oci/state: use crun's non-standard root state field to avoid bundle dir access

[henry118]

Partially fixes #648.

The OCI runtime spec defines what a runtime passes to hooks on stdin: a state JSON object containing a container's bundle path. To find the container root, the toolkit currently opens <bundle>/config.json and reads root.path from it. This requires read access to the bundle directory.

When Podman runs a container with --userns nomap or --userns auto, the invoking user's UID is intentionally excluded from the container's user namespace UID map. The hook process runs inside the container's user namespace with an unmapped UID, which has no permission to read the bundle directory owned by the host user. As a result, GetContainerRoot() fails opening config.json with permission denied, and every CDI hook that calls it exits with an error.

crun includes a non-standard root field in the state JSON it sends to hooks, populated from config.json's root.path:

https://github.com/containers/crun/blob/c3a49b822cc45c1ae9e0459eff534efe61c4a5be/src/libcrun/container.c#L746

This provides the rootfs path directly, without requiring any access to the bundle directory. GetContainerRoot() can now check s.Root first. If present, it can be returned directly without accessing the config JSON file.

This fix is limited to crun only. runc does not include a root field in its state JSON. And this fix requires crun ≥ 1.27 because 1.27 included a change which allows ignoring chdir permission errors before container hook is executed (containers/crun#2035).

Given #648 is reported on Podman and crun is podman's preferred and default runtime, this fix should be suffice for majority of the use cases.

[elezar]

What about adding a State.getRoot() (string, error) helper to determine the root so that we don't have to duplicate the IsAbs and Join calls?

Suggested change

	func (s *State) getRoot() (string, error) {
	if s.Root != "" {
	return s.Root, nil
	}
	spec, err := s.loadMinimalSpec()
	if err != nil {
	return "", err
	}
	if spec.Root != nil {
	return spec.Root.Path, nil
	}
	return "", nil
	}
	// GetContainerRoot returns the root for the container from the associated spec. If the spec is not yet loaded, it is
	// loaded and cached.
	func (s *State) GetContainerRoot() (string, error) {
	containerRoot, err := s.getRoot()
	if err != nil {
	return "", err
	}

[henry118]

Updated.

[coveralls]

Coverage Report for CI Build 32179083108

Coverage increased (+0.3%) to 43.984%

Details

• Coverage increased (+0.3%) from the base build.
• Patch coverage: 11 of 11 lines across 1 file are fully covered (100%).
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	15283
Covered Lines:	6722
Line Coverage:	43.98%
Coverage Strength:	0.49 hits per line

---

💛 - Coveralls

[cdesiniotis]

/cherry-pick release-1.20

[github-actions]

🤖 Backport PR created for release-1.20: #2007 ✅

[henry118]

/cherry-pick release-1.20

[github-actions]

🤖 Backport PR created for release-1.20: #2013 ✅