Podman creates a rundir with insufficient permissions about podman HOT 8 OPEN

There is probably no user session for the ansible user so Podman fall backs to create the rundir in the home directory.

Are you sure you want to run podman as the ansible user and not as root?

If you really want it, I suggest enabling lingering mode for that user (loginctl enable-linger ansible)

from podman.

I want to have a rootless container. Therefore the HAProxy container is running in the user space of the the ansible user. Lingering mode is already activated for this user.

from podman.

strange that the /home/ansible/rundir directory is created when there is a user session.

do you get the same error if you run sudo -u ansible /usr/libexec/keepalived/haproxy_check.sh manually?

Can you temporarily turn off selinux to see if it is blocking the access to the directory?

from podman.

Turning off SELinux, does not change the behavior. That is something I have already tested.

$ sestatus
SELinux status:                 disabled

Running the script as ansible user works as exptected:

$ /usr/libexec/keepalived/haproxy_check.sh
59f82621245d

Yes, I get the same error running it manually with sudo -u ansible:

$ sudo -u ansible /usr/libexec/keepalived/haproxy_check.sh
ERRO[0000] unable to make rootless runtime: mkdir /home/ansible/rundir/containers: permission denied

But, after stopping keepalived and removing the rundir with its 0600 permissions, it works:

$ sudo systemctl stop keepalived.service
$ rm -rf ~/rundir
$ sudo -u ansible /usr/libexec/keepalived/haproxy_check.sh
59f82621245d
$ ls -la ~/rundir
drwx------   3 ansible ansible   24 25. Jun 09:49 .
drwx------. 12 ansible ansible 4096 25. Jun 09:49 ..
drwx------   2 ansible ansible    6 25. Jun 09:49 containers

In this case, it gets created with sufficient permissions 0700.

As soon as I remove the rundir and start the keepalived service again, Podman recreates it with insufficient permissions:

$ rm -rf ~/rundir
$ sudo systemctl start keepalived.service
$ sudo ls -la /home/ansible/rundir
drw-------   2 ansible ansible    6 25. Jun 09:51 .
drwx------. 12 ansible ansible 4096 25. Jun 09:51 ..

It seems that only running the script from within keepalived causes this issue.
I appreciate any help.

from podman.

it smells like keepalived is using the wrong umask.

Can you try to override the umask value to something like 0022?

EDIT:

if https://github.com/acassen/keepalived/blob/master/lib/utils.c#L73 is the default umask used by keepalived, then that explains the missing exec bit set for the directory

from podman.

@romanwoessner had a chance to try overriding the umask value?

from podman.