support "--security-opt systempaths=unconfined"

[cyphar]

/kind feature

Description

Right now you can't disable the /proc overmounts. While these are a security feature in general, due to kernel restrictions, this means that you cannot run a subcontainer or other sandbox that tries to mount procfs (even if it uses user namespaces). Having a way to optionally disable this would be neat and would also bring more feature parity with Docker (which supports --security-opt systempaths=unconfined).

In newer kernels you will be able to work around this with mount -t procfs -o subset=pids procfs /proc but right now the only other workaround is to mount some /proc handle into the container. The safest way is with something like:

% mkdir /tmp/empty-procfs
% sudo unshare -pf mount -t proc proc /tmp/empty-procfs
% podman run -v /tmp/empty-procfs:/.stashed-proc # ...

But most people probably end up doing /proc:/.stashed-proc which is quite dangerous. This is also probably needed to completely support AllowedProcMountTypes = Unmasked.

[mheon]

We already support passing options to the /proc mount via --security-opt proc-opts (added in #7227). It looks like Docker went ahead and added it at some point at well, using a completely incompatible syntax, so now we'll have to support that as well...

[cyphar]

This is separate to procfs mount options. This is about disabling the /proc/scsi et al overmounts (MaskedPaths).

[mheon]

Ah - I see, you're entirely right. This is definitely worth adding.

[vrothberg]

@cyphar, do you have cycles to open a PR?

[cyphar]

I'll write something up this week.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[rhatdan]

@umohnani8 PR to handle --security-opt=mask/unmask should fix this Issue.

@umohnani8 We might want to add a unmask=all flag to remove all masking.

[umohnani8]

Yup, we have unmask=ALL as an option as well. The PR is #8408

[cyphar]

Uh this isn't quite fixed because you don't have flag-parity with Docker but I can send a PR to fix that up.

[rhatdan]

SGTM

[umohnani8]

Opened #8630 for the flag-parity