Rkt: process can't listen to the network, permission denied (1.6.0)

[artem-sidorenko]

Environment

rkt Version: 1.6.0
appc Version: 0.8.1
Go Version: go1.6.1
Go OS/Arch: linux/amd64
Features: -TPM
--
Linux 4.4.0-22-generic x86_64
--
NAME="Ubuntu"
VERSION="16.04 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
UBUNTU_CODENAME=xenial
--
systemd 229
+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ -LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN

What did you do?

$ rkt version
rkt Version: 1.6.0
appc Version: 0.8.1
Go Version: go1.6.1
Go OS/Arch: linux/amd64
Features: -TPM
$ rkt run  coreos.com/dnsmasq:v0.2.0 --interactive --exec /bin/sh
....
$ /usr/sbin/dnsmasq -x /var/run/dnsmasq.pid
dnsmasq: failed to create listening socket for port 53: Permission denied
$ netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ACC ]     STREAM     LISTENING      93451 -                   /run/systemd/journal/stdout
unix  2      [ ]         DGRAM                     93453 -                   /run/systemd/journal/socket
unix  3      [ ]         DGRAM                     93416 -                   /run/systemd/notify
unix  2      [ ACC ]     STREAM     LISTENING      93418 -                   /run/systemd/private
unix  2      [ ]         DGRAM                     93432 -                   /run/systemd/journal/dev-log
unix  2      [ ]         SEQPACKET  CONNECTED      93278 -                   
unix  2      [ ]         SEQPACKET  CONNECTED      93274 -                   
unix  2      [ ]         DGRAM                     93583 -                   
$ whoami
root
$ /usr/sbin/dnsmasq -p 100 -x /var/run/dnsmasq.pid 

dnsmasq: failed to create listening socket for port 100: Permission denied
$ /usr/sbin/dnsmasq -p 1030 -x /var/run/dnsmasq.pid 

dnsmasq: failed to change group-id to nobody: Operation not permitted

What did you expect to see?

$ rkt version
rkt Version: 1.5.1
appc Version: 0.7.4
Go Version: go1.6.1
Go OS/Arch: linux/amd64
Features: -TPM
$ rkt run  coreos.com/dnsmasq:v0.2.0 --interactive --exec /bin/sh
...
$ /usr/sbin/dnsmasq -x /var/run/dnsmasq.pid
$ netstat -anp
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:53              0.0.0.0:*               LISTEN      -
tcp        0      0 :::53                   :::*                    LISTEN      -
udp        0      0 0.0.0.0:53              0.0.0.0:*                           -
udp        0      0 :::53                   :::*                                -
Active UNIX domain sockets (servers and established)
Proto RefCnt Flags       Type       State         I-Node PID/Program name    Path
unix  2      [ ]         DGRAM                     55251 -                   /run/systemd/notify
unix  2      [ ACC ]     STREAM     LISTENING      55252 -                   /run/systemd/private
unix  3      [ ]         DGRAM                     55264 -                   /run/systemd/journal/dev-log
unix  2      [ ACC ]     STREAM     LISTENING      55268 -                   /run/systemd/journal/stdout
unix  2      [ ]         DGRAM                     55269 -                   /run/systemd/journal/socket
unix  2      [ ]         DGRAM                     55478 -                   
unix  2      [ ]         DGRAM                     55187 -                   
unix  2      [ ]         DGRAM                     55183 -    

What did you see instead?

dnsmasq: failed to create listening socket for port 53: Permission denied

[iaguis]

This seems to be a bug on the dnsmasq image, it has a os/linux/capabilities-retain-set with CAP_NET_ADMIN in it. This means that only those capabilities will be given to the app, and without CAP_NET_BIND_SERVICE you can't bind a socket to privileged ports. This was not implemented in rkt before but it is since https://github.com/coreos/rkt/pull/2589.

The image should be fixed.

[jonboulle]

needs a patch @ https://github.com/coreos/coreos-baremetal/blob/e88e24912936afb3792ae11877a7cdc7c194aa6e/contrib/dnsmasq/build-aci#L36

[artem-sidorenko]

@iaguis @jonboulle thx for information and link, I assumed something like this

I tried it with unprivileged port as well (see above):

$ /usr/sbin/dnsmasq -p 1030 -x /var/run/dnsmasq.pid 

dnsmasq: failed to change group-id to nobody: Operation not permitted

Does it mean dnsmasq image is missing some other capability too?

[iaguis]

Does it mean dnsmasq image is missing some other capability too?

Yes, it misses all the capabilities except CAP_NET_ADMIN. To change the group-id you need CAP_SETGID.

[artem-sidorenko]

Ok, I'll have a look and provide a PR to dnsmasq

[dghubble]

Should be fixed in the coreos.com/dnsmasq:v0.3.0 ACI release.

$ rkt version
rkt Version: 1.6.0
appc Version: 0.8.1
Go Version: go1.6.1
Go OS/Arch: linux/amd64
Features: -TPM

$ sudo rkt run coreos.com/dnsmasq:v0.3.0
image: using image from local store for image name coreos.com/rkt/stage1-coreos:1.6.0
image: using image from local store for image name coreos.com/dnsmasq:v0.3.0
image: using image from local store for image name quay.io/coreos/alpine-sh
networking: loading networks from /etc/rkt/net.d
networking: loading network default with type ptp
[52722.997154] dnsmasq[5]: dnsmasq: started, version 2.72 cachesize 150
[52722.997442] dnsmasq[5]: dnsmasq: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN DHCP DHCPv6 no-Lua TFTP no-conntrack ipset auth no-DNSSEC loop-detect
[52722.997645] dnsmasq[5]: dnsmasq: reading /etc/resolv.conf
[52722.997822] dnsmasq[5]: dnsmasq: using nameserver 8.8.8.8#53
[52722.999393] dnsmasq[5]: dnsmasq: read /etc/hosts - 1 addresses