permission denied in unpriv.create when creating rootless image

[lukasheinrich]

Hi,

we're trying to test the skopeo / umoci / runc toolchain for usage within high energy physics usecases (ATLAS experiment). We publish images on Docker Hub that we'd like to run in rootless mode

hub.docker.com/r/atlas/

but unpacking them with umoci hrows this error (unpacking e.g. busybox works fine)

create runtime bundle: unpack layer: unpack entry: etc/gshadow: create regular: unpriv.create: open unpacked_atlas/rootfs/etc/gshadow: permission denied

steps to reproduce

skopeo copy docker://atlas/analysisbase oci:atlas_analysisbase:latest
umoci unpack --rootless --image $PWD/atlas_analysisbase:latest unpacked_atlas

any pointers what could be amiss?

(cc'ing @davidlt)

[cyphar]

First off, cool. 😸

I think this is happening because the mode of /etc/gshadow in the image is 000 (though I could've sworn this is a case we already handled), and umoci is trying to truncate the file in order to overwrite it. The fix is either to remove "regular" files when unpacking over them rather than truncating, or to make unpriv.Wrap also chmod the final path. I'll take a look and add a test for this.

[cyphar]

I just realised that these two possible options have different semantics in the case of hard-linked files (which the spec doesn't help clarify). If you have a hard-linked file, and then you have a new layer that modifies the file, should the other hard-links see the modifications?

In theory, the new layer should have tar.TypeLink files as well, so I guess we should remove the old file? But then this makes implementing unpacking more difficult...

[cyphar]

I've gone with the removal option in #223. PTAL and double-check it fixes the issue (that patch fixed the issue on my machine).

[lukasheinrich]

Thanks @cyphar for the very quick turn-around. I'll try to check this later today.

L

[lukasheinrich]

@cyphar any ETA on the 0.4.0 release? Thanks.

[cyphar]

https://github.com/openSUSE/umoci/milestone/9 tracks the remaining issues I would like to fix before 0.4.0. Only one of them requires significant work (#224) and I'm working on it at the moment. The plan would be to release it end of next week.