Port mapping not working #3318
Comments
|
Hi @tuefue - thanks for the report. I believe that this issue is due to a lack of full support for nf_tables (which has replaced iptables), when using the CNI ipmasq / portmap plugins. Newer Linux distributions, which have moved to nf_tables, will hit issues with certain CNI configurations. Luckily, there is a potential solution on the horizon. The upstream CNI plugins project has recently merged a change that adds support for nftables on ipmasq / portmap plugins: containernetworking/plugins#935 This project is what we import into SingularityCE to gain CNI networking functionality. There is no release yet with the fix in it, but as soon as there is then we can update the dependency and support for portmap with nf_tables should then be working. We'll monitor the status of the CNI plugins project until that happens. |
|
It's released https://github.com/containernetworking/plugins/releases/tag/v1.6.0.
|
|
Dependabot has opened some pull requests to bring in the dependency update onto our branches. Unforunately, the update CNI plugins dependency requires Go 1.23. Our current documented policy is to support the current (1.23) and previous (1.22) Go version for stable releases. We'll have to have a think about the policy (the issue has also come up with other dependencies recently). Chiefly the issue is with building packages for EPEL etc. where the Go version may lag behind upstream. There will be a delay in getting a release out with this due to the issue above. |
|
Hi. Is there any update on this issue? I have same problem using fakeroot. Also I wonder if it's problem on newer iptables library. After a few googlings, I found that iptables v1.8.8 has changelog as below: And for manpage of iptables v1.8.9, such message is inserted: So I doubt that it's because of newer iptables library... |
|
Ahh okay - the Singularity does clear the environment before calling the CNI plugin, which will in turn call This will require a bit of thought. Likely we can set the real & effective uid to be the same, avoiding the error.... but this needs consideration of what else is using the escalation code shared by CNI plugin execution. |
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Fixes sylabs#3318
Pick sylabs#3444 Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Newer versions of the `iptables` command use a real vs effective uid check whether they are being called from a setuid script, and exit if that's the case. This check was added because iptables can call out to binaries / libraries on `PATH` / `LD_LIBRARY_PATH`, and these are generally under control of the user - allowing privilege escalation attackes. Singularity sanitizes the environment before running CNI plugins, which will call `iptables`, so we can set both real and effective uid to 0 to avoid the error. While we are here, make `PATH` sanitization the default in the network code, rather than relying on the caller applying it. Add some tests around the priv escalation / drop code. Fixes sylabs#3318
Before you report an issue...
Version of Singularity
singularity-ce version 4.2.1-noble
Describe the bug
Port mapping causes errors.
To Reproduce
Run command:
OS / Linux Distribution
up-to-date
Installation Method
DEB from GitHub (https://github.com/sylabs/singularity/releases/download/v4.2.1/singularity-ce_4.2.1-noble_amd64.deb)
Additional context
iptables command output:
ip6tables command output:
The text was updated successfully, but these errors were encountered: