chrootarchive: remove redundant "init" mitigation for CVE-2019-14271

This init wasa added in [a316b10] to prevent libraries being loaded in
memory from an untrusted environment. Later mitigations added in [e9bbc41],
and [2b4db93] (following implementation of https://go.dev/issue/50102 in
go1.23) made this init redundant, but the original patch was left in-place.

In some situations, this init can cause delays, resulting in slow starts of
containers;

    dockerd[165807]: init github.com/docker/docker/pkg/chrootarchive @11 ms, 20013 ms clock, 147808 bytes, 131 allocs

Further looking into the mitigation, it's debatable if the defence-in-depth
adds much value (see [1]);

> From my point of view, the original fix (func init()) is only a workaround
> instead of a proper fix (avoid populating user/group names). NSS loads DSOs
> lazily, user.Lookup("docker") and net.LookupHost("localhost") can not guarantee
> every DSOs are loaded.
>
> For example, in a sane environment (/etc/hosts contains an entry for localhost),
> net.LookupHost("localhost") stops at libnss_files.so and will not load libnss_dns.so,
> which makes it almost useless because libnss_files.so was already loaded due
> to user.Lookup("docker").

This patch removes the init to prevent the possibility of adding delays, and
because this mitigation became redundant.

[a316b10]: moby/moby@a316b10
[e9bbc41]: moby/moby@e9bbc41
[2b4db93]: moby/moby@2b4db93
[1]: moby/moby#44540 (comment)

Signed-off-by: Sebastiaan van Stijn <[email protected]>

Author: thaJeztah

chrootarchive/archive_unix.go

@@ -5,21 +5,12 @@ package chrootarchive
 import (
 	"errors"
 	"io"
-	"net"
-	"os/user"
 	"path/filepath"
 	"strings"
 
 	"github.com/moby/go-archive"
 )
 
-func init() {
-	// initialize nss libraries in Glibc so that the dynamic libraries are loaded in the host
-	// environment not in the chroot from untrusted files.
-	_, _ = user.Lookup("docker")
-	_, _ = net.LookupHost("localhost")
-}
-
 func invokeUnpack(decompressedArchive io.Reader, dest string, options *archive.TarOptions, root string) error {
 	relDest, err := resolvePathInChroot(root, dest)
 	if err != nil {