"Failed to connect"

AND WHYYYYYYYYYYYYYYYYYYYYYYYYYYYYY?!

"[Errno 13] Permission denied: '/dev/ttyUSB0'"

Okay, but, WHYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYY?!

@zhenech check the group. serial devices are often in an extra group not given to all users by default

@zhenech
AppArmor, SELinux, group not imported into container

@towo no, no, no.
podman with --group-add keep-groups
if I exec into the container, I can read and write to the device

@zhenech
Seccomp?

@zhenech
setenforce 0
chmod 777 /dev/*
touch /etc/y_u_mad

@jmtd @towo It worked before I switched the setup from CentOS to Debian…

chmod 777 on the device makes it work. WHY?!

@itnomad

@zhenech
@jmtd Rootless?

@towo @jmtd what else?

@zhenech
podman info --debug | yq .host.ociRuntime.name? runc doesn't do group keep
@jmtd

@towo @jmtd crun it is

@zhenech
@jmtd I'm feeling stumped.

@towo @jmtd same.

@towo @jmtd and the winner is: fucking inheritance.

The containers are started by systemd.
The user got the dialout group only recently.
The systemd process didn't have that group yet, so the container launched by it did neither.
My "podman exec" was launched by my shell, which DID have the new group.

tableflip.gif