Device permissions are changed when using a userns (rootful container)

[jorti]

Hi,

I'm running a container as root using userns=auto and the device /dev/dri mapped. My problem is that I've noticed that I can only use the device /dev/dri/renderD128 as the user root inside the container.

In the host, the device /dev/dri/renderD128 has 0666 permissions:

# ls -l /dev/dri
total 0
drwxr-xr-x. 2 root root         80 ene 15 07:38 by-path
crw-rw----+ 1 root video  226,   1 ene 15 07:38 card1
crw-rw-rw-. 1 root render 226, 128 ene 15 07:38 renderD128

However in a rootful container using a userns the permissions are changed to 0444, so a non-root user inside the container cannot use the device (it needs read-write):

# podman run -ti --rm --userns auto --device /dev/dri:/dev/dri:rwm  fedora ls -l /dev/dri
total 0
crw-r-----. 1 root video 226,   1 Jan 15 09:32 card1
crw-r--r--. 1 root   105 226, 128 Jan 15 09:32 renderD128

If not using a userns, the permissions are preserved:

# podman run -ti --rm  --device /dev/dri:/dev/dri:rwm  fedora ls -l /dev/dri
total 0
crw-rw----. 1 root video 226,   1 Jan 15 09:36 card1
crw-rw-rw-. 1 root   105 226, 128 Jan 15 09:36 renderD128

I'm using Fedora 39 with these package versions:

podman-4.8.3-1.fc39.x86_64
crun-1.12-1.fc39.x86_64

Is this expected? How can I correct the permissions of the device?

[eriksjolund]

An issue was created about this.

• Device permissions are changed when using a userns (rootful container) crun#1389