Ensure that --userns=keep-id sets user in config

[mheon]

One of the side-effects of the --userns=keep-id command is switching the default user of the container to the UID of the user running Podman (though this can still be overridden by the --user flag). However, it did this by setting the UID and GID in the OCI spec, and not by informing Libpod of its intention to switch users via the WithUser() option. Because of this, a lot of the code that should have triggered when the container ran with a non-root user was not triggering. In the case of the issue that this fixed, the code to remove capabilities from non-root users was not triggering. Adjust the keep-id code to properly inform Libpod of our intention to use a non-root user to fix this.

Also, fix an annoying race around short-running exec sessions where Podman would always print a warning that the exec session had already stopped.

Fixes #9919

[mheon]

Still need to write tests

[mheon]

@edsantiago Poke - do we have an issue for exec throwing warnings to the effect of:

WARN[0000] Error resizing exec session 626b91169ae09e7feb2ad75ebf595a53a8ed2b0455d60347aba6b6a6c1b0ce96: could not open ctl file for terminal resize for container 9ecdf6282b9d7824e6b681b3d40cb39a5c0c83ded8cf42860b470e3e0d853b3d: open /home/mheon/.local/share/containers/storage/overlay-containers/9ecdf6282b9d7824e6b681b3d40cb39a5c0c83ded8cf42860b470e3e0d853b3d/userdata/626b91169ae09e7feb2ad75ebf595a53a8ed2b0455d60347aba6b6a6c1b0ce96/ctl: no such device or address 

I think I remember one but I can't find it. Anyways, that's fixed here.

[rhatdan]

@mheon if I do a podman inspect after this is done, does the user say the UID/GID of the calling user?

[mheon]

@rhatdan Yep:

mheon@Marlborough containers/podman (fix_9919) » podman inspect -l  | grep User                  
            "User": "1000:1000",

Before:

mheon@Marlborough containers/podman (fix_9919) » podman inspect -l  | grep User
            "User": "",

[edsantiago]

@mheon that error doesn't look familiar, and I can't find any emails with "ctl" and "resizing" nor "resizing" and "exec" in my well-indexed archives. If you want tests, take a look at the new https://github.com/containers/podman/blob/master/test/system/450-interactive.bats

[mheon]

Unfortunately, it still says:

            "UsernsMode": "private",

I think that's a separate, more involved fix, though.

[mheon]

@edsantiago Huh. It is a race, so if CI isn't seeing it, my working theory is that CI is too slow to actually experience it.

[giuseppe]

LGTM

[mheon]

Added a check in Libpod to make sure this doesn't happen again. Test added. Should be good to merge.

[rhatdan]

/lgtm
/hold

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: giuseppe, mheon, rhatdan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [giuseppe,mheon,rhatdan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[mheon]

/hold cancel