newuidmap: open of uid_map failed: Permission denied #20386

EvgenyAfanasev · 2023-10-11T15:13:26Z

EvgenyAfanasev
Oct 11, 2023

Issue Description

When running rootless podman inside a container, I get the errors:

running `/usr/bin/newuidmap 16111 0 500 1 1 10000 65536`: newuidmap: open of uid_map failed: Permission denied 
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

Steps to reproduce the issue

/etc/subuid

evgenii:10000:65536

/etc/subgid

evgenii:10000:65536

podman --log-level trace info

INFO podman filtering at log level trace          
DEBUG Called info.PersistentPreRunE(podman --log-level trace info) 
DEBUG Using conmon: "/usr/bin/conmon"              
DEBUG Initializing boltdb state at /home/evgenii/.local/share/containers/storage/libpod/bolt_state.db 
DEBUG Using graph driver overlay                   
DEBUG Using graph root /home/evgenii/.local/share/containers/storage 
DEBUG Using run root /run/user/500/containers      
DEBUG Using static dir /home/evgenii/.local/share/containers/storage/libpod 
DEBUG Using tmp dir /run/user/500/libpod/tmp       
DEBUG Using volume path /home/evgenii/.local/share/containers/storage/volumes 
DEBUG Using transient store: false                 
DEBUG Not configuring container store              
DEBUG Initializing event backend journald          
DEBUG Configured OCI runtime crun-wasm initialization failed: no valid executable found for OCI runtime crun-wasm: invalid argument 
DEBUG Configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument 
DEBUG Configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument 
DEBUG Configured OCI runtime youki initialization failed: no valid executable found for OCI runtime youki: invalid argument 
TRACE found runtime "/usr/bin/crun"                
DEBUG Configured OCI runtime runc initialization failed: no valid executable found for OCI runtime runc: invalid argument 
DEBUG Configured OCI runtime runj initialization failed: no valid executable found for OCI runtime runj: invalid argument 
DEBUG Configured OCI runtime krun initialization failed: no valid executable found for OCI runtime krun: invalid argument 
DEBUG Configured OCI runtime ocijail initialization failed: no valid executable found for OCI runtime ocijail: invalid argument 
DEBUG Using OCI runtime "/usr/bin/crun"            
ERROR running `/usr/bin/newuidmap 16111 0 500 1 1 10000 65536`: newuidmap: open of uid_map failed: Permission denied 
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

I also tried running podman unshare cat /proc/self/uid_map, but with same result

Describe the results you received

podman --log-level trace info

INFO podman filtering at log level trace          
DEBUG Called info.PersistentPreRunE(podman --log-level trace info) 
DEBUG Using conmon: "/usr/bin/conmon"              
DEBUG Initializing boltdb state at /home/evgenii/.local/share/containers/storage/libpod/bolt_state.db 
DEBUG Using graph driver overlay                   
DEBUG Using graph root /home/evgenii/.local/share/containers/storage 
DEBUG Using run root /run/user/500/containers      
DEBUG Using static dir /home/evgenii/.local/share/containers/storage/libpod 
DEBUG Using tmp dir /run/user/500/libpod/tmp       
DEBUG Using volume path /home/evgenii/.local/share/containers/storage/volumes 
DEBUG Using transient store: false                 
DEBUG Not configuring container store              
DEBUG Initializing event backend journald          
DEBUG Configured OCI runtime crun-wasm initialization failed: no valid executable found for OCI runtime crun-wasm: invalid argument 
DEBUG Configured OCI runtime kata initialization failed: no valid executable found for OCI runtime kata: invalid argument 
DEBUG Configured OCI runtime runsc initialization failed: no valid executable found for OCI runtime runsc: invalid argument 
DEBUG Configured OCI runtime youki initialization failed: no valid executable found for OCI runtime youki: invalid argument 
TRACE found runtime "/usr/bin/crun"                
DEBUG Configured OCI runtime runc initialization failed: no valid executable found for OCI runtime runc: invalid argument 
DEBUG Configured OCI runtime runj initialization failed: no valid executable found for OCI runtime runj: invalid argument 
DEBUG Configured OCI runtime krun initialization failed: no valid executable found for OCI runtime krun: invalid argument 
DEBUG Configured OCI runtime ocijail initialization failed: no valid executable found for OCI runtime ocijail: invalid argument 
DEBUG Using OCI runtime "/usr/bin/crun"            
ERROR running `/usr/bin/newuidmap 16111 0 500 1 1 10000 65536`: newuidmap: open of uid_map failed: Permission denied 
Error: cannot set up namespace using "/usr/bin/newuidmap": exit status 1

Describe the results you expected

normal podman info

podman info output

podman version 4.7.1

Alt Linux x86_64

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

Additional information

Additional information like issue happens only occasionally or issue happens with a particular architecture or on a particular setting

rhatdan · 2023-10-11T15:34:10Z

rhatdan
Oct 11, 2023
Maintainer

How is the container you are running running? Have you checked SELinux yet?

