CAP_NET_RAW capability has no effect

[panpur]

Hello,

I'm getting error Bad file descriptor when creating raw socket in c++ aplication in CRC 1.37 (Centos 8).
Here's snippet of uid1000 SCC:

allowedCapabilities:
- CAP_NET_RAW
requiredDropCapabilities:
- KILL
- SETUID
- SETGID
runAsUser:
  type: MustRunAs
  uid: 1000

I've set the SCC to service acc using oc adm policy add-scc-to-user uid1000 -z runasuid1000 --as system:admin
Then in deployment config:

serviceAccount: runasuid1000
serviceAccountName: runasuid1000
containers:
  securityContext:
  - capabilities:
      add:
      - CAP_NET_RAW

Am I missing something?

[cfergeau]

Have you checked inside your application pod whether the binary has the expected caps or not? https://cloud.redhat.com/blog/linux-capabilities-in-openshift has some details explaining how to check this.

[panpur]

It does not have the permitted & effective caps:

$ for line in $(grep Cap /proc/1/status | awk '{print $2}'); do capsh --decode=$line; done;
0x00000000000035fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw
0x0000000000000000=
0x0000000000000000=
0x00000000000035fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_admin,cap_net_raw
0x0000000000000000=

getcap command also output nothing.
Which is weird since I already set it in dockerfile (and tested working fine using docker run with non root user):

RUN setcap cap_net_raw+ep /opt/myapp

[praveenkumar]

@panpur This doesn't look like issue with CRC side but more like openshift side. Have you tried same setting on a production Openshift cluster and does that worked?

[praveenkumar]

@panpur I can see you opened BZ https://bugzilla.redhat.com/show_bug.cgi?id=2041730 about same and it is against crc component which shouldn't be case if you able to reproduce same with production Openshift cluster.

[panpur]

Oh sorry actually I have not able to setup one yet.
I've tried to use the free trial of redhat dev sandbox, but it's has limited functionality, i.e no admin access to create SCC.
I'm not sure what component I had to assign to, so I just put CRC on bugzilla.

[gbraad]

I'm not sure what component I had to assign to, so I just put CRC on bugzilla.

if not sure, set nothing if that is possible

[panpur]

Seems not possible.
I tried to remove it, but then getting You must select a Component for this bug. message.

[panpur]

@praveenkumar I finally have access to production OpenShift Azure system.
The issue also reproduced there, so yes it's not CRC issue.
I'd like to update the component in BZ report. Any idea to which component I should set it into?