biggest showstopper right now is that I can't use sudo for anything. it prompts for password, never

B

bketelsenOP•8/3/23, 4:26 PM

the whole thing is fascinating, there's a lot of moving parts here

A

akdev•8/3/23, 4:27 PM

you can use podman exec -u 0 to investigate

Bbketelsen biggest showstopper right now is that I can't use sudo for anything. it prompts ...

A

akdev•8/3/23, 4:29 PM

Mm this is not a rootful container is it?

B

bketelsenOP•8/3/23, 4:29 PM

no, I don't think so

A

akdev•8/3/23, 4:30 PM

Is it trying to read /etc off the host or the container? (Sorry not familiar with podman sh)

B

bketelsenOP•8/3/23, 4:30 PM

I think it's trying to read /etc from the container, I suspect it's not mounted but should be

B

bketelsenOP•8/3/23, 4:31 PM

at least /etc/shadow should be?

J

j0rge•8/3/23, 4:33 PM

no one's familiar with podmansh, it just landed. We might be the first outside of the podman team playing with it

B

bketelsenOP•8/3/23, 4:33 PM

going where noone has gone before

B

bketelsenOP•8/3/23, 4:33 PM

it's my mantra lol

A

akdev•8/3/23, 4:34 PM

Can you do:

id -Z

id -Z

id -Z

id -Z and

ls -lZ /etc/sudoers /etc/shadow

ls -lZ /etc/sudoers /etc/shadow

ls -lZ /etc/sudoers /etc/shadow

ls -lZ /etc/sudoers /etc/shadow

Inside the container

Jj0rge no one's familiar with podmansh, it just landed. We might be the first outside o...

A

akdev•8/3/23, 4:35 PM

Yeah I was looking for docs

A

akdev•8/3/23, 4:35 PM

Nada lol

A

akdev•8/3/23, 4:35 PM

I got to the PR it got merged on trying to see

A

akdev•8/3/23, 4:36 PM

Mm so we are trying to make sudo work so we can replace the system shell?

A

akdev•8/3/23, 4:38 PM

mm maybe also wc -l /etc/shadow inside and out side of the container too

A

akdev•8/3/23, 4:39 PM

It doesn't seem like it automounts etc or anything like that

A

akdev•8/3/23, 4:39 PM

So probably what is happening is that your /etc/shadow and other related files don't have the user

A

akdev•8/3/23, 4:40 PM

You could try the following to confirm:

podman exec -it -u 0:0

podman exec -it -u 0:0

podman exec -it -u 0:0

podman exec -it -u 0:0 into the container and then do

passwd $youruserincontainer

passwd $youruserincontainer

passwd $youruserincontainer

passwd $youruserincontainer

A

akdev•8/3/23, 4:40 PM

If this works and you can set a password then maybe sudo will work

B

bketelsenOP•8/3/23, 4:41 PM

$ id -Z
unconfined_u:unconfined_r:spc_t:s0

$ id -Z
unconfined_u:unconfined_r:spc_t:s0

$ id -Z
unconfined_u:unconfined_r:spc_t:s0

$ id -Z
unconfined_u:unconfined_r:spc_t:s0

A

akdev•8/3/23, 4:41 PM

this is good

B

bketelsenOP•8/3/23, 4:41 PM

$ ls -lZ /etc/sudoers /etc/shadow
-rw-r-----. 1 root shadow system_u:object_r:container_file_t:s0:c1022,c1023  729 Jul 31 01:17 /etc/shadow
-r--r-----. 1 root root   system_u:object_r:container_file_t:s0:c1022,c1023 1671 Aug  3  2022 /etc/sudoers

$ ls -lZ /etc/sudoers /etc/shadow
-rw-r-----. 1 root shadow system_u:object_r:container_file_t:s0:c1022,c1023  729 Jul 31 01:17 /etc/shadow
-r--r-----. 1 root root   system_u:object_r:container_file_t:s0:c1022,c1023 1671 Aug  3  2022 /etc/sudoers

$ ls -lZ /etc/sudoers /etc/shadow
-rw-r-----. 1 root shadow system_u:object_r:container_file_t:s0:c1022,c1023  729 Jul 31 01:17 /etc/shadow
-r--r-----. 1 root root   system_u:object_r:container_file_t:s0:c1022,c1023 1671 Aug  3  2022 /etc/sudoers

