support inspecting `user.rootlesscontainers` xattr

[AkihiroSuda]

We should have a utility command to show the user.rootlesscontainers xattr value in a human-readable format.

e.g.

$ id -u
1001

$ ls -ln /path/to/bundle/etc/
...
-rw-r----- 1 1001 1001 422 May 29 23:20 shadow

$ getfattr -d -e hex -m user.rootlesscontainers /path/to/bundle/rootfs/etc/shadow 
...
user.rootlesscontainers=0xdeadbeef...

$ umoci ls-bundle /path/to/bundle/etc/
-rw-r----- 1 0 42 422 May 29 23:20 shadow

[cyphar]

Not a bad idea -- though it'd probably be called something like umoci raw rootless-ls.

[DrDaveD]

Alternatively an LD_PRELOAD module that could be applied to any tool would be super useful.

[cyphar]

That already exists -- see https://github.com/rootless-containers/PRoot (which is a fork of PRoot with rootless containers support, written by @AkihiroSuda). We had planned to write a version that used seccomp-notify but I don't think we ever got around to it.

There's also https://github.com/rootless-containers/runrootless and https://github.com/cyphar/remainroot.

[DrDaveD]

I knew about that archived PRoot project (which I have brought up to date, see rootless-containers/proto#6), but that is based on ptrace instead of LD_PRELOAD. More significantly, it is based on an entire separate project with a different primary goal of faking root access and so maintaining a fork requires ongoing work to merge in changes from upstream. I was thinking that an LD_PRELOAD made specifically for the purpose of emulating the user.rootlesscontainers xattr might be easier to maintain.

runrootless is also archived. I hadn't seen your remainroot, but I see now that it previously supported and rejected LD_PRELOAD so I suppose that you've got some negative views of an LD_PRELOAD approach for this. I have had mostly positive experience with it in the fakeroot command and in a small one I wrote for Apptainer to modify the behavior of fuse2fs.

[cyphar]

Right, I hadn't looked at this stuff in ages.

The issue with LD_PRELOAD is that it doesn't work for programs that do not use the syscall wrappers provided by glibc (such as all Go programs and a fair number of C programs that want to use their own wrappers), which is why I ended up going with ptrace. You can't really guarantee that LD_PRELOAD will work with arbitrary binaries or continue to work for the same binary when it is updated.

The ideal solution would be to use the seccomp-notify facility, as that doesn't suffer from the issues that ptrace suffers from and is very efficient in comparison.

[DrDaveD]

seccomp_unitify(2) does look promising, although the disadvantage is that it appears to not be available on older still supported operating systems like EL8.