checkpoint: resolve symlink for external bind mount (take II)

[liusdu]

[From @kolyshkin: This is a respin of #2902 which was reverted in #3043]

runc resolves symlink before doing bind mount. So
we should save original path while formatting CriuReq for
dump and restore.

"checkpoint: resolve symlink for external bind mount" is merged as
da22625 (PR #2902) previously. And reverted
in commit 70fdc05 (PR #3043) duo to behavior changes
caused by commit 0ca91f4 (Fixes: CVE-2021-30465)

Signed-off-by: Liu Hua [email protected]

Changelog entry

(by @kolyshkin)

* runc checkpoint/restore: fixed for containers with an external bind mount
  which destination is a symlink. (#3047).

[liusdu]

Hi @kolyshkin and @cyphar Sorry for broking CI system in the weekend..

When #2902 is merge, issue #3042 shows that CI is broken, with error message No mapping for /real/conf mountpoint.
After a quick bisect search, I found it is cause by changes from commit 0ca91f4.

diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go
index 945a0fa..849bf4a 100644
--- a/libcontainer/container_linux.go
+++ b/libcontainer/container_linux.go
@@ -1217,7 +1217,6 @@ func (c *linuxContainer) makeCriuRestoreMountpoints(m *configs.Mount) error {
                if err := checkProcMount(c.config.Rootfs, dest, ""); err != nil {
                        return err
                }
-               m.Destination = dest
                if err := os.MkdirAll(dest, 0755); err != nil {
                        return err
                }

I am not sure whether it is introduced due to security issue. So I choose Solution 2 described in #3042

[kolyshkin]

LGTM

[kolyshkin]

LGTM

[kolyshkin]

@cyphar @AkihiroSuda PTAL

[liusdu]

Thanks @kolyshkin , @cyphar @AkihiroSuda rebased and tested with newest master.

[kolyshkin]

@liusdu can you please rebase? we did some changes to CI that unfortunately require an explicit rebase.

[liusdu]

@kolyshkin rebased~

[kolyshkin]

@liusdu needs another rebase (we're tackling with CI lately)

[liusdu]

rebased

[kolyshkin]

LGTM

[liusdu]

@kolyshkin @cyphar @crosbymichael rebased, please take a look at this patch.

[kolyshkin]

Still LGTM

[cyphar]

LGTM. Tbh I'm still not sure I understand why it's necessary, but if it fixes stuff for CRIU I'm happy.