$ ls -lZ /etc/sudoers /etc/shadow
-rw-r-----. 1 root shadow system_u:object_r:container_file_t:s0:c1022,c1023  729 Jul 31 01:17 /etc/shadow
-r--r-----. 1 root root   system_u:object_r:container_file_t:s0:c1022,c1023 1671 Aug  3  2022 /etc/sudoers

A

akdev•8/3/23, 4:45 PM

selinux should not be a problem according to this,
spc_t is a highly privileged domain so it should be able to read/write to container_file_t files

J

j0rge•8/3/23, 4:50 PM

https://github.com/containers/podman/blob/main/docs/source/markdown/podmansh.1.md

GitHub

podman/docs/source/markdown/podmansh.1.md at main · containers/podman

Podman: A tool for managing OCI containers and pods. - containers/podman

J

j0rge•8/3/23, 4:50 PM

this is the only doc we have afaict

B

bketelsenOP•8/3/23, 4:56 PM

i am not sure how I can do a

podman exec

podman exec

podman exec

podman exec since it's a rootless container running as the

fullu

fullu

fullu

fullu user, who has

podmansh

podmansh

podmansh

podmansh set as the shell. so I don't know how to do any podman things in the context of that user

B

bketelsenOP•8/3/23, 5:01 PM

oh interesting

B

bketelsenOP•8/3/23, 5:02 PM

I passed in /etc/passwd /etc/sudoers /etc/shadow as volumes and now the uid mapping is getting in the way

B

bketelsenOP•8/3/23, 5:02 PM

$ ls -la /etc/passwd
-rw-r--r--. 1 root root 1417 Aug  3 17:00 /etc/passwd
$ sudo su
sudo: /etc/sudoers is owned by uid 65534, should be 0
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit

$ ls -la /etc/passwd
-rw-r--r--. 1 root root 1417 Aug  3 17:00 /etc/passwd
$ sudo su
sudo: /etc/sudoers is owned by uid 65534, should be 0
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit

$ ls -la /etc/passwd
-rw-r--r--. 1 root root 1417 Aug  3 17:00 /etc/passwd
$ sudo su
sudo: /etc/sudoers is owned by uid 65534, should be 0
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit

$ ls -la /etc/passwd
-rw-r--r--. 1 root root 1417 Aug  3 17:00 /etc/passwd
$ sudo su
sudo: /etc/sudoers is owned by uid 65534, should be 0
sudo: no valid sudoers sources found, quitting
sudo: error initializing audit plugin sudoers_audit

Bbketelsen i am not sure how I can do a `podman exec` since it's a rootless container runni...

A

akdev•8/3/23, 7:10 PM

you can just do podman exec from the user I guess mm

A

akdev•8/3/23, 7:10 PM

If the user has no shell then probably

sudo -u $user podman

sudo -u $user podman

sudo -u $user podman

sudo -u $user podman may still work?

Bbketelsen I passed in /etc/passwd /etc/sudoers /etc/shadow as volumes and now the uid mapp...

A

akdev•8/3/23, 7:11 PM

You don't want these ones inside the container because your user can't read them anyway (well /etc/shadow can't be read)

A

akdev•8/3/23, 7:13 PM

If you get sudo working inside the container then we can probably use

nsenter -t 1

nsenter -t 1

nsenter -t 1

nsenter -t 1 to get real root

Aakdev If the user has no shell then probably `sudo -u $user podman` may still work?

B

bketelsenOP•8/3/23, 7:16 PM

this worked with some caveats. had to start as root, cd to the user's home, then run it and it worked!

A

akdev•8/3/23, 7:18 PM

Try changing the password inside the container with passwd (don't pass /etc/shadow and /etc/passwd through though)

B

bketelsenOP•8/3/23, 7:28 PM

bash-5.2# sudo -u fullu podman exec -it cf7 passwd
Changing password for fullu.
Current password: 
passwd: Authentication token manipulation error

bash-5.2# sudo -u fullu podman exec -it cf7 passwd
Changing password for fullu.
Current password: 
passwd: Authentication token manipulation error

bash-5.2# sudo -u fullu podman exec -it cf7 passwd
Changing password for fullu.
Current password: 
passwd: Authentication token manipulation error

bash-5.2# sudo -u fullu podman exec -it cf7 passwd
Changing password for fullu.
Current password: 
passwd: Authentication token manipulation error

B

bketelsenOP•8/3/23, 7:30 PM

however ... !

