newuidmap: open of uid_map failed: Permission denied #20386
EvgenyAfanasev
started this conversation in
General
Replies: 10 comments 3 replies
-
|
How is the container you are running running? Have you checked SELinux yet? |
Beta Was this translation helpful? Give feedback.
0 replies
-
It is my workstation PC
SELinux is not installed |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
We need the output of podman info. |
Beta Was this translation helpful? Give feedback.
0 replies
-
sudo podman info
is it ? |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Is newuidmap and newgidmap setuid or setfcap? $ getcap /usr/bin/newuidmap /usr/bin/newgidmap |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
Moving to a discussion as this doe snot look like a podman bug and instead something with your environment |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
have the same issue, when I try to use podman, the output is just slightly different (because of the version 4.7.2?): $ sudo podman info
host:
arch: amd64
buildahVersion: 1.32.0
cgroupControllers:
- cpuset
- cpu
- io
- memory
- hugetlb
- pids
- rdma
- misc
cgroupManager: systemd
cgroupVersion: v2
conmon:
package: conmon-2.1.8-2.fc40.x86_64
path: /usr/bin/conmon
version: 'conmon version 2.1.8, commit: '
cpuUtilization:
idlePercent: 80.82
systemPercent: 5.32
userPercent: 13.86
cpus: 4
databaseBackend: boltdb
distribution:
distribution: fedora
variant: silverblue
version: "40"
eventLogger: journald
freeLocks: 2048
hostname: castle
idMappings:
gidmap: null
uidmap: null
kernel: 6.7.0-0.rc3.20231129git18d46e76d7c2.30.fc40.x86_64
linkmode: dynamic
logDriver: journald
memFree: 11850792960
memTotal: 16663478272
networkBackend: netavark
networkBackendInfo:
backend: netavark
dns:
package: aardvark-dns-1.9.0-1.fc40.x86_64
path: /usr/libexec/podman/aardvark-dns
version: aardvark-dns 1.9.0
package: netavark-1.9.0-1.fc40.x86_64
path: /usr/libexec/podman/netavark
version: netavark 1.9.0
ociRuntime:
name: crun
package: crun-1.12-1.fc40.x86_64
path: /usr/bin/crun
version: |-
crun version 1.12
commit: ce429cb2e277d001c2179df1ac66a470f00802ae
rundir: /run/crun
spec: 1.0.0
+SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
os: linux
pasta:
executable: /usr/bin/pasta
package: passt-0^20231119.g4f1709d-1.fc40.x86_64
version: |
pasta 0^20231119.g4f1709d-1.fc40.x86_64
Copyright Red Hat
GNU General Public License, version 2 or later
<https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
remoteSocket:
exists: false
path: /run/podman/podman.sock
security:
apparmorEnabled: false
capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
rootless: false
seccompEnabled: true
seccompProfilePath: /usr/share/containers/seccomp.json
selinuxEnabled: true
serviceIsRemote: false
slirp4netns:
executable: /usr/bin/slirp4netns
package: slirp4netns-1.2.2-1.fc40.x86_64
version: |-
slirp4netns version 1.2.2
commit: 0ee2d87523e906518d34a6b423271e4826f71faf
libslirp: 4.7.0
SLIRP_CONFIG_VERSION_MAX: 4
libseccomp: 2.5.3
swapFree: 8589930496
swapTotal: 8589930496
uptime: 0h 4m 16.00s
plugins:
authorization: null
log:
- k8s-file
- none
- passthrough
- journald
network:
- bridge
- macvlan
- ipvlan
volume:
- local
registries:
search:
- registry.fedoraproject.org
- registry.access.redhat.com
- docker.io
- quay.io
store:
configFile: /usr/share/containers/storage.conf
containerStore:
number: 0
paused: 0
running: 0
stopped: 0
graphDriverName: overlay
graphOptions:
overlay.mountopt: nodev,metacopy=on
graphRoot: /var/lib/containers/storage
graphRootAllocated: 498556993536
graphRootUsed: 37828894720
graphStatus:
Backing Filesystem: btrfs
Native Overlay Diff: "false"
Supports d_type: "true"
Supports shifting: "true"
Supports volatile: "true"
Using metacopy: "true"
imageCopyTmpDir: /var/tmp
imageStore:
number: 0
runRoot: /run/containers/storage
transientStore: false
volumePath: /var/lib/containers/storage/volumes
version:
APIVersion: 4.7.2
Built: 1698762097
BuiltTime: Tue Oct 31 15:21:37 2023
GitCommit: ""
GoVersion: go1.21.3
Os: linux
OsArch: linux/amd64
Version: 4.7.2I am running Fedora Silverblue rawhide: $ rpm-ostree status
State: idle
Deployments:
● fedora:fedora/rawhide/x86_64/silverblue
Version: Rawhide.20231130.n.0 (2023-11-30T06:04:25Z)
BaseCommit: d9e7bc68f8e53945dc71f52b8c6c6722ed3a893cb4c83e7c12a265821e76f45e
GPGSignature: Valid signature by 115DF9AEF857853EE8445D0A0727707EA15B79CC
LayeredPackages: alacritty bemenu brightnessctl fd-find git-lfs grim j4-dmenu-desktop mako neovim network-manager-applet polkit-gnome ripgrep slurp sway swaylock tmux vifm waybar
wl-clipboard wlroots xdg-desktop-portal-wlrthis is the last version that works for me, if it helps somehow. fedora:fedora/rawhide/x86_64/silverblue
Version: Rawhide.20231116.n.0 (2023-11-16T06:02:02Z)
BaseCommit: 5bfde4ec863d8bcbb5890cf4aba27d9bf92bec193f050e4da86b68a46ad61f13
GPGSignature: Valid signature by 115DF9AEF857853EE8445D0A0727707EA15B79CC
LayeredPackages: alacritty bemenu brightnessctl fd-find git-lfs grim j4-dmenu-desktop libwebkit2gtk-4.0.so.37 mako neovim network-manager-applet polkit-gnome ripgrep slurp sway
swaylock tmux vifm waybar webkit2gtk4.0-devel wl-clipboard wlroots xdg-desktop-portal-wlr
Pinned: yes$ getcap /usr/bin/newuidmap /usr/bin/newgidmap
/usr/bin/newuidmap cap_setuid=ip
/usr/bin/newgidmap cap_setgid=ip |
Beta Was this translation helpful? Give feedback.
