Wrong file ownership on volumes initialized from container image

[praiskup]

/kind bug

Description

The bind-mounted, freshly initialized volume contains correct files from the original
container image - but wrong permissions, when some directory has rwx------
permissions.

Steps to reproduce the issue:

$ podman build .
STEP 1: FROM fedora:32
STEP 2: RUN useradd testuser &&     mkdir /var/cache/testuser &&     touch /var/cache/testuser/datafile &&     chown -R testuser:testuser /var/cache/testuser &&     chmod -R 0700 /var/cache/testuser
STEP 3: COMMIT
--> 498a900473b
498a900473b241651fe9e2e7e078efaca9b59d7060a6a4b5724a97a113cbf10c
$ podman run --rm -ti 498a900473b241651fe9e2e7e078efaca9b59d7060a6a4b5724a97a113cbf10c bash
[root@c1dcda852158 /]# ls /var/cache/testuser/ -lah
total 0
drwx------. 2 testuser testuser 22 Jul 29 07:46 .
drwxr-xr-x. 3 root     root     22 Jul 29 07:46 ..
-rwx------. 1 testuser testuser  0 Jul 29 07:46 datafile
[root@c1dcda852158 /]# exit
$ podman run -v newvolume:/var/cache/testuser --rm -ti 498a900473b241651fe9e2e7e078efaca9b59d7060a6a4b5724a97a113cbf10c bash
[root@0c218c6e4777 /]# ls /var/cache/testuser/ -lah
total 0
drwx------. 2 root root 22 Jul 29 07:47 .
drwxr-xr-x. 3 root root 22 Jul 29 07:46 ..
-rwx------. 1 root root  0 Jul 29 07:46 datafile
[root@0c218c6e4777 /]#

Describe the results you received:

You can see in that output that file ownership differs in the two podman run scenarios,
one run with -v and one without.

Output of podman version:

$ podman version
Version:      2.0.3
API Version:  1
Go Version:   go1.14.3
Built:        Thu Jan  1 01:00:00 1970
OS/Arch:      linux/amd64

Output of podman info --debug:

$ podman info --debug
host:
  arch: amd64
  buildahVersion: 1.15.0
  cgroupVersion: v2
  conmon:
    package: conmon-2.0.19-1.fc32.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.0.19, commit: 5dce9767526ed27f177a8fa3f281889ad509fea7'
  cpus: 8
  distribution:
    distribution: fedora
    version: "32"
  eventLogger: file
  hostname: raiskup
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 17122
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 17122
      size: 1
    - container_id: 1
      host_id: 100000
      size: 65536
  kernel: 5.7.8-200.fc32.x86_64
  linkmode: dynamic
  memFree: 14404263936
  memTotal: 33270272000
  ociRuntime:
    name: crun
    package: crun-0.14.1-1.fc32.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 0.14.1
      commit: 598ea5e192ca12d4f6378217d3ab1415efeddefa
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +YAJL
  os: linux
  remoteSocket:
    path: /run/user/17122/podman/podman.sock
  rootless: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.1.4-1.fc32.x86_64
    version: |-
      slirp4netns version 1.1.4
      commit: b66ffa8e262507e37fca689822d23430f3357fe8
      libslirp: 4.3.1
      SLIRP_CONFIG_VERSION_MAX: 2
  swapFree: 0
  swapTotal: 0
  uptime: 72h 19m 55.42s (Approximately 3.00 days)
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - registry.centos.org
  - docker.io
store:
  configFile: /home/praiskup/.config/containers/storage.conf
  containerStore:
    number: 16
    paused: 0
    running: 15
    stopped: 1
  graphDriverName: overlay
  graphOptions:
    overlay.mount_program:
      Executable: /usr/bin/fuse-overlayfs
      Package: fuse-overlayfs-1.1.2-1.fc32.x86_64
      Version: |-
        fusermount3 version: 3.9.1
        fuse-overlayfs: version 1.1.0
        FUSE library version 3.9.1
        using FUSE kernel interface version 7.31
  graphRoot: /home/praiskup/.local/share/containers/storage
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "false"
    Supports d_type: "true"
    Using metacopy: "false"
  imageStore:
    number: 132
  runRoot: /run/user/17122/containers
  volumePath: /home/praiskup/.local/share/containers/storage/volumes
version:
  APIVersion: 1
  Built: 0
  BuiltTime: Thu Jan  1 01:00:00 1970
  GitCommit: ""
  GoVersion: go1.14.3
  OsArch: linux/amd64
  Version: 2.0.3

Package info (e.g. output of rpm -q podman or apt list podman):

podman-2.0.3-1.fc32.x86_64

Additional environment details (AWS, VirtualBox, physical, etc.):

Normal F32 x86_64 native box.

[giuseppe]

PR here: #7164