Skip to content

Add SUID bit check and auto-fix for newuidmap and newgidmap in setup script#3

Open
fkerem wants to merge 1 commit into
oats-center:mainfrom
fkerem:up/setuid-newugidmap
Open

Add SUID bit check and auto-fix for newuidmap and newgidmap in setup script#3
fkerem wants to merge 1 commit into
oats-center:mainfrom
fkerem:up/setuid-newugidmap

Conversation

@fkerem

@fkerem fkerem commented Jun 23, 2025

Copy link
Copy Markdown
Member

This PR enhances the setup.sh script by checking for the required SUID bits on /usr/bin/newuidmap and /usr/bin/newgidmap. These permissions are necessary for rootless Podman containers to function properly when using user namespaces.

Rootless Podman requires the newuidmap and newgidmap binaries to have the SetUID bit enabled so that unprivileged users can map UID/GID ranges during container startup.

Without this, SPRING services relying on rootless containers may fail silently or exhibit permission-related issues.

Changelog:

  • Checks whether both binaries have the correct SUID bit using [ -u FILE ].
  • If not set:
    • Prompts the user to fix the issue with sudo chmod u+s.
    • Exits if the user declines, ensuring misconfigured environments don’t proceed.

@fkerem

fkerem commented Jun 24, 2025

Copy link
Copy Markdown
Member Author

In Digital Ocean's Fedora 41, this doesn't work. This was the solution instead:

sudo chmod u-s /usr/bin/new[gu]idmap
sudo setcap cap_setuid+eip /usr/bin/newuidmap
sudo setcap cap_setgid+eip /usr/bin/newgidmap

I'll create a PR to update the readme.

@fkerem fkerem closed this Jun 24, 2025
@fkerem

fkerem commented Jun 24, 2025

Copy link
Copy Markdown
Member Author

This can now be merged as well. An alternative solution for Fedora 41+ is documented in the Troubleshooting section of README.md as part of PR #4 .

@fkerem fkerem reopened this Jun 24, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant