New images 2025-04-01

[Luap99]

Does this PR introduce a user-facing change?

None

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Luap99

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Luap99]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Luap99]

podman tests are failing on debian, something seems to run dnsmasq on 0.0.0.0:53 which of course conflicts with out dns handling, I need to resping new images with dnsmasq running.

[Luap99]

podman run --mount type=devpts,target=/dev/pts with uid, gid and mode

 $ podman [options] run -t --mount type=devpts,target=/dev/pts,uid=1000,gid=1001,mode=123 quay.io/libpod/systemd-image:20240124 stat -c%g-%a /dev/pts/0
 Error: crun: open `/dev/pts/0`: Permission denied: OCI permission denied

Test is consistently failing and I can reproduce on rawhide with the 6.15 kernel (6.15.0-0.rc0.20250327git1a9239bb4253.5.fc43.x86_64).

@giuseppe Does that ring a bell for you? It is only failing as rootless, as root the command works fine.

[giuseppe]

this looks like something changed in the kernel.

I wonder if it is caused by:

commit cc0876f817d6d1636795e97c20c3b2b1e177718c
Author: David Howells <dhowells@redhat.com>
Date:   Wed Feb 5 15:34:30 2025 -0600

    vfs: Convert devpts to use the new mount API
    
    Convert the devpts filesystem to the new internal mount API as the old
    one will be obsoleted and removed.  This allows greater flexibility in
    communication of mount parameters between userspace, the VFS and the
    filesystem.
    
    See Documentation/filesystems/mount_api.txt for more information.
    
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    [sandeen: forward port, keep pr_err vs errorf]
    Co-developed-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Link: https://lore.kernel.org/r/20250205213931.74614-3-sandeen@redhat.com
    Signed-off-by: Christian Brauner <brauner@kernel.org>

I'll ping David about it

[Luap99]

this looks like something changed in the kernel.

I wonder if it is caused by:

commit cc0876f817d6d1636795e97c20c3b2b1e177718c
Author: David Howells <dhowells@redhat.com>
Date:   Wed Feb 5 15:34:30 2025 -0600

    vfs: Convert devpts to use the new mount API
    
    Convert the devpts filesystem to the new internal mount API as the old
    one will be obsoleted and removed.  This allows greater flexibility in
    communication of mount parameters between userspace, the VFS and the
    filesystem.
    
    See Documentation/filesystems/mount_api.txt for more information.
    
    Cc: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David Howells <dhowells@redhat.com>
    [sandeen: forward port, keep pr_err vs errorf]
    Co-developed-by: Eric Sandeen <sandeen@redhat.com>
    Signed-off-by: Eric Sandeen <sandeen@redhat.com>
    Link: https://lore.kernel.org/r/20250205213931.74614-3-sandeen@redhat.com
    Signed-off-by: Christian Brauner <brauner@kernel.org>

I'll ping David about it

I am currently trying to build/bisect the kernel I can let you know if I find something.

So far it seems to be caused by other weird mode of 123, using a sane mode of 600 seems to work fine but my understanding is we should have CAP_DAC_OVERRIDE in the userns here so the mode likely should not matter at all.

And because the same works as real root I assume it is related to the user namespac'ed cap.

[giuseppe]

I am 99% sure that the issue is that the cc0876f817d6d1636795e97c20c3b2b1e177718c commit causes the specified IDs to be mapped in the user namespace

[giuseppe]

this patch fixes the problem for me:

diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
index 42e4d6eeb29f..9c20d78e41f6 100644
--- a/fs/devpts/inode.c
+++ b/fs/devpts/inode.c
@@ -89,12 +89,12 @@ enum {
 };
 
 static const struct fs_parameter_spec devpts_param_specs[] = {
-       fsparam_u32     ("gid",         Opt_gid),
+       fsparam_gid     ("gid",         Opt_gid),
        fsparam_s32     ("max",         Opt_max),
        fsparam_u32oct  ("mode",        Opt_mode),
        fsparam_flag    ("newinstance", Opt_newinstance),
        fsparam_u32oct  ("ptmxmode",    Opt_ptmxmode),
-       fsparam_u32     ("uid",         Opt_uid),
+       fsparam_uid     ("uid",         Opt_uid),
        {}
 };