0 replies

EvgenyAfanasev · 2023-10-11T16:59:03Z

EvgenyAfanasev
Oct 11, 2023
Author

How is the container you are running running?

It is my workstation PC

Have you checked SELinux yet?

SELinux is not installed

0 replies

rhatdan · 2023-10-11T17:27:37Z

rhatdan
Oct 11, 2023
Maintainer

We need the output of podman info.
We need the actual podman command you are executing the outside container with.

0 replies

EvgenyAfanasev · 2023-10-11T17:34:00Z

EvgenyAfanasev
Oct 11, 2023
Author

We need the output of podman info.

sudo podman info

host:
  arch: amd64
  buildahVersion: 1.32.0
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - misc
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.8-alt1.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.8, commit: alt1'
  cpuUtilization:
    idlePercent: 99.44
    systemPercent: 0.24
    userPercent: 0.32
  cpus: 16
  databaseBackend: boltdb
  distribution:
    distribution: altlinux
    version: "10.2"
  eventLogger: journald
  freeLocks: 1996
  hostname: asrock-x470-r2700x
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.5.6-un-def-alt1
  linkmode: dynamic
  logDriver: journald
  memFree: 24327307264
  memTotal: 33564573696
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.8.0-alt1.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.8.0
    package: netavark-1.8.0-alt2.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.8.0
  ociRuntime:
    name: crun
    package: crun-1.9.2-alt1.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.9.2
      commit: 8e8e1ede095667bebe9d6f06d9cda8b6e047cca0
      rundir: /run/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +YAJL
  os: linux
  pasta:
    executable: ""
    package: ""
    version: ""
  remoteSocket:
    exists: false
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.1.12-alt1.x86_64
    version: |-
      slirp4netns version 1.1.12
      commit: 7a104a101aa3278a2152351a082a6df71f57c9a3
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 3
      libseccomp: 2.5.4
  swapFree: 68719472640
  swapTotal: 68719472640
  uptime: 2h 49m 50.00s (Approximately 0.08 days)
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.altlinux.org
  - docker.io
  - quay.io
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 9
    paused: 0
    running: 0
    stopped: 9
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 180799668224
  graphRootUsed: 30186856448
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /tmp/.private/root
  imageStore:
    number: 7
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 4.7.1
  Built: 1696594085
  BuiltTime: Fri Oct  6 15:08:05 2023
  GitCommit: alt1
  GoVersion: go1.21.2
  Os: linux
  OsArch: linux/amd64
  Version: 4.7.1

We need the actual podman command you are executing the outside container with.

is it ? podman run hello

0 replies

rhatdan · 2023-10-11T19:43:29Z

rhatdan
Oct 11, 2023
Maintainer

Is newuidmap and newgidmap setuid or setfcap?

$ getcap /usr/bin/newuidmap /usr/bin/newgidmap
/usr/bin/newuidmap cap_setuid=ep
/usr/bin/newgidmap cap_setgid=ep

0 replies

Luap99 · 2023-10-17T15:56:07Z

Luap99
Oct 17, 2023
Maintainer

Moving to a discussion as this doe snot look like a podman bug and instead something with your environment

0 replies

616b2f · 2023-12-01T00:16:46Z

616b2f
Dec 1, 2023

have the same issue, when I try to use podman, the output is just slightly different (because of the version 4.7.2?):

ERRO[0000] running `/usr/bin/newuidmap 4574 0 1000 1 1 100000 65536`: newuidmap: write to uid_map failed: Operation not permitted
Error: cannot set up namespace using "/usr/bin/newuidmap": should have setuid or have filecaps setuid: exit status 1

$ sudo podman info
host:
  arch: amd64
  buildahVersion: 1.32.0
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  - hugetlb
  - pids
  - rdma
  - misc
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.8-2.fc40.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.8, commit: '
  cpuUtilization:
    idlePercent: 80.82
    systemPercent: 5.32
    userPercent: 13.86
  cpus: 4
  databaseBackend: boltdb
  distribution:
    distribution: fedora
    variant: silverblue
    version: "40"
  eventLogger: journald
  freeLocks: 2048
  hostname: castle
  idMappings:
    gidmap: null
    uidmap: null
  kernel: 6.7.0-0.rc3.20231129git18d46e76d7c2.30.fc40.x86_64
  linkmode: dynamic
  logDriver: journald
  memFree: 11850792960
  memTotal: 16663478272
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.9.0-1.fc40.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.9.0
    package: netavark-1.9.0-1.fc40.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.9.0
  ociRuntime:
    name: crun
    package: crun-1.12-1.fc40.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.12
      commit: ce429cb2e277d001c2179df1ac66a470f00802ae
      rundir: /run/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20231119.g4f1709d-1.fc40.x86_64
    version: |
      pasta 0^20231119.g4f1709d-1.fc40.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: false
    path: /run/podman/podman.sock
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: false
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.2-1.fc40.x86_64
    version: |-
      slirp4netns version 1.2.2
      commit: 0ee2d87523e906518d34a6b423271e4826f71faf
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.3
  swapFree: 8589930496
  swapTotal: 8589930496
  uptime: 0h 4m 16.00s
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
  - quay.io
store:
  configFile: /usr/share/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: overlay
  graphOptions:
    overlay.mountopt: nodev,metacopy=on
  graphRoot: /var/lib/containers/storage
  graphRootAllocated: 498556993536
  graphRootUsed: 37828894720
  graphStatus:
    Backing Filesystem: btrfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Supports shifting: "true"
    Supports volatile: "true"
    Using metacopy: "true"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 0
  runRoot: /run/containers/storage
  transientStore: false
  volumePath: /var/lib/containers/storage/volumes
version:
  APIVersion: 4.7.2
  Built: 1698762097
  BuiltTime: Tue Oct 31 15:21:37 2023
  GitCommit: ""
  GoVersion: go1.21.3
  Os: linux
  OsArch: linux/amd64
  Version: 4.7.2

