Wrong permissions of mounted volume using relative path for current directory on macOS

[oklimberg]

Issue Description

I am currently in the onboarding process of a project, in which developers only have been using Linux so far. However, I am using macOS and using one of their podman run commands failed on my machine. After some investigation, we found out, that mounting a volume of the current directory using . for the path was causing the issue. I checked the documentation for the --mount/ -v option and could not find any limitation on relative paths for mounts.
After some more testing, we noticed .. also does not work. Same applies for relative paths to subfolders without a starting point (e.eg: -v subfolder:/path/in/container instead of -v ./subfolder:/path/in/container) or any path starting with .. (e.g.: -v ../sibling:/path/in/container)

Steps to reproduce the issue

Steps to reproduce the issue

1. run podman run -v .:/var/www/html php:8.0-apache ls from any folder on the host machine

Describe the results you received

the command above exits with the following error: ls: cannot open directory '.': Permission denied

Describe the results you expected

I would have expected to see the output of the ls command

podman info output

host:
  arch: arm64
  buildahVersion: 1.37.2
  cgroupControllers:
  - cpu
  - io
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.1.10-1.fc40.aarch64
    path: /usr/bin/conmon
    version: 'conmon version 2.1.10, commit: '
  cpuUtilization:
    idlePercent: 99.86
    systemPercent: 0.07
    userPercent: 0.07
  cpus: 7
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: coreos
    version: "40"
  eventLogger: journald
  freeLocks: 2046
  hostname: localhost.localdomain
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
    uidmap:
    - container_id: 0
      host_id: 501
      size: 1
    - container_id: 1
      host_id: 100000
      size: 1000000
  kernel: 6.9.12-200.fc40.aarch64
  linkmode: dynamic
  logDriver: journald
  memFree: 1222479872
  memTotal: 2043703296
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.12.1-1.20240819115418474394.main.6.gc2cd0be.fc40.aarch64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.13.0-dev
    package: netavark-1.12.1-1.20240819170533312370.main.26.g4358fd3.fc40.aarch64
    path: /usr/libexec/podman/netavark
    version: netavark 1.13.0-dev
  ociRuntime:
    name: crun
    package: crun-1.16-1.20240813143753154884.main.16.g26c7687.fc40.aarch64
    path: /usr/bin/crun
    version: |-
      crun version UNKNOWN
      commit: 158b340ec38e187abee05cbf3f27b40be2b564d0
      rundir: /run/user/501/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-0^20240726.g57a21d2-1.fc40.aarch64
    version: |
      pasta 0^20240726.g57a21d2-1.fc40.aarch64-pasta
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/501/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: true
  serviceIsRemote: true
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.2.2-2.fc40.aarch64
    version: |-
      slirp4netns version 1.2.2
      commit: 0ee2d87523e906518d34a6b423271e4826f71faf
      libslirp: 4.7.0
      SLIRP_CONFIG_VERSION_MAX: 4
      libseccomp: 2.5.5
  swapFree: 0
  swapTotal: 0
  uptime: 14h 21m 24.00s (Approximately 0.58 days)
  variant: v8
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - docker.io
store:
  configFile: /var/home/core/.config/containers/storage.conf
  containerStore:
    number: 2
    paused: 0
    running: 0
    stopped: 2
  graphDriverName: overlay
  graphOptions: {}
  graphRoot: /var/home/core/.local/share/containers/storage
  graphRootAllocated: 106769133568
  graphRootUsed: 5925675008
  graphStatus:
    Backing Filesystem: xfs
    Native Overlay Diff: "true"
    Supports d_type: "true"
    Supports shifting: "false"
    Supports volatile: "true"
    Using metacopy: "false"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 16
  runRoot: /run/user/501/containers
  transientStore: false
  volumePath: /var/home/core/.local/share/containers/storage/volumes
version:
  APIVersion: 5.2.2
  Built: 1724198400
  BuiltTime: Wed Aug 21 02:00:00 2024
  GitCommit: ""
  GoVersion: go1.22.6
  Os: linux
  OsArch: linux/arm64
  Version: 5.2.2

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

Yes

Additional environment details

No response

Additional information

No response

[baude]

hello @oklimberg , ive been thinking about this one ... on the one hand, it might be easy enough to normalize the host side input for the volume mount, but that also gave me pause about expectations.

today, podman cannot do dynamic volume mounting. by this, I mean mount some directory on the fly into the podman machine vm. Mounts need to be defined at the time of creation. So in the case of using . as the directory indicator, we could have a potential problem where if . meant /Users/me/somedir then it would work because /Users/me/ is, by default, mounted into the machine; therefore normalizing it would be fine. On the other hand, if you were sitting in /tmp/foobar and passed ., then it would try and find /tmp/foobar on the machine vm which may or may not exist?

if you kind of expected that and are fine with this approach, speak up. I just wanted to verify expecations first ... thank you for the issue submission either way.

[github-actions]

A friendly reminder that this issue had no activity for 30 days.

[oklimberg]

To be honest, the main reason for creating this issue was the different behavior on macOS and Linux.
I will have to check the setup of the Linux users, regarding the path within the default user directory mount from your example.
Is this only valid for direct subfolders of the user home, or does this apply to all subfolders?