Comments (3)
debarshiray
commented on September 13, 2024
Yes, I can reproduce this; and it doesn't matter if the storage driver (specified in ~/.config/containers/storage.conf) used is overlay or vfs.
from toolbox.
debarshiray
commented on September 13, 2024
As @owtaylor pointed out, this is a matter of capabilities. Specifically CAP_DAC_OVERRIDE for the problem you observed.
On the host:
[rishi@kolache ~]$ capsh --print
Current: =
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read
Securebits: 00/0x0/1'b0
secure-noroot: no (unlocked)
secure-no-suid-fixup: no (unlocked)
secure-keep-caps: no (unlocked)
uid=1000(rishi)
gid=1000(rishi)
groups=10(wheel),1000(rishi)
Inside the toolbox:
🔹[rishi@toolbox ~]$ capsh --print
Current: = cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read+eip
Bounding set =cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read
Securebits: 00/0x0/1'b0
secure-noroot: no (unlocked)
secure-no-suid-fixup: no (unlocked)
secure-keep-caps: no (unlocked)
uid=1000(rishi)
gid=1000(rishi)
groups=10(wheel)
We need to clear the current list of effective capabilities to match the behaviour on the host.
from toolbox.
debarshiray
commented on September 13, 2024
@kstuart Does #38 help with the LibreOffice build?
from toolbox.
Related Issues (20)
- List supported toolbox images
- Cannot access mounted drive with fuse outside of toolbox
- Xwayland broken in toolbox containers HOT 1
- Add distribution: Ubuntu 24.04 LTS HOT 2
- can't start ubuntu (useradd: UID is not unique) HOT 1
- systemd (255.6-1) breaks dependency
- Missing locales on Arch Linux guest HOT 3
- Can't resolve host `toolbox` inside `fedora-toolbox:40` container HOT 4
- Isolate $HOME directory via snapshot and overlay
- Can't enter fedora 40 toolbx: Failed to bind /etc/machine-id HOT 24
- run0 Allows execution on HOT 6
- Gstreamer unable to find plugins in toolbox
- Fish Shell Completions
- toolbox can't source path HOT 2
- Unable to run fzf through flatpak-spawn
- Fedora 39 Image doesn't build
- profile.d/toolbox.sh doesn't take into account TERMINFO_DIRS HOT 3
- Cannot get terminal window size inside toolbox via TIOCGWINSZ ioctl
- Hostname changing causes unexpected issues. HOT 3
- Visual bugs on my bash shell inside toolbox.
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from toolbox.