fix permission denied

[win-t]

when exec as root and config.Cwd is not owned by root, exec will fail
because root doesn't have the caps.

So, Chdir should be done before setting the caps.

to reproduce this error

1. create Dockerfile

FROM alpine:latest

RUN mkdir /lala && chown nobody:nobody /lala && chmod 0700 /lala
USER nobody
WORKDIR /lala

ENTRYPOINT ["sh", "-c", "mkfifo lala; cat lala"]

2. build and run the container

docker build -t asdf .
docker run -it --rm --name hai asdf

3. docker exec from another terminal

docker exec -it -u 0:0 hai sh

[crosbymichael]

LGTM

[siscia]

ping!

[cyphar]

LGTM.

[Random-Liu]

Does this introduce a regression?
See containerd/cri#1397 (comment) and moby/moby#36587

@crosbymichael @cyphar

[justincormack]

I believe this is incorrect as @Random-Liu suggests; I am unsure why you accepted a PR with a repro just from docker exec not runc as docker exec has some interesting properties in that it inherits some properties from the original run.

[win-t]

@justincormack I can reproduce this just with old version of runc
it is just more easy with docker

[cyphar]

I can see the argument for this new behaviour being wrong (in theory you could bypass some DAC controls in very odd setups by setting your working directory to be inside a path which is world-rx but has a parent which the use doesn't have rx permissions on.

I'm okay with reverting this, but I don't really feel that either behaviour is necessarily wrong. After all, we've always said that being able to run custom container configurations is equivalent to running as root (not that anyone listens...).

[kolyshkin]

At least we should not merge PRs with no runc repro / integration test case.

This was some arbitrary change that fixed one workflow and broke another (#2685), and there is no test case to see if the fix from #2685 results in any regressions :(

[kolyshkin]

OK here is the test case which fails before and passes after this PR.

@test "runc exec --user with no access to cwd" {
        requires root

        chown 42 rootfs/root
        chmod 700 rootfs/root

        update_config '   .process.cwd = "/root"
                        | .process.user.uid = 42
                        | .process.args |= ["sleep", "1h"]'

        runc run -d --console-socket "$CONSOLE_SOCKET" test_busybox
        [ "$status" -eq 0 ]

        runc exec --user 0 test_busybox true
        [ "$status" -eq 0 ]
}