permission issue with host devices and ssh

[Viatorus]

Hello,

I try to access a host device inside a container while being connected through ssh.

I use --userns keep-id --group-add keep-groups --device /dev/ttyS0 when running the container.

Inside the container, I can call cat /ttyS0 without a problem. id shows:

uid=1000(newuser) gid=1000(newuser) groups=1000(newuser),65534(nogroup)

If I connect me through ssh, I get Permission denied wtih cat /ttyS0. id shows:

uid=1000(newuser) gid=1000(newuser) groups=1000(newuser)

How do I get the correct group rights when using ssh?

My minimal example:
https://gist.github.com/Viatorus/278266a421443e46bfa53f045a6bd474

[rhatdan]

Are you ssh into the container? Only the primary process (pid 1) of the container is guaranteed access to the leaked group sockets.

[Viatorus]

Are you ssh into the container?
Yes, I ssh into the container.

Only the primary process (pid 1) of the container is guaranteed access to the leaked group sockets.
Ah, I thought about something like this... :/

But what can I do to make it also work inside a SSH session?

[Viatorus]

Are the uid/gid also different? :(

[rhatdan]

You could take the hosts GID and map it to itself within the container.

If this is a systemd based container running sshd then that would be the only way.

If you are running sshd as PID 1 inside of the container, then you might be able to get sshd to leak the file descriptor to the session, although I doubt you can.

Why are you ssh into the container versus using podman exec?

[Viatorus]

You could take the hosts GID and map it to itself within the container.

Can you explain this in more detail, please?

Why are you ssh into the container versus using podman exec?

The IDE we are using (CLion/Intellij) works - as I am aware of - only reliable good if the container with the developer environment is connected through ssh. The dev environment but also contains tools like "flash a device over /dev/tty..." which can be directly executed from the IDE.

[rhatdan]

Say the GID required for access is GID 10. Then all users of the tool would need to have

USER 10:10:1

In the /etc/subgid.