runc with user namespace enabled fails to bind mount host dirs with 750 permission #2484
Description
When config.json has the following:
- user namespace enabled
- a bind mount from a host directory that is a sub-directory of one with with
drwxr-x---permission, it fails with the error message:
# time="2020-06-22T13:48:26Z" level=error msg="container_linux.go:367:
starting container process caused: process_linux.go:459:
container init caused: rootfs_linux.go:58:
mounting \"/tmp/busyboxtest/source-inaccessible/dir\"
to rootfs at \"/tmp/inaccessible\" caused:
stat /tmp/busyboxtest/source-inaccessible/dir: permission denied"
I implemented a reproducer in the integration tests, along with the explanation and a workaround when started from a systemd unit: #2483