I am running Fedora Silverblue rawhide:

$ rpm-ostree status
State: idle
Deployments:
● fedora:fedora/rawhide/x86_64/silverblue
                  Version: Rawhide.20231130.n.0 (2023-11-30T06:04:25Z)
               BaseCommit: d9e7bc68f8e53945dc71f52b8c6c6722ed3a893cb4c83e7c12a265821e76f45e
             GPGSignature: Valid signature by 115DF9AEF857853EE8445D0A0727707EA15B79CC
          LayeredPackages: alacritty bemenu brightnessctl fd-find git-lfs grim j4-dmenu-desktop mako neovim network-manager-applet polkit-gnome ripgrep slurp sway swaylock tmux vifm waybar
                           wl-clipboard wlroots xdg-desktop-portal-wlr

this is the last version that works for me, if it helps somehow.

  fedora:fedora/rawhide/x86_64/silverblue
                  Version: Rawhide.20231116.n.0 (2023-11-16T06:02:02Z)
               BaseCommit: 5bfde4ec863d8bcbb5890cf4aba27d9bf92bec193f050e4da86b68a46ad61f13
             GPGSignature: Valid signature by 115DF9AEF857853EE8445D0A0727707EA15B79CC
          LayeredPackages: alacritty bemenu brightnessctl fd-find git-lfs grim j4-dmenu-desktop libwebkit2gtk-4.0.so.37 mako neovim network-manager-applet polkit-gnome ripgrep slurp sway
                           swaylock tmux vifm waybar webkit2gtk4.0-devel wl-clipboard wlroots xdg-desktop-portal-wlr
                   Pinned: yes

$ getcap /usr/bin/newuidmap /usr/bin/newgidmap
/usr/bin/newuidmap cap_setuid=ip
/usr/bin/newgidmap cap_setgid=ip

2 replies

Luap99 Dec 1, 2023
Maintainer

$ getcap /usr/bin/newuidmap /usr/bin/newgidmap
/usr/bin/newuidmap cap_setuid=ip
/usr/bin/newgidmap cap_setgid=ip

The caps should show ep not ip AFAIK. I am not sure why it is ip but it looks wrong.

616b2f Dec 1, 2023

It seems like in the version that still works for me, it's also ep, I am not sure why it's changed, maybe I ask in the atomic community if they can have a look.

xxxserxxx · 2025-02-12T01:47:05Z

xxxserxxx
Feb 12, 2025

Same issue here. Differences:

I'm running Arch
Everything (rootless podman) was working fine
I did a software update and started getting this exact same error.
My setcap_* are both ep

Aside from having no idea how to fix this, the error message is utterly useless to me.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

newuidmap: open of uid_map failed: Permission denied #20386

{{title}}

Replies: 8 comments 2 replies

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

newuidmap: open of uid_map failed: Permission denied #20386

EvgenyAfanasev Oct 11, 2023

Issue Description

Steps to reproduce the issue

Describe the results you received

Describe the results you expected

podman info output

Podman in a container

Privileged Or Rootless

Upstream Latest Release

Additional environment details

Additional information

Replies: 8 comments · 2 replies

rhatdan Oct 11, 2023 Maintainer

EvgenyAfanasev Oct 11, 2023 Author

rhatdan Oct 11, 2023 Maintainer

EvgenyAfanasev Oct 11, 2023 Author

rhatdan Oct 11, 2023 Maintainer

Luap99 Oct 17, 2023 Maintainer

616b2f Dec 1, 2023

Luap99 Dec 1, 2023 Maintainer

616b2f Dec 1, 2023

xxxserxxx Feb 12, 2025

EvgenyAfanasev
Oct 11, 2023

Replies: 8 comments 2 replies

rhatdan
Oct 11, 2023
Maintainer

EvgenyAfanasev
Oct 11, 2023
Author

rhatdan
Oct 11, 2023
Maintainer

EvgenyAfanasev
Oct 11, 2023
Author

rhatdan
Oct 11, 2023
Maintainer

Luap99
Oct 17, 2023
Maintainer

616b2f
Dec 1, 2023

Luap99 Dec 1, 2023
Maintainer

xxxserxxx
Feb 12, 2025