After changing podman graphroot, permissions denied

[arrannn]

I have changed the location that rootless podman saves containers to, but I am having issues when trying to pull an image.

Error: could not get runtime: error opening "/mnt/podman/storage/storage.lock": permission denied

I am sure that this should be an easy fix however changing the permissions of new storage folder don't seem to have any effect. I am running this as a user, and not as root.

If I change the permissions of storage.lock I run into the same error but with any directories that are created when pulling the image

ERRO[0000] error migrating containers: chown /mnt/podman/storage/overlay/l: operation not permitted

Any suggestions please?

[mheon]

Potentially SELinux? Does setenforce 0 cause it to work?

[arrannn]

Thanks for the reply. Unfortunately not. For context here is how I changed the storage after changing the graphroot config

sudo mkdir -p /mnt/podman/storage
sudo chown Usernamehere /mnt/podman/storage /mnt/podman
sudo semanage fcontext -a -e $HOME/.local/share/containers /mnt/podman/storage
sudo restorecon -R -v /mnt/podman/storage
sudo chmod -R ugo+rw /mnt/podman

I know that it is possible as I am trying to replicate the functionality of another machine which has the same versions of the OS and podman and works as intended, but there must be some missing configuration that I can't seem to identify

[rhatdan]

As a normal user could you do
$ touch /mnt/podman/storage/storage.lock

And it works?

[arrannn]

Yes that seems to work, so it appears that the user does have permissions

[usernamehere@host scripts]$ touch /mnt/podman/storage/storage.lock
[usernamehere@host scripts]$ podman info --log-level=debug
INFO[0000] running as rootless
DEBU[0000] Initializing boltdb state at /home/usernamehere/.local/share/containers/storage/libpod/bolt_state.db
DEBU[0000] Using graph driver overlay
DEBU[0000] Using graph root /mnt/podman/storage
DEBU[0000] Using run root /run/user/1000
DEBU[0000] Using static dir /home/usernamehere/.local/share/containers/storage/libpod
DEBU[0000] Using tmp dir /run/user/1000/libpod/tmp
DEBU[0000] Using volume path /home/usernamehere/.local/share/containers/storage/volumes
DEBU[0000] Set libpod namespace to ""
ERRO[0000] could not get runtime: error opening "/mnt/podman/storage/storage.lock": permission denied

[rhatdan]

Yup and if the user does not have permissions then Podman does not either.

[arrannn]

in this case though where the user does have permissions and podman doesn't, is there an easy workaround?

[rhatdan]

If the user has permissions, then Podman should as well. From a DAC Point of view.

[arrannn]

is there way to ensure that podman is in fact running as the correct user? Perhaps if it is somehow running as a different user I could add permissions for that

[rhatdan]

How are you starting podman? If you login and execute podman then it is running as the current user.

[arrannn]

just as a sanity check I disconnected and logged in

Last login: Thu Jun  9 13:01:34 2022 from **.**.**.**
[username@host ~]$ podman info
Error: could not get runtime: error opening "/mnt/podman/storage/storage.lock": permission denied

[rhatdan]

Try

$ sudo chown $(id -u):$(id -g) -R /mnt/podman

[arrannn]

$ sudo chown $(id -u):$(id -G) -R /mnt/podman
chown: cannot access '4': No such file or directory
chown: cannot access '190': No such file or directory

[rhatdan]

oops

$ sudo chown $(id -u):$(id -g) -R /mnt/podman

[arrannn]

That worked! Thankyou! would you mind giving me a little bit of context of what actually happens there?

[rhatdan]

It looks like you created the /mnt/podman directory as root and never chowned to match the non root user.