非特权容器中Python修改文件atime权限问题及Linux Capability求助

问题背景 #

容器以非特权模式运行（UID/GID均为1000），能写入文件但无法通过Python代码修改文件atime，添加SYS_ADMIN Capability仍无法解决，仅特权模式下操作正常。

相关命令输出 #

bash-5.1$ id 
uid=1000(contest) gid=1000(contest) groups=1000(contest)
bash-5.1$ ls -l
total 250
-rwxrwxrwx    1 root     contest          0 Oct 27 07:16 anotherfile
-rwxrwxrwx    1 root     contest     254823 Oct 27 07:37 outfile
-rwxrwxrwx    1 root     contest          0 Oct 24 03:52 test
-rwxrwxrwx    1 root     contest        364 Oct 27 07:16 test.py
-rwxrwxrwx    1 root     contest         18 Oct 24 05:25 testfile
bash-5.1$ python3 test.py
1666854988.190472
1666851388.190472
Traceback (most recent call last):
  File "/mnt/azurefile/test.py", line 19, in <module>
    os.utime(myfile, (atime - 3600.0, mtime))
PermissionError: [Errno 1] Operation not permitted
bash-5.1$ capsh --print
Current: =
Bounding set =cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_admin,cap_mknod,cap_audit_write,cap_setfcap
Ambient set =
Current IAB: !cap_dac_read_search,!cap_linux_immutable,!cap_net_broadcast,!cap_net_admin,!cap_ipc_lock,!cap_ipc_owner,!cap_sys_module,!cap_sys_rawio,!cap_sys_ptrace,!cap_sys_pacct,!cap_sys_boot,!cap_sys_nice,!cap_sys_resource,!cap_sys_time,!cap_sys_tty_config,!cap_lease,!cap_audit_control,!cap_mac_override,!cap_mac_admin,!cap_syslog,!cap_wake_alarm,!cap_block_suspend,!cap_audit_read
Securebits: 00/0x0/1'b0 (no-new-privs=0)
 secure-noroot: no (unlocked)
 secure-no-suid-fixup: no (unlocked)
 secure-keep-caps: no (unlocked)
 secure-no-ambient-raise: no (unlocked)
uid=1000(contest) euid=1000(contest)
gid=1000(contest)
groups=1000(contest)
Guessed mode: HYBRID (4)

修改atime的Python代码 #

from datetime import datetime
import os
import time

myfile = "anotherfile"
current_time = time.time()

"""
Set the access time of a given filename to the given atime.
atime must be a datetime object.
"""
stat = os.stat(myfile)
mtime = stat.st_mtime
atime = stat.st_atime

print(mtime)
mtime = mtime - 3600.0
print(mtime)
os.utime(myfile, (atime - 3600.0, mtime))

原Pod YAML配置 #

---
kind: Pod
apiVersion: v1
metadata:
  name: nginx-azurefile
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    fsGroup: 1000
  nodeSelector:
    "kubernetes.io/os": linux
  containers:
    - image: acheng.azurecr.io/capsh
      name: nginx-azurefile
      securityContext:
        capabilities:
          add: ["CHOWN","SYS_ADMIN","SYS_RESOURCES"]
      command:
        - "/bin/bash"
        - "-c"
        - set -euo pipefail; while true; do echo $(date) >> /mnt/azurefile/outfile; sleep 10; done
      volumeMounts:
        - name: persistent-storage
          mountPath: "/mnt/azurefile"
  imagePullSecrets:             
    - name: acr-secret  
  volumes:
    - name: persistent-storage
      persistentVolumeClaim:
        claimName: pvc-azurefile

解决方案 #

1. 核心问题：缺失CAP_FOWNER权限 #

从capsh --print输出可见，进程的有效Capability集合为空（Current: =），虽然Bounding集包含cap_fowner，但未在容器配置中显式添加，导致无法使用该权限。当用户不是文件所有者时，修改文件atime/mtime需要CAP_FOWNER绕过权限检查。

2. 修正Pod配置 #

修改容器的securityContext，添加FOWNER Capability，同时可移除不必要的SYS_ADMIN和SYS_RESOURCES：

securityContext:
  capabilities:
    add: ["CHOWN", "FOWNER"]

3. 验证修复 #

应用配置后，进入容器执行capsh --print，确认Current行包含cap_fowner，再运行Python脚本即可正常修改文件atime。

注：Azure Files远程存储的权限限制已在特权模式下验证可突破，因此核心问题为容器Capability缺失，无需额外存储配置调整。

内容的提问来源于stack exchange，提问作者Alan Cheng