Disable namespace remapping for chown cleanup

[HackAttack]

This feature breaks our ability to effectively become root (by design).

[toote]

Could you provide more information about the exact issue you are trying to solve? I am not sure I understand what it is.

[HackAttack]

In order for the chown cleanup to work, we have to be root (to be able to delete root-owned files). Since we can’t assume sudo will work, the “trick” to becoming root is to run a container as root and mount in the directory we want to clean. In Docker’s default configuration, root in the container is root outside the container, but this is a security hole which Docker allows you to avoid with user namespaces. But we need to exploit that security hole to do what we’re trying to do! So we disable the protection on a per-container basis.

[toote]

Makes sense! Would you be able to also document that in the chown option so that it is not a surprise for those running the plugin?

[HackAttack]

What do you think should be documented? This change seems like a bug fix that should be transparent to users. Before this change, the chown option would not work if userns-remap was enabled—now it should. I’m not sure the implementation details of how it works should be in the documentation?

[toote]

Just that the chown option will run a container that will share the host's user namespace. Some security people may have issues with that and we want to disclose that kind of things just in case.

[HackAttack]

Ok, done.