Allow users to add host user accounts to /etc/passwd #12627

rhatdan · 2021-12-16T14:27:24Z

Some containers require certain user account(s) to exist within the
container when they are run. This option will allow callers to add a
bunch of passwd entries from the host to the container even if the
entries are not in the local /etc/passwd file on the host.

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935831

Signed-off-by: Daniel J Walsh [email protected]

What this PR does / why we need it:

How to verify it

Which issue(s) this PR fixes:

Special notes for your reviewer:

mheon · 2021-12-16T14:29:46Z

docs/source/markdown/podman-create.1.md

+#### **--hostuser**=*name*
+
+Add host user account to /etc/passwd within container. Username or UID must
+exists on the host system.


Please make it more clear that this does not set the user in the container to be the new UID or GID.

Does this work with rootless Podman, considering UID/GID mapping means the UID/GID won't actually match the one on the host? Probably need a warning about that.

Also should mention explicitly that UID is allowed.

Should we change the UID to match the UID on the host? within the user namespace?
IE Adding dwalsh (UID=3267) would end up as UID=0 within the container.

mheon · 2021-12-16T14:31:04Z

Does --hostuser=my-user --user=my-user work? As in, creates a user identical to the one on the host, and then sets the container to start as that user?

rhatdan · 2021-12-16T14:46:37Z

./bin/podman run --hostuser dwalsh --user dwalsh alpine grep dwalsh /etc/passwd
Error: unable to find user dwalsh: no matching entries in passwd file

Does not work. I will take a look.

docs/source/markdown/podman-create.1.md

TomSweeneyRedHat · 2021-12-16T23:43:41Z

docs/source/markdown/podman-run.1.md

+#### **--hostuser**=*name*
+
+Add host user account to /etc/passwd within container. Username or UID must
+exists on the host system.


If you take above, do the same here.

rhatdan · 2021-12-22T15:51:50Z

@giuseppe WDYT, should the UIDs be modified based on the user namespace within the container?

cdoern · 2021-12-22T18:04:51Z

libpod/container_internal_linux.go

 // Returns password entry (as a string that can be appended to /etc/passwd) and
 // any error that occurred.
 func (c *Container) generatePasswdEntry() (string, error) {
 	passwdString := ""

 	addedUID := 0
+	for _, userid := range c.config.HostUsers {
+		// Assume UID look up first, if it fails lookup by username
+		u, err := user.LookupId(userid)


maybe make a function for this since done a few times. similar to https://github.com/containers/podman/blob/dbdf4761abb6d68169c8fdd24bd0c44d38c1c5f8/pkg/domain/infra/abi/images.go#L839-L844 once this merges you can use this

giuseppe · 2021-12-22T19:12:01Z

I think we shouldn't do any conversion to the ids in the namespace.
The rootless user won't anyway be able to use IDs outside of the allocated range and the ID should be relative to the container image so I think it is correct without converting it.

giuseppe · 2021-12-23T08:18:30Z

test/system/030-run.bats

@@ -711,6 +711,18 @@ EOF
    run_podman rmi nomtab
 }

+@test "podman run --hostuser tests" {
+    skip_if_not_rootless "test whether hostuser is successfully added"


why does it need rootless?

Mainly because I am not sure how to figure out a user which is not in the container to add to the container. If you are running rootless, I can add the current user.

If running as root, I could add a user to the system and then use that, but I am not crazy about modifying a system when users run the tests.

@edsantiago Any ideas?

giuseppe

LGTM

openshift-ci · 2021-12-23T09:56:47Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [giuseppe,rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rhatdan · 2021-12-23T12:14:35Z

@containers/podman-maintainers PTAL

vrothberg · 2021-12-23T12:19:31Z

docs/source/markdown/podman-create.1.md

+Add a user account to /etc/passwd from the host to the container. The Username
+or UID must exists on the host system.


Suggested change

Add a user account to /etc/passwd from the host to the container. The Username

or UID must exists on the host system.

