Stop glob'ing on podman cp

[jwhonce]

• Do not support wildcards
• Restore pause=true to avoid race conditions. User can still do --pause=false to avoid container pause.

Signed-off-by: Jhon Honce [email protected]

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jwhonce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [jwhonce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mtrmac]

Removing the globs is fine, but I can’t see how the rest of the PR is secure; it removes a large part of the existing protections without any replacement that I can see.

If it is doing something non-obvious, please write an explicit argument (that someone unfamiliar with the code can follow, like a future maintainer) for why it is secure (what are the security objectives, how are those goals upheld; maybe what are the attacks and how they are prevented) — ideally as comments directly in the code to decrease the risk that future maintainers will undo/break that without noticing.

[rhatdan]

BTW, I think we should go back to default to pausing the container. Then if someone wants to have better performance is willing to take on the risk, they can run it with the --pause=false flag.

[rhatdan]

Lets get the default changed to default to Pause and get the temporary patch fixed. And then open a card to do a full test.

[TomSweeneyRedHat]

LGTM assuming happy tests

[rhatdan]

One issue with the pause is this will fail on rootless containers not running with cgroups V2, but I still think it is a good default.

[rhatdan]

/lgtm

[mheon]

We can't break cp for rootless containers by default - need to verify it still works.

[haircommander]

/cherry-pick v1.4.2-stable

[haircommander]

/cherrypick v1.4.2-stable