[workspacekit] Don't bogously filter proc mount targets

[csweichel]

fixes #5124

This PR makes workspacekit handle the style of proc mounts we're seeing from runc recently.
There are several challenges involved:

1. the mount target is /proc/self/... which only makes sense in the context of the calling process. In such cases we replace the mount target with /proc/<targetPID> as seen from ring1. Such a path does not exist in the mount namespace of ring2, where nsinsider will move the mount to, hence
2. we now support symlinks as mount targets. We resolve the symlink in the seccomp-notify handler and expect them to resolve to a valid path in the ring2 mount namespace.

By virtue of those two changes, a mount to something like /proc/self/fd/7 works, because we first rewrite the path to /proc/<pid>/fd/7 and resolve the symlink.

This PR also harmonises the handling of proc and sysfs mounts.

How to test

try a recent runc

sudo curl -o $(which runc) -L https://github.com/opencontainers/runc/releases/download/v1.0.1/runc.amd64
docker run --rm -it alpine:latest

[codecov]

Codecov Report

Merging #5139 (7157dcc) into main (e68e76d) will increase coverage by 7.65%.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           main   #5139      +/-   ##
=======================================
+ Coverage      0   7.65%   +7.65%     
=======================================
  Files         0       3       +3     
  Lines         0     588     +588     
=======================================
+ Hits          0      45      +45     
- Misses        0     540     +540     
- Partials      0       3       +3     

Flag	Coverage Δ
components-workspacekit-app	7.65% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
components/workspacekit/cmd/lift.go	18.18% <0.00%> (ø)
components/workspacekit/cmd/rings.go	7.54% <0.00%> (ø)
components/workspacekit/cmd/root.go	0.00% <0.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e68e76d...7157dcc. Read the comment docs.

[aledbf]

/approve

[aledbf]

LGTM

[leodido]

Just some nitpicking.

Otherwise it LGTM

[leodido]

/lgtm

[roboquat]

LGTM label has been added.

Git tree hash: b066d37d5d56913eacafa60f15c14eb48abf4841

[roboquat]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aledbf, leodido

Associated issue: #5124

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• components/workspacekit/OWNERS [aledbf]
• components/ws-daemon/OWNERS [aledbf]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment