Comments (2)
Make sure to go through the cases in #1459 before making changes.
from apptainer.
Indeed I found that the problem in #1459 reappeared. I think adding the fuse allow_other
option helps, but that's not enough to fix the Permission denied
error. With setuid mode it also happens on CentOS7, although not on Rocky9. In user namespace mode it happens on all 3 current systems.
Here's how to reproduce it outside of Apptainer, using just command line commands. Use the test.squashfs from #1459 and for simplicity build a simple squashfs container with
$ apptainer pull test_image.sif docker://alpine
$ apptainer sif dump 4 test_image.sif >test_image.squashfs
Next reproduce the issue privileged on CentOS7 or Rocky8 since it's simpler:
$ cd /tmp
$ mkdir mnt1 mnt2 mnt3
$ sudo unshare -m
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test_image.squashfs mnt1 &
[1] 7617
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test.squashfs mnt2 &
[2] 7622
[root@localhost tmp]# mount -t overlay -o lowerdir=mnt2:mnt1 - mnt3
[root@localhost tmp]# runuser user -c "ls mnt3"
ls: cannot open directory 'mnt3': Permission denied
Replace user
with your own user name and 1000
with your own uid and gid.
Bizarrely, I found that this can be worked around by unmounting and remounting the overlay:
[root@localhost tmp]# umount mnt3
[root@localhost tmp]# mount -t overlay -o lowerdir=mnt2:mnt1 - mnt3
[root@localhost tmp]# runuser user -c "ls mnt3"
This only works when there is also an access to the mnt3 mountpoint after the initial overlay mount and before the umount.
Likewise, for user namespaces, on Rocky8 or Rocky9 in one window create a root-mapped user namespace:
SHELL=/bin/sh unshare -rm
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test_image.squashfs mnt1 &
[root@localhost tmp]# squashfuse -f -o allow_other,ro,uid=1000,gid=1000 test.squashfs mnt2 &
[root@localhost tmp]# mount -t overlay -o lowerdir=mnt2:mnt1 - mnt3
[root@localhost tmp]# echo $$
2793
Then in another window enter that namespace and create a sub user namespace:
$ SHELL=/bin/sh nsenter -t 2793 --preserve-credentials -U -m --
[root@localhost /]# cd tmp
[root@localhost tmp]# unshare -U
[nobody@localhost tmp]$ echo $$
3350
Then back in the root-mapped namespace set it to map root back to the original user:
[nobody@localhost tmp]# echo "1000 0 1" >/proc/3350/gid_map
[nobody@localhost tmp]# echo "1000 0 1" >/proc/3350/uid_map
Then in the nsenter user shell you see Permission denied:
[nobody@localhost tmp]$ id
uid=1000(user) gid=1000(user) groups=1000(user),65534(nobody)
[nobody@localhost tmp]$ cd mnt3
ls: cannot open directory 'mnt3': Permission denied
Until you go back to the original root-mapped space and umount and mount again the overlay.
from apptainer.
Related Issues (20)
- ERROR: apply_privileges Requesting capability set HOT 3
- APPTAINERENV_CUDA_VISIBLE_DEVICES env not working HOT 1
- Missing EGL ICD when using --nv HOT 2
- Couldn't always determine user account information in slurm HOT 7
- oras download gets stuck HOT 1
- Timeout seems changed in stopping mounts from 10 secs to 1 sec. HOT 2
- RFE: Add `--sandbox` option to `apptainer pull`
- Yum bootstrap fails on el8 & el9 "while copying pseudo devices" with "operation not permitted" HOT 3
- Unknown image format/type HOT 1
- v1.3.1 Docker credentials not read from ~/.docker/config.json HOT 2
- Apptainer cannot download Docker image even when properly logged in HOT 3
- Apptainer getting stuck at tzdata configuration despite export DEBIAN_FRONTEND=noninteractive HOT 1
- Building from source with --with-suid: make fails with uninformative error HOT 1
- X.509 Integration in Apptainer HOT 2
- Building on local image fails with error mounting `tmpfs` HOT 11
- No access to usernames except myself in apptainer container HOT 1
- Problems getting the CernVM-FS client working from inside of a container. HOT 1
- Guidance on Choosing Between Apptainer and SingularityCE for Computational Materials Science Applications. HOT 8
- Facing Library link not found issue when launching Monolix 2024 in container through apptainer HOT 3
- How to Submit Jobs from Materials Studio GUI running on Microsoft Windows to Apptainer Container with DS BIOVIA Materials Studio Installed on Ubuntu 22.04.4 LTS. HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from apptainer.