a014988113
A rootless user can bind-mount a directory whose parent is mode 700 when that parent is owned by a UID inside their /etc/subuid range, and gets "statfs ...: permission denied" when the same parent is owned by root. The user has no access to the parent in either case, and nothing in the docs explains the difference. The reason is the user namespace. CAP_DAC_OVERRIDE bypasses a file's mode only when that file's UID and GID are both mapped in the namespace, which is "Operation of file-related capabilities" in user_namespaces(7). A parent whose owner is not mapped is reported with the overflow ID 65534, so root gets no DAC override and the parent's mode is enforced. An owner inside the subordinate range is mapped, the override applies, and mode 700 is bypassed. --userns=keep-id changes none of the outcomes. The report that prompted this was a rootless bind mount of a directory under /etc/letsencrypt, owned by certbot:certbot with mode 750, by a user who is not in that group, and a question about whether that is intentional. The "Using volumes" section explains the ID shift for files created inside the container and says nothing about whether the mount source can be traversed, which is the part the reporter hit. Add a short subsection there that opens with the capability rule and shows three cases as one rule: mode 755 owned by root mounts fine because world permissions already allow it, mode 700 owned by root fails, and mode 700 owned by an ID inside the range succeeds. It also gives the podman unshare check for whether a UID is mapped, and the consequence for subordinate ranges that overlap real accounts. Behavior checked on Debian with podman 5.4.2 and a 100000:65536 range. Discussion: https://github.com/podman-container-tools/podman/discussions/29443 Signed-off-by: José M. Requena Plens <jmrplens@gmail.com> |
||
|---|---|---|
| .. | ||
| basic_networking.md | ||
| image_signing.md | ||
| mac_client.md | ||
| mac_win_client.md | ||
| macos_autostart.md | ||
| performance.md | ||
| podman-derivative-api.md | ||
| podman-for-windows.md | ||
| podman-install-certificate-authority.md | ||
| podman-win-install.jpg | ||
| podman-wsl-term.jpg | ||
| podman_bridge.png | ||
| podman_macvlan.png | ||
| podman_pod.png | ||
| podman_rootless_default.png | ||
| podman_tutorial.md | ||
| podman_tutorial_cn.md | ||
| qemu-remote-tutorial.md | ||
| README.md | ||
| remote_client.md | ||
| rootless_tutorial.md | ||
| socket_activation.md | ||
Podman Tutorials
Links to a number of useful tutorials for the Podman utility.
Learn how to set up Podman and perform some basic commands with the utility.
Basic Setup and Use of Podman in a Rootless environment
The steps required to set up rootless Podman are enumerated.
Special setup for running the Podman remote client on a Mac or Windows PC and connecting to Podman running on a Linux VM are documented.
Running Podman on macOS startup with launchd
How to automatically start a Podman machine at login on macOS using launchd LaunchAgents.
A brief how-to on using the Podman remote-client.
How to use libpod for custom/derivative projects
How the libpod API can be used within your own project.
Learn how to set up and use image signing with Podman.
A basic guide to common network setups with Podman
Learn how to run containers that support socket activation.
Performance guide regarding Podman configuration and usage.