[Rootless] --privileged does not grant SYS_ADMIN to non-UID-0 #13449
Description
Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)
/kind bug
Description
In rootless mode, --privileged does not grant SYS_ADMIN to the container unless the container is running as UID 0.
Steps to reproduce the issue:
- Build an image with this
Containerfileandpodman build -t issue-demo .
FROM docker.io/ubuntu:20.04
RUN apt-get update && \
apt-get install -y fuse2fs && \
useradd -m demo
USER demo
WORKDIR /home/demo
RUN truncate -s 20M test.img && \
mkfs.ext4 test.img && \
mkdir -p mnt- Use
--privilegedand try to mounttest.imgas a non-root user with FUSE (which requiresSYS_ADMIN). Observe that this fails:
$ podman run --rm -it --privileged --device /dev/fuse issue-demo
demo@8b901f739b3f:~$ fuse2fs -o ro test.img mnt/
Mounting read-only.
fuse: failed to exec fusermount: No such file or directory
demo@8b901f739b3f:~$ ls mnt
demo@8b901f739b3f:~$
- Use
--cap-add SYS_ADMINand try to mounttest.imgas a non-root user with FUSE. Observe that this is successful:
$ podman run --rm -it --cap-add SYS_ADMIN --device /dev/fuse issue-demo
demo@162ab2946b21:~$ fuse2fs -o ro test.img mnt/
Mounting read-only.
demo@162ab2946b21:~$ ls mnt
lost+found
demo@162ab2946b21:~$
- Use
--privilegedonce more, but specify-u 0to run the container as "root". Try to mount the image; observe that this is successful:
$ podman run --rm -it --privileged --device /dev/fuse -u 0 issue-demo
root@62e0f5540ad4:/home/demo# fuse2fs -o ro test.img mnt/
Mounting read-only.
root@62e0f5540ad4:/home/demo# ls mnt
lost+found
root@62e0f5540ad4:/home/demo#
Describe the results you received:
Using the --privileged flag does not grant SYS_ADMIN to non-root container users. It only grants SYS_ADMIN to UID 0.
Using --cap-add SYS_ADMIN properly grants SYS_ADMIN to any container user, regardless of UID.
Describe the results you expected:
I expected the --privileged flag to grant SYS_ADMIN to all container users, regardless of UID.
Additional information you deem important (e.g. issue happens only occasionally):
I am running podman in rootless mode. Unfortunately I am not equipped to test this in root mode. This behavior I described also happens with --userns=keep-id.
Output of podman version:
Client: Podman Engine
Version: 4.0.1
API Version: 4.0.1
Go Version: go1.17.7
Git Commit: c8b9a2e3ec3630e9172499e15205c11b823c8107
Built: Thu Feb 24 16:44:27 2022
OS/Arch: linux/amd64
Output of podman info --debug:
host:
arch: amd64
buildahVersion: 1.24.1
cgroupControllers: []
cgroupManager: cgroupfs
cgroupVersion: v1
conmon:
package: /usr/bin/conmon is owned by conmon 1:2.1.0-1
path: /usr/bin/conmon
version: 'conmon version 2.1.0, commit: bdb4f6e56cd193d40b75ffc9725d4b74a18cb33c'
cpus: 12
distribution:
distribution: artix
version: unknown
eventLogger: file
hostname: [redacted]
idMappings:
gidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
uidmap:
- container_id: 0
host_id: 1000
size: 1
- container_id: 1
host_id: 100000
size: 65536
kernel: 5.16.12-artix1-1
linkmode: dynamic
logDriver: k8s-file
memFree: 13220433920
memTotal: 50465959936
networkBackend: cni
ociRuntime:
name: crun
package: /usr/bin/crun is owned by crun 1.4.3-1
path: /usr/bin/crun
version: |-
crun version 1.4.3
commit: 61c9600d1335127eba65632731e2d72bc3f0b9e8
spec: 1.0.0
+SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
os: linux
remoteSocket:
path: /run/user/1000/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: true
seccompEnabled: true
seccompProfilePath: /etc/containers/seccomp.json
selinuxEnabled: false
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: /usr/bin/slirp4netns is owned by slirp4netns 1.1.12-1
version: |-
slirp4netns version 1.1.12
commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
libslirp: 4.6.1
SLIRP_CONFIG_VERSION_MAX: 3
libseccomp: 2.5.3
swapFree: 8556638208
swapTotal: 8589930496
uptime: 17h 30m 8.06s (Approximately 0.71 days)
plugins:
log:
- k8s-file
- none
- passthrough
network:
- bridge
- macvlan
- ipvlan
volume:
- local
registries: {}
store:
configFile: /home/[redacted]/.config/containers/storage.conf # Note - this file does not exist, and I did not create this file, I am using the default config
containerStore:
number: 1
paused: 0
running: 0
stopped: 1
graphDriverName: overlay
graphOptions: {}
graphRoot: /home/[redacted]/.local/share/containers/storage
graphStatus:
Backing Filesystem: extfs
Native Overlay Diff: "true"
Supports d_type: "true"
Using metacopy: "false"
imageCopyTmpDir: /var/tmp
imageStore:
number: 25
runRoot: /run/user/1000/containers
volumePath: /home/[redacted]/.local/share/containers/storage/volumes
version:
APIVersion: 4.0.1
Built: 1645721067
BuiltTime: Thu Feb 24 16:44:27 2022
GitCommit: c8b9a2e3ec3630e9172499e15205c11b823c8107
GoVersion: go1.17.7
OsArch: linux/amd64
Version: 4.0.1
Package info (e.g. output of rpm -q podman or apt list podman):
$ pacman -Q --info podman
Name : podman
Version : 4.0.1-1
Description : Tool and library for running OCI-based containers in pods
Architecture : x86_64
URL : https://github.com/containers/podman
Licenses : Apache
Groups : None
Provides : None
Depends On : conmon containers-common crun fuse-overlayfs iptables libdevmapper.so=1.02-64 libgpgme.so=11-64 libseccomp.so=2-64 slirp4netns
Optional Deps : apparmor: for AppArmor support
btrfs-progs: support btrfs backend devices
catatonit: --init flag support
netavark: for a new container-network-stack implementation
podman-compose: for docker-compose compatibility
podman-docker: for Docker-compatible CLI
Required By : None
Optional For : None
Conflicts With : None
Replaces : None
Installed Size : 79.54 MiB
Packager : Artix Build Bot <jenkins@artixlinux.org>
Build Date : Thu 24 Feb 2022 04:44:27 PM UTC
Install Date : Sun 06 Mar 2022 04:31:11 AM UTC
Install Reason : Explicitly installed
Install Script : No
Validated By : Signature
Have you tested with the latest version of Podman and have you checked the Podman Troubleshooting Guide? (https://github.com/containers/podman/blob/main/troubleshooting.md)
Yes - this is the latest version available to my distribution. I have checked the troubleshooting guide, and a maintainer commented in another issue suggesting I file this issue.
Additional environment details (AWS, VirtualBox, physical, etc.):
Physical headless server