plugin: fix mounting /etc/hosts when running in UserNS

[AkihiroSuda]

- What I did
Fix error mounting "/etc/hosts" to rootfs at "/etc/hosts": mount /etc/hosts:/etc/hosts (via /proc/self/fd/6), flags: 0x5021: operation not permitted.

This error was introduced in 7d08d84 (dockerd-rootless.sh: set rootlesskit --state-dir=DIR) that changed the filesystem of the state dir from /tmp to /run (in a typical setup).

Fixes #47248

- How I did it

Applied mountsopts.FixUpOCI

- How to verify it

docker plugin install ghcr.io/ibm/docker-logdna:1.0.1

- Description for the changelog

plugin: fix mounting /etc/hosts when running in UserNS

- A picture of a cute animal (not mandatory but encouraged)

🐧

[thaJeztah]

Curious; what's different about the new location that's used; is it a permissions issue, and in that case, should we just fail to start, asking the user to fix the permissions for the $XDG_RUNTIME_DIR/dockerd-rootless directory?

[AkihiroSuda]

Curious; what's different about the new location that's used; is it a permissions issue, and in that case, should we just fail to start, asking the user to fix the permissions for the $XDG_RUNTIME_DIR/dockerd-rootless directory?

No, this is not a permission issue

moby/daemon/oci_linux.go

Lines 448 to 499 in ff05850

	// Get the set of mount flags that are set on the mount that contains the given
	// path and are locked by CL_UNPRIVILEGED. This is necessary to ensure that
	// bind-mounting "with options" will not fail with user namespaces, due to
	// kernel restrictions that require user namespace mounts to preserve
	// CL_UNPRIVILEGED locked flags.
	func getUnprivilegedMountFlags(path string) ([]string, error) {
	var statfs unix.Statfs_t
	if err := unix.Statfs(path, &statfs); err != nil {
	return nil, err
	}
	// The set of keys come from https://github.com/torvalds/linux/blob/v4.13/fs/namespace.c#L1034-L1048.
	unprivilegedFlags := map[uint64]string{
	unix.MS_RDONLY: "ro",
	unix.MS_NODEV: "nodev",
	unix.MS_NOEXEC: "noexec",
	unix.MS_NOSUID: "nosuid",
	unix.MS_NOATIME: "noatime",
	unix.MS_RELATIME: "relatime",
	unix.MS_NODIRATIME: "nodiratime",
	}
	var flags []string
	for mask, flag := range unprivilegedFlags {
	if uint64(statfs.Flags)&mask == mask {
	flags = append(flags, flag)
	}
	}
	return flags, nil
	}
	var (
	mountPropagationMap = map[string]int{
	"private": mount.PRIVATE,
	"rprivate": mount.RPRIVATE,
	"shared": mount.SHARED,
	"rshared": mount.RSHARED,
	"slave": mount.SLAVE,
	"rslave": mount.RSLAVE,
	}
	mountPropagationReverseMap = map[int]string{
	mount.PRIVATE: "private",
	mount.RPRIVATE: "rprivate",
	mount.SHARED: "shared",
	mount.RSHARED: "rshared",
	mount.SLAVE: "slave",
	mount.RSLAVE: "rslave",
	}
	)

[thaJeztah]

LGTM

@neersighted PTAL