B

bketelsenOP•8/3/23, 7:30 PM

podman exec -it -u 0:0

podman exec -it -u 0:0

podman exec -it -u 0:0

podman exec -it -u 0:0 into the container and then do

passwd $youruserincontainer

passwd $youruserincontainer

passwd $youruserincontainer

passwd $youruserincontainer <- that worked

J

j0rge•8/3/23, 7:30 PM

@EyeCantCU nice work getting the builds working! thanks!

B

bketelsenOP•8/3/23, 7:31 PM

$ sudo su
[sudo] password for fullu: 
fullu is not in the sudoers file.  This incident will be reported.
$

$ sudo su
[sudo] password for fullu: 
fullu is not in the sudoers file.  This incident will be reported.
$

$ sudo su
[sudo] password for fullu: 
fullu is not in the sudoers file.  This incident will be reported.
$

$ sudo su
[sudo] password for fullu: 
fullu is not in the sudoers file.  This incident will be reported.
$

J

j0rge•8/3/23, 7:32 PM

this one is above my skill level if someone wants to take a look: https://github.com/ublue-os/nvidia/pull/140

GitHub

Use FCOS for generating the akmods keys by Perpixel · Pull Request ...

This makes it possible to run it on arm64 macOS.

J

j0rge•8/3/23, 7:33 PM

I like the idea of building stuff on fcos so that we can just use the stable channel, the less numbers to keep track of the better, heh.

Jj0rge @EyeCantCU nice work getting the builds working! thanks!

E

EyeCantCU•8/3/23, 7:35 PM

No problem. Glad the ball is rolling again. Want to add the GNOME extension but for whatever reason every time I tried building it COPR failed to remove the chroot environment. Given the same extension compiled just fine for Bazzite yesterday, I'd imagine it's a COPR bug and I'll just try later today or tomorrow

B

bketelsenOP•8/3/23, 7:35 PM

and success @akdev - I got sudo access by using the podman exec -u 0:0 to add my container user to the sudo group

B

bketelsenOP•8/3/23, 7:36 PM

now it's down to selinux issues.

A

akdev•8/3/23, 7:36 PM

selinux should actually be ok, what issues do you have now?

B

bketelsenOP•8/3/23, 7:40 PM

dpkg: error processing archive /var/cache/apt/archives/libpython3.10-minimal_3.1
0.12-1~22.04.2_amd64.deb (--unpack):
 new libpython3.10-minimal:amd64 package pre-removal script subprocess returned 
error exit status 2
dpkg (subprocess): cannot set security execution context for maintainer script: 
Invalid argument

dpkg: error processing archive /var/cache/apt/archives/libpython3.10-minimal_3.1
0.12-1~22.04.2_amd64.deb (--unpack):
 new libpython3.10-minimal:amd64 package pre-removal script subprocess returned 
error exit status 2
dpkg (subprocess): cannot set security execution context for maintainer script: 
Invalid argument

dpkg: error processing archive /var/cache/apt/archives/libpython3.10-minimal_3.1
0.12-1~22.04.2_amd64.deb (--unpack):
 new libpython3.10-minimal:amd64 package pre-removal script subprocess returned 
error exit status 2
dpkg (subprocess): cannot set security execution context for maintainer script: 
Invalid argument

dpkg: error processing archive /var/cache/apt/archives/libpython3.10-minimal_3.1
0.12-1~22.04.2_amd64.deb (--unpack):
 new libpython3.10-minimal:amd64 package pre-removal script subprocess returned 
error exit status 2
dpkg (subprocess): cannot set security execution context for maintainer script: 
Invalid argument

B

bketelsenOP•8/3/23, 7:40 PM

after gaining sudo in the container I did an apt update & apt upgrade

B

bketelsenOP•8/3/23, 7:43 PM

success!

biggest showstopper right now is that I can't use sudo for anything. it prompts for password, never

Similar Threads

Similar Threads

Similar Threads