2 replies
-
The caps should show |
Beta Was this translation helpful? Give feedback.
-
|
It seems like in the version that still works for me, it's also |
Beta Was this translation helpful? Give feedback.
-
|
Same issue here. Differences:
Aside from having no idea how to fix this, the error message is utterly useless to me. |
Beta Was this translation helpful? Give feedback.
0 replies
-
|
I'm also facing the same issue on Alma Linux 9. Does anyone knows what might be wrong and could please give us a hand? I tried reinstalling shadow-utils, didn't work. Also tried setting SELinux to permissive, didn't work. The cmd that is failing[root@apollo containers-stack]# sudo -u deploy podman info
ERRO[0000] running `/bin/newuidmap 41266 0 1001 1 1 165536 65536`: newuidmap: open of uid_map failed: Permission denied
Error: cannot set up namespace using "/bin/newuidmap": exit status 1CapabilitiesMy OS[root@apollo containers-stack]# cat /etc/os-release
NAME="AlmaLinux"
VERSION="9.6 (Sage Margay)"
ID="almalinux"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.6"
PLATFORM_ID="platform:el9"
PRETTY_NAME="AlmaLinux 9.6 (Sage Margay)"
ANSI_COLOR="0;34"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:almalinux:almalinux:9::baseos"
HOME_URL="https://almalinux.org/"
DOCUMENTATION_URL="https://wiki.almalinux.org/"
BUG_REPORT_URL="https://bugs.almalinux.org/"
ALMALINUX_MANTISBT_PROJECT="AlmaLinux-9"
ALMALINUX_MANTISBT_PROJECT_VERSION="9.6"
REDHAT_SUPPORT_PRODUCT="AlmaLinux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.6"
SUPPORT_END=2032-06-01subuid[root@apollo containers-stack]# cat /etc/subuid
vboufleur:100000:65536
deploy:165536:65536subgid[root@apollo containers-stack]# cat /etc/subgid
vboufleur:100000:65536
deploy:165536:65536 |
Beta Was this translation helpful? Give feedback.
1 reply
-
|
For anyone interested, the solution to my problem were wrong permissions on the newgidmap and newuidmap files. Managed to fix it with these commands: # Podman might need this
dnf reinstall -y shadow-utils
# Allowing the files to be executed by all users
chmod 0755 /usr/bin/newuidmap /usr/bin/newgidmap
# Setting needed capacity
setcap cap_setuid+ep /usr/bin/newuidmap
setcap cap_setgid+ep /usr/bin/newgidmap
# Removing Setuid and Setgid bits
chmod -s /usr/bin/newuidmap
chmod -s /usr/bin/newgidmap |
Beta Was this translation helpful? Give feedback.
-
|
Chiming in with a duplicate issue in a RHEL8.8 container. I've tried all of the suggestions in this thread without success. For context, I am running Ubuntu and using Podman to create a RHEL container, which also needs to be provisioned with Podman. Recreating the Issue This error code is consistent for all Container Host (Ubuntu) Podman Info (Ubuntu) Container OS (RHEL) Capabilities subuid and subgid Podman Info (RHEL) |
Beta Was this translation helpful? Give feedback.
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
-
Issue Description
When running rootless podman inside a container, I get the errors:
Steps to reproduce the issue
Steps to reproduce the issue
podman unshare cat /proc/self/uid_map, but with same resultDescribe the results you received
podman --log-level trace info
Describe the results you expected
normal podman info
podman info output
Podman in a container
No
Privileged Or Rootless
None
Upstream Latest Release
Yes
Additional environment details
Additional environment details
Additional information
Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting
Beta Was this translation helpful? Give feedback.
All reactions