[PATCH container] fix #8254: oci create: do not require /etc/ files for numeric ids

[PATCH container] fix #8254: oci create: do not require /etc/ files for numeric ids

[Filip Schauer]

resolve_oci_user() used to always die if /etc/passwd or /etc/group could
not be resolved in the container rootfs, even when the image config set
a numeric User that needs no lookup.

Only treat the files as unresolvable when they are actually needed.

This also changes behavior when a name cannot be resolved. It now fails
with an error instead of silently continuing without a UID or GID, which
let the container's init run as root even though the image asked for a
different user. This is also required by the OCI image spec, in the
"Conversion to OCI Runtime Configuration" section: "If Config.User does
not correspond to a user in the container's context, the converter MUST
return an error."

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
 src/PVE/LXC/Create.pm | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/src/PVE/LXC/Create.pm b/src/PVE/LXC/Create.pm
index 64a6f66..3c07911 100644
--- a/src/PVE/LXC/Create.pm
+++ b/src/PVE/LXC/Create.pm
@@ -801,12 +801,13 @@ sub resolve_oci_user {
             # Prevent symlinks from escaping out of container rootdir
             chroot($rootdir) or die "failed to change root to: $rootdir: $!\n";
             chdir('/') or die "failed to change to root directory\n";
-            my $etc_passwd = abs_path('/etc/passwd')
-                or die "cannot resolve /etc/passwd path in container rootfs\n";
-            my $etc_group = abs_path('/etc/group')
-                or die "cannot resolve /etc/group path in container rootfs\n";
+            my $etc_passwd = abs_path('/etc/passwd');
+            my $etc_group = abs_path('/etc/group');
 
-            return [$rootdir . $etc_passwd, $rootdir . $etc_group];
+            return [
+                defined($etc_passwd) ? $rootdir . $etc_passwd : undef,
+                defined($etc_group) ? $rootdir . $etc_group : undef,
+            ];
         })
     };
 
@@ -858,6 +859,7 @@ sub resolve_oci_user {
     } else {
         $username = $user;
         $uid = $lookup_field->($etc_passwd, 0, $username, 2);
+        die "cannot resolve username '$username' to uid\n" if !defined($uid);
     }
 
     if (defined($group)) {
@@ -865,6 +867,7 @@ sub resolve_oci_user {
             $gid = $group;
         } else {
             $gid = $lookup_field->($etc_group, 0, $group, 2);
+            die "cannot resolve group '$group' to gid\n" if !defined($gid);
         }
     } else {
         $gid = $lookup_field->($etc_passwd, 2, $uid, 3) if defined($uid);
-- 
2.47.3