On Thu, Jul 05, 2018 at 02:14:20PM +0200, Jan Pazdziora wrote:
I can reproduce the problem on Fedora for example with
docker run --security-opt=seccomp=unconfined --rm -ti -e DEBUG_NO_EXIT=true -e
PASSWORD=Secret123 -h ipa.example.test freeipa/freeipa-server:fedora-27 -U -r EXAMPLE.TEST
--no-ntp
-- the seccomp=unconfined allows the first operation but due to
lack of CAP_CHOWN, the second one then fails.
I can "fix" this on Fedora with
--privileged --security-opt=seccomp=unconfined
but I don't consider it a good solution for obvious reasons.
--
Jan Pazdziora
Senior Principal Software Engineer, Security Engineering, Red Hat