Add a user account to /etc/passwd from the host to the container. The username

or UID must exist on the host system.

Same below.

Some containers require certain user account(s) to exist within the container when they are run. This option will allow callers to add a bunch of passwd entries from the host to the container even if the entries are not in the local /etc/passwd file on the host. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935831 Signed-off-by: Daniel J Walsh <[email protected]>

mheon · 2021-12-23T18:27:52Z

/lgtm

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 16, 2021

mheon reviewed Dec 16, 2021

View reviewed changes

rhatdan force-pushed the passwd branch 2 times, most recently from e0ec610 to 29b8beb Compare December 16, 2021 18:53

TomSweeneyRedHat reviewed Dec 16, 2021

View reviewed changes

docs/source/markdown/podman-create.1.md Outdated Show resolved Hide resolved

TomSweeneyRedHat reviewed Dec 16, 2021

View reviewed changes

rhatdan force-pushed the passwd branch 3 times, most recently from d570235 to 123e6b8 Compare December 21, 2021 17:01

cdoern reviewed Dec 22, 2021

View reviewed changes

rhatdan force-pushed the passwd branch 2 times, most recently from e930052 to a3b309b Compare December 22, 2021 19:11

giuseppe reviewed Dec 23, 2021

View reviewed changes

giuseppe approved these changes Dec 23, 2021

View reviewed changes

vrothberg reviewed Dec 23, 2021

View reviewed changes

rhatdan force-pushed the passwd branch from a3b309b to e8c06fa Compare December 23, 2021 12:52

openshift-ci bot assigned mheon Dec 23, 2021

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Dec 23, 2021

openshift-merge-robot merged commit 73a54ea into containers:main Dec 23, 2021

github-actions bot added the locked - please file new issue/PR Assist humans wanting to comment on an old issue or PR with locked comments. label Sep 22, 2023

github-actions bot locked as resolved and limited conversation to collaborators Sep 22, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow users to add host user accounts to /etc/passwd #12627

Allow users to add host user accounts to /etc/passwd #12627

rhatdan commented Dec 16, 2021

mheon Dec 16, 2021

rhatdan Dec 16, 2021

mheon commented Dec 16, 2021

rhatdan commented Dec 16, 2021

TomSweeneyRedHat Dec 16, 2021

rhatdan commented Dec 22, 2021

cdoern Dec 22, 2021

giuseppe commented Dec 22, 2021

giuseppe Dec 23, 2021

rhatdan Dec 23, 2021

giuseppe left a comment

openshift-ci bot commented Dec 23, 2021

rhatdan commented Dec 23, 2021

vrothberg Dec 23, 2021

mheon commented Dec 23, 2021

		Add a user account to /etc/passwd from the host to the container. The Username
		or UID must exists on the host system.

Allow users to add host user accounts to /etc/passwd #12627

Allow users to add host user accounts to /etc/passwd #12627

Conversation

rhatdan commented Dec 16, 2021

What this PR does / why we need it:

How to verify it

Which issue(s) this PR fixes:

Special notes for your reviewer:

mheon Dec 16, 2021

Choose a reason for hiding this comment

rhatdan Dec 16, 2021

Choose a reason for hiding this comment

mheon commented Dec 16, 2021

rhatdan commented Dec 16, 2021

TomSweeneyRedHat Dec 16, 2021

Choose a reason for hiding this comment

rhatdan commented Dec 22, 2021

cdoern Dec 22, 2021

Choose a reason for hiding this comment

giuseppe commented Dec 22, 2021

giuseppe Dec 23, 2021

Choose a reason for hiding this comment

rhatdan Dec 23, 2021

Choose a reason for hiding this comment

giuseppe left a comment

Choose a reason for hiding this comment

openshift-ci bot commented Dec 23, 2021

rhatdan commented Dec 23, 2021

vrothberg Dec 23, 2021

Choose a reason for hiding this comment

mheon commented Dec 23, 2021