DHCP Discovery - Operation not permitted

[bserrao]

The problem

I'm seeing this error (Cannot watch for dhcp packets: [Errno 1] Operation not permitted) in home assistant log. As a result some integrations that rely on this don't work properly.
I'm running a Home Assistant container on Fedora Coreos and i've already disabled SELinux.
Any clue why is this happening?

What version of Home Assistant Core has the issue?

core-2021.12.2

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant Container

Integration causing the issue

DHCP Discovery

Link to integration documentation on our website

https://www.home-assistant.io/integrations/dhcp

Example YAML snippet

No response

Anything in the logs that might be useful for us?

Logger: homeassistant.components.dhcp
Source: components/dhcp/__init__.py:372
Integration: DHCP Discovery (documentation, issues)
First occurred: 11:47:30 AM (1 occurrences)
Last logged: 11:47:30 AM

Cannot watch for dhcp packets: [Errno 1] Operation not permitted

Additional information

No response

[probot-home-assistant]

dhcp documentation
dhcp source
_{^{(message by IssueLinks)}}

[probot-home-assistant]

Hey there @bdraco, mind taking a look at this issue as it has been labeled with an integration (dhcp) you are listed as a code owner for? Thanks!
_{^{(message by CodeOwnersMention)}}

[frenck]

Could you provide information on how you run this container, so we can reroduce it?

[bserrao]

Sure, also i've found the issue... it's not directly related to HA
I'm running the container with podman... i've looked at the code, scapy documentation and did some experiments... So i think the problem is scapy that runs inside container needs root access or at least access to CAP_NET_RAW, and podman isn't providing that, even if i run it with privilleged flag.

Because i don't think this is a "supported" setup, i guess we can close this issue.
I'll continue to look into it, and if i find a solution i'll put it here so it could help others...
Also found this (RedHat - Running Home Assistant with Podman) i wonder if they don't have the same issue...

[bserrao]

I've managed to solve this.
Running podman container with --cap-add=CAP_NET_RAW,CAP_NET_BIND_SERVICE and removing --network=host solved this issue.

Thanks a lot for your work and sorry for taking your time.

[JHBoricua]

I've managed to solve this. Running podman container with --cap-add=CAP_NET_RAW,CAP_NET_BIND_SERVICE and removing --network=host solved this issue.

Thanks a lot for your work and sorry for taking your time.

Hi @bserrao Can you share the config you used to deploy the container in Podman after figuring out the above? I assume since you removed host networking you now have a port mapping for at least 8123?

[bserrao]

Hey there @JHBoricua, sure...

podman run -d --name homeassistant --cap-add=CAP_NET_RAW,CAP_NET_BIND_SERVICE --restart=unless-stopped -p 8123:8123 -v /etc/localtime:/etc/localtime:ro -v ~/hass/config:/config:Z -v ~/hass/media:/media:Z --pull=always homeassistant/home-assistant:stable

[jeffgoh]

This seems to have been true even for earlier home-assistant containers, and probably crept in as a change by Redhat to improve podman security vis-a-viz docker in terms of limiting container capabilities.

To make this work for myself, podman needs CAP_NET_RAW (basically DHCP Discovery/Inspection is running a sniffer on the network, hence the RAW). This seems to be true even for rooted containers (had thought it only applied to rootless). Either -p or host doesn't change whether discovery works. CAP_NET_BIND_SERVICE only affects if listening below port 1000, I believe, so the minimum change is to add this stanza:

--cap-add=CAP_NET_RAW

[JHBoricua]

Sadly even after adding CAP_NET_RAW and CAP_NET_BIND_SERVICE it still throws the error message Cannot watch for dhcp packets: [Errno 1] Operation not permitted on my podman deployment. Will keep digging more on this.

[stooke]

@JHBoricua when I experienced this, it was because I hadn't deleted the old container.