libctr/init_linux: reorder chdir

[haircommander]

commit 5e0e67d moved the chdir to be one of the
first steps of finalizing the namespace of the container.

However, this causes issues when the cwd is not accessible by the user running runc, but rather
as the container user.

Thus, setupUser has to happen before we call chdir. setupUser still happens before setting the caps,
so the user should be privileged enough to mitigate the issues fixed in 5e0e67d (I've tested it on my machine, so I believe it does not regress)

Signed-off-by: Peter Hunt pehunt@redhat.com

[thaJeztah]

I see there was some discussion around the original change in #2086 (comment) as well

@cyphar @justincormack @crosbymichael ptal

[haircommander]

Warning: apt-key output should not be parsed (stdout is not a terminal)

https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/Release.key:

2020-11-19 18:37:41 ERROR 404: Not Found.

gpg: no valid OpenPGP data found.

The command '/bin/sh -c echo 'deb http://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/Debian_Unstable/ /' > /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list     && wget -nv https://download.opensuse.org/repositories/devel:kubic:libcontainers:stable/Debian_Unstable/Release.key -O- | sudo apt-key add -     && apt-get update     && apt-get install -y --no-install-recommends skopeo     && rm -rf /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list     && apt-get clean     && rm -rf /var/cache/apt /var/lib/apt/lists/*;' returned a non-zero code: 2

this doesn't seem related. can someon retrigger the tests?

also, PTAL @kolyshkin @mrunalp @AkihiroSuda

[thaJeztah]

been running into that as well; /cc @cyphar

[kolyshkin]

Proposed CI fix is in #2686. Once merged, you'll need to rebase to fix CI.

[haircommander]

rebased, thanks @kolyshkin

[kolyshkin]

@haircommander this seems like a regression. Can we have a test case?

[haircommander]

I am having trouble writing a test (I personally have not created a situation where this bug comes up, only had it come up in someone else's node in a pretty specific scenario). I'll keep trying, but ideally we could go forward with this without it for now

[haircommander]

ok the test is written--it's not pretty but it exists. PTAL @kolyshkin

[kolyshkin]

CI is failing on rootless tests

....
ok 21 runc create --pid-file with new CWD
[sudo] password for rootless: 
No output has been received in the last 10m0s, this potentially indicates a stalled build or something wrong with the build itself.

Maybe sudo needs -n?

[haircommander]

@kolyshkin @mrunalp @AkihiroSuda @cyphar @justincormack @crosbymichael PTAL

[kolyshkin]

CI went south :(

GitHub Actions has encountered an internal error when running your job.

[kolyshkin]

I don't quite get it. Can this test be run as root, and then drop the privs to a non-root user when it needs to?

Asking because the way it is right now, our CI never runs it.

[haircommander]

unfortunately, I wasn't able to figure out how to run the test as a non privileged user

[kolyshkin]

Also related: containerd/containerd#4669

[kolyshkin]

Carrying this over in #2712