OCPBUGS-62150: server: ignore /etc/passwd mount

adrianreber · openshift-cherrypick-robot · commit 5962cd750e55 · 2025-12-15T16:39:15.000Z
Ignore /etc/passwd when checking for mounts. Always rely on the mount as
defined from Kubernetes. This follows existing practice like for
/etc/hosts or /etc/resolv.conf

Signed-off-by: Adrian Reber &lt;areber@redhat.com&gt;
diff --git a/server/container_restore.go b/server/container_restore.go
@@ -273,6 +273,8 @@ func (s *Server) CRImportCheckpoint(
 		"/dev/shm":           true,
 		"/etc/resolv.conf":   true,
 		"/etc/hostname":      true,
+		"/etc/passwd":        true,
+		"/etc/group":         true,
 		"/run/secrets":       true,
 		"/run/.containerenv": true,
 	}
diff --git a/test/checkpoint.bats b/test/checkpoint.bats
@@ -154,3 +154,44 @@ function teardown() {
 	[[ "$container_name" == "restored-sleep-container" ]]
 	[[ "$pod_name" == "restoresandbox2" ]]
 }
+
+@test "checkpoint and restore: /etc/passwd uses Kubernetes run_as_user on restore" {
+	CONTAINER_ENABLE_CRIU_SUPPORT=true start_crio
+	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
+	# Create container with run_as_user=1001
+	START_JSON=$(mktemp)
+	jq '.linux.security_context.run_as_user.value = 1001
+		| .command=["/bin/sh"]
+		| .args=["-c","sleep inf"]' \
+		"$TESTDATA"/container_sleep.json > "$START_JSON"
+	ctr_id=$(crictl create "$pod_id" "$START_JSON" "$TESTDATA"/sandbox_config.json)
+	crictl start "$ctr_id"
+	# Verify the UID of the running process
+	run crictl exec "$ctr_id" id
+	[[ "$output" == *"uid=1001"* ]]
+	# Verify /etc/passwd contains entry for UID 1001
+	run crictl exec "$ctr_id" cat /etc/passwd
+	[[ "$output" == *"1001"* ]]
+	# Checkpoint the container
+	crictl checkpoint --export="$TESTDIR"/cp.tar "$ctr_id"
+	crictl rm -f "$ctr_id"
+	crictl rmp -f "$pod_id"
+	pod_id=$(crictl runp "$TESTDATA"/sandbox_config.json)
+	RESTORE_JSON=$(mktemp)
+	jq '.image.image="'"$TESTDIR"'/cp.tar"
+		| .linux.security_context.run_as_user.value = 1001' \
+		"$TESTDATA"/container_sleep.json > "$RESTORE_JSON"
+	ctr_id=$(crictl create "$pod_id" "$RESTORE_JSON" "$TESTDATA"/sandbox_config.json)
+	crictl start "$ctr_id"
+	# Verify that the container was restored
+	restored=$(crictl inspect --output go-template --template "{{(index .info.restored)}}" "$ctr_id")
+	[[ "$restored" == "true" ]]
+	# Verify the UID is still 1001
+	run crictl exec "$ctr_id" id
+	[[ "$output" == *"uid=1001"* ]]
+	run crictl exec "$ctr_id" cat /etc/passwd
+	[[ "$output" == *"1001"* ]]
+	# Cleanup
+	rm -f "$START_JSON"
+	rm -f "$RESTORE_JSON"
+}

Original file line number	Diff line number	Diff line change
`@@ -273,6 +273,8 @@ func (s *Server) CRImportCheckpoint(`
`273`	`273`	`"/dev/shm": true,`
`274`	`274`	`"/etc/resolv.conf": true,`
`275`	`275`	`"/etc/hostname": true,`
	`276`	`+ "/etc/passwd": true,`
	`277`	`+ "/etc/group": true,`
`276`	`278`	`"/run/secrets": true,`
`277`	`279`	`"/run/.containerenv": true,`
`278`	`280`	`}`