ]]; then \ if [[ "${DNFCMD}" == "${_DNFCMD}" ]]; then \
dnf clean all && \ dnf clean all && \
rm -rf /var/cache/dnf; \ rm -rf /var/cache/dnf; \
@@ -98,7 +99,9 @@ RUN sed -i -r \
chmod u+s /usr/bin/new{uid,gid}map && \ chmod u+s /usr/bin/new{uid,gid}map && \
rm -f /home/podman/.bash* && \ rm -f /home/podman/.bash* && \
echo DOCKER_HOST="unix:///tmp/podman-run-1000/podman/podman.sock" > /etc/profile.d/podman.sh && \ echo DOCKER_HOST="unix:///tmp/podman-run-1000/podman/podman.sock" > /etc/profile.d/podman.sh && \
echo "podman:10000:10000" | tee /etc/subuid > /etc/subgid echo "podman:10000:10000" | tee /etc/subuid > /etc/subgid && \
setcap -n 10000 cap_setuid+ep /usr/bin/newuidmap && \
setcap -n 10000 cap_setuid+ep /usr/bin/newgidmap
# Runtime rootless-mode configuration # Runtime rootless-mode configuration
USER podman USER podman