core doesn't get default entries in /etc/subuid and /etc/subgid except with podman where they are broken #1733
Description
Description and Impact
Core doesn’t get entries in /etc/subuid and /etc/subgid because it isn’t created with them. All other users get entries because they are created by ignition. This breaks rootless containers for core. I believe that ignition directly calls useradd which is why this happens.
When the podman sysext is added there is a workaround added to fix this. It overwrites the first characters in /etc/sub[ug]id after users have been created by ignition. This can leave the file in an unusable state. Further the addition is hard coded to a specific range and doesn’t account for what else ignition may have done. This seems to be caused by this and the following lines
w /etc/subuid - - - - core:1065536:65536
w /etc/subgid - - - - core:1065536:65536
Environment and steps to reproduce
Here are two examples:
Core + 4 Users (default)
butane file:
variant: flatcar
version: 1.1.0
passwd:
users:
- name: core
ssh_authorized_keys:
- ssh-ed25519 ...
- name: one
- name: two
- name: three
- name: four
On the resulting VM:
core@user-test ~ $ cat /etc/subuid
one:100000:65536
two:165536:65536
three:231072:65536
four:296608:65536
core@user-test ~ $ cat /etc/subgid
one:100000:65536
two:165536:65536
three:231072:65536
four:296608:65536
Core + 4 users + podman -docker -containerd
ignition file:
variant: flatcar
version: 1.1.0
passwd:
users:
- name: core
ssh_authorized_keys:
- ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIfFF+O2JFqmW/AYoMitdXJ3C69DKnx+qH6jBCRBpO/V
- name: one
- name: two
- name: three
- name: four
storage:
files:
# Add Podman and configure it
- path: /etc/containers/policy.json
contents:
source: https://raw.githubusercontent.com/containers/podman/main/test/policy.json
- path: /etc/flatcar/enabled-sysext.conf
contents:
inline: |
podman
links:
# Remove docker and containerd
- path: /etc/extensions/docker-flatcar.raw
target: /dev/null
overwrite: true
- path: /etc/extensions/containerd-flatcar.raw
target: /dev/null
overwrite: true
On the resulting VM:
core@user-test ~ $ cat /etc/subuid
core:1065536:65536wo:165536:65536
three:231072:65536
four:296608:65536
core@user-test ~ $ cat /etc/subgid
core:1065536:65536wo:165536:65536
three:231072:65536
four:296608:65536
Expected behavior
Core should always have entries in /etc/subuid and /etc/subgid. Those entries should not be added in a way that could damage the file. Those entries should be in ranges consistent with allowing other users on the system.
Additional information
none