podman cp dereferences symlink in host context after filepath.Glob(srcPath)

[eriksjolund]

Is this a BUG REPORT or FEATURE REQUEST? (leave only one on its own line)

/kind bug

Description

podman cp mycontainer:/testfile /tmp/test

may resolve a symlink in the host context (e.g. the file /tmp/hostdir/hello.txt) and copy it into
the directory /tmp/test

Steps to reproduce the issue:

erik@laptop:/tmp$ mkdir /tmp/hostdir
erik@laptop:/tmp$ echo hello > /tmp/hostdir/hello.txt
erik@laptop:/tmp$ cat /tmp/build.sh 
container=$(buildah from scratch)                                                                                                    
mnt=$(buildah mount $container)

touch "$mnt/file*"
ln -s "/file*" "$mnt/testfile"
ln -s "/tmp/hostdir/hello.txt" "$mnt/file_symlink_to_hostfile"

buildah umount $container
buildah commit $container glob1

erik@laptop:/tmp$ buildah unshare bash /tmp/build.sh && container=$(podman create localhost/glob1 dummycmd) 
442548187b2cb9fb3ee953a1987b643d50e7c42549b731aacc8a5ac9ebef083e
Getting image source signatures
Copying blob d3c1b073cbdd done
Copying config 6492f94e90 done
Writing manifest to image destination
Storing signatures
6492f94e909731586eecbd470ad2a9c378dc87fc2eb7e3d89712dfd4011170b4
erik@laptop:/tmp$ rm -rf /tmp/test && mkdir /tmp/test && podman cp $container:/testfile /tmp/test

Describe the results you received:

erik@laptop:/tmp$ ls -l /tmp/test
total 4
-rw-rw-r-- 1 erik erik 0 Aug 15 20:43 'file*'
-rw-rw-r-- 1 erik erik 6 Aug 15 20:34  hello.txt
erik@laptop:/tmp$ 

Describe the results you expected:

I would not have expected to see the files /tmp/test/hello.txt and /tmp/test/file*

Additional information you deem important (e.g. issue happens only occasionally):

Output of podman version:

erik@laptop:/tmp$ podman --version
podman version 1.5.0
WARN[0000] unable to find /home/erik/.config/containers/registries.conf. some podman (image shortnames) commands may be limited 
erik@laptop:/tmp$

Output of podman info --debug:

erik@laptop:/tmp$ podman info --debug
debug:
  compiler: gc
  git commit: ""
  go version: go1.10.4
  podman version: 1.5.0
host:
  BuildahVersion: 1.10.1
  Conmon:
    package: 'conmon: /usr/bin/conmon'
    path: /usr/bin/conmon
    version: 'conmon version 2.0.0, commit: unknown'
  Distribution:
    distribution: ubuntu
    version: "18.04"
  MemFree: 199711514624
  MemTotal: 201407889408
  OCIRuntime:
    package: Unknown
    path: /home/erik/crun/crun/static-build/crun
    version: |-
      crun 0.7
      spec: 1.0.0
      +SELINUX +CAP +SECCOMP +EBPF +YAJL
  SwapFree: 107374178304
  SwapTotal: 107374178304
  arch: amd64
  cpus: 32
  eventlogger: journald
  hostname: laptop
  kernel: 5.0.0-23-generic
  os: linux
  rootless: true
  uptime: 36h 26m 18.07s (Approximately 1.50 days)
registries:
  blocked: null
  insecure: null
  search: null
store:
  ConfigFile: /home/erik/.config/containers/storage.conf
  ContainerStore:
    number: 195
  GraphDriverName: overlay
  GraphOptions:
  - overlay.mount_program=/usr/bin/fuse-overlayfs
  GraphRoot: /home/erik/.local/share/containers/storage
  GraphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  ImageStore:
    number: 102
  RunRoot: /run/user/1000
  VolumePath: /home/erik/.local/share/containers/storage/volumes

erik@laptop:/tmp$ 

Additional environment details (AWS, VirtualBox, physical, etc.):

erik@laptop:/tmp$ buildah --version
buildah version 1.10.1 (image-spec 1.0.1, runtime-spec 1.0.1-dev)
erik@laptop:/tmp$ cat /etc/issue
Ubuntu 18.04.3 LTS \n \l

[mheon]

/etc/host is always a bind-mount to a container-local copy of the host's /etc/host. I would expect that if you passed --dns to that podman create you'd find the contents were suddenly different.

Still, podman cp is definitely doing the wrong thing here, I think - albeit it's doing it entirely in container context.

[mheon]

Sorry, replace --dns with --add-host - oops

[eriksjolund]

Sorry, I used some other file path and did a replace string in my editor to get /etc/hosts . That was not a good idea I realize now. I thought the actual file path was irrelevant.
Anyway I have now edited the original bug description and changed
the file path to /tmp/hostdir/hello.txt and re-run the example again on the computer.

[eriksjolund]

And I verified that the file /tmp/hostdir/hello.txt was not included in the container,
by running podman unshare and podman mount $container

erik@laptop:/tmp# ls -l $mnt 
total 0
-rw-rw-r-- 1 root root  0 Aug 15 20:59 'file*'
lrwxrwxrwx 1 root root 22 Aug 15 20:59  file_symlink_to_hostfile -> /tmp/hostdir/hello.txt
lrwxrwxrwx 1 root root  6 Aug 15 20:59  testfile -> '/file*'
erik@laptop:/tmp# 

[eriksjolund]

Another thing (not strictly this bug but closely related) is the handling of "-". The check to see if such a command line argument is given should be done on the actual command line arguments given (not on the result of symlink dereferencing or filepath.Base(destPath)).