Usage of sudo when using "--arch" parameter

[asbachb]

Hi. I'm trying to run sudo on an arm64 image on an x86_64 host which fails with an error: "sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?"

How to reproduce

❯ podman run --arch arm64 -it --rm ubuntu:22.04 bash
[...]

root@ee2598daa39e:/# apt update
[...]

root@ee2598daa39e:/# apt install sudo
[...]

root@ee2598daa39e:/# su nobody -s /bin/bash -c "sudo whoami"
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
root@ee2598daa39e:/# 

Any idea how this could be fixed?

[rhatdan]

Could you run this again with --cap-add all to see if this is a missing Capabilities causing this issue?

[asbachb]

Like that?

❯ podman run --cap-add all --arch arm64 -it --rm ubuntu:22.04 bash
root@80a881051fc1:/# apt update
[...]

root@80a881051fc1:/# apt install sudo
[...]

root@80a881051fc1:/# su nobody -s /bin/bash -c "sudo whoami"                         
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?

[rhatdan]

Ok so the file system that is in your homedir is mounted with nosuid?

[asbachb]

I most likely test in tmpfs. The system is mounted with btrfs.

But it does not seem to be connected to be mounted filesystem as when ich remove --arch arm64 parameter everything works as expected.

[rhatdan]

Could you look to see what mount says, because sudo seems to think the file system is mounted nosudo.

[nalind]

This is a known limitation: setuid/setgid bits don't work when the binary that has those bits set on it has to be run by a qemu-user-static emulator. In order to get the elevated privileges that those bits ask for, the emulators would need to be registered with the kernel using the "C" flag as described in the kernel docs. I imagine the distribution packaging for qemu-user-static doesn't do this, as part of an attempt to avoid making the emulators targets for potential security shenanigans.