Don't allow backsteps in local volume plugin

[msau42]

Kubernetes version (use kubectl version): 1.7

Similar to #47107, we need to check for backsteps in the path ("/foo/bar/../../../baz") for the local volume. It should be checked in the API validation, and also at mount time.

[k8s-github-robot]

@msau42 There are no sig labels on this issue. Please add a sig label by:
(1) mentioning a sig: @kubernetes/sig-<team-name>-misc
(2) specifying the label manually: /sig <label>

Note: method (1) will trigger a notification to the team. You can find the team list here and label list here

[msau42]

/sig storage

[msau42]

@ddysher, would you be able to look at this?

[msau42]

To clarify, I don't think this is critical to fix in 1.7 (for local volumes). Only the adminstrator can create local PVs, so the paths they export are under their control.

[ddysher]

sure, i'll take a look after external provisioner work.

[liggitt]

if you want to change API validation, you should do it before 1.7 releases, since the field is new. Changing validation on a released field is much harder

[dchen1107]

Approved this for 1.7 release based on the conversation with @liggitt and the engineers from @kubernetes/sig-storage-misc