Copy ParseIDMap from idtools and extend supporting @ParentID

This topic has been discussed at length at containers#18333, with
@giuseppe, @Luap99 and with the feedback from @rhatdan. The requirements were defined there and
this aims to be the implementation.

Motivation
===========

These series of patches aim to make --uidmap and --gidmap easier to use, especially in rootless podman setups.

(I will focus here on the --gidmap option, although the same applies for --uidmap.)

In rootless podman, the user namespace mapping happens in two steps, through an intermediate mapping.

See https://docs.podman.io/en/latest/markdown/podman-run.1.html#uidmap-container-uid-from-uid-amount
for further detail, here is a summary:

First the user GID is mapped to 0 (root), and all subordinate GIDs (defined at /etc/subgid, and
usually >100000) are mapped starting at 1.

If we want to change it further, we can use the --gidmap option, to map that intermediate mapping
to the final mapping that will be seen by the container.

As an example, let's say we have as main GID the group 1000, and we also belong to the additional GID 2000,
that we want to make accessible inside the container.

We first ask the sysadmin to subordinate the group to us, by adding "$user:2000:1" to /etc/subgid.

Then we need to use --gidmap to specify that we want to map GID 2000 into some GID inside the container.

And here is the first trouble:

Since the --gidmap option operates on the intermediate mapping, we first need to figure out where has
podman placed our GID 2000 in that intermediate mapping using:

    podman unshare cat /proc/self/gid_map

Then, we may see that GID 2000 was mapped intermediate GID 5. So our --gidmap option should include:

    --gidmap 20000:5:1

This intermediate mapping may change in the future if further groups are subordinated to us (or we stop
having its subordination), so we are forced to verify the mapping with
`podman unshare cat /proc/self/gid_map` every time, and parse it if we want to script it.

**The first usability improvement** we agreed on containers#18333 is to be able to use:

    --gidmap 20000:@2000:1

so podman does this lookup in the parent user namespace for us.

But this is only part of the problem. We must specify a full gidmap and not only what we want:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1

This is becoming complicated. We had to break the gidmap at 5, because the intermediate 5 had to
be mapped to another value (20000), and then we had to keep mapping all other subordinate ids... up to
close to the maximum number of subordinate ids that we have (or some reasonable value). This is hard
to explain to someone who does not understand how the mappings work internally.

**The second usability improvement** is to be able to use:

   --gidmap "+20000:@2000:1"

where the plus sign (`+`) states that we want to start with an identity mapping, and break it where
necessary so this mapping gets included.

One final improvement related to this is the following:

By default, when podman  gets a --gidmap argument but not a --uidmap argument, it copies the mapping.
With the new syntax this copying does not make sense. Having a GID subordinated to us does not imply
that the same UID will be subordinated as well. This means, that when we wanted to use:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1

We also had to include:

    --gidmap 0:0:5 --gidmap 5:6:15000 --gidmap 20000:5:1 --uidmap 0:0:65000

making everything even harder to understand without proper context.

In this series of patches, when a "break and insert" gidmap is given (using the described `+` syntax)
without a --uidmap, we assume that we want the "identity mapping" as --uidmap (0:0:65000).

To preserve backwards compatibility, this different default mapping is only used when the `+` syntax
is used, so users who rely on the previous behaviour don't suffer any changes.

Signed-off-by: Sergio Oller <[email protected]>

Author: zeehio

pkg/util/utils.go

@@ -4,6 +4,7 @@ import (
 	"errors"
 	"fmt"
 	"math"
+	"math/bits"
 	"os"
 	"os/user"
 	"path/filepath"
@@ -30,6 +31,7 @@ import (
 	stypes "github.com/containers/storage/types"
 	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	ruser "github.com/opencontainers/runc/libcontainer/user"
 	"github.com/sirupsen/logrus"
 	"golang.org/x/term"
 )
@@ -292,6 +294,90 @@ func GetNoMapMapping() (*stypes.IDMappingOptions, int, int, error) {
 	return &options, 0, 0, nil
 }
 
+
+func mapIDwithMapping(id uint64, mapping []ruser.IDMap, mapSetting string) (mappedid uint64, err error) {
+	for _, v := range mapping {
+	    if v.Count == 0 {
+	        continue
+	    }
+	    if id >= uint64(v.ParentID) && id < uint64(v.ParentID + v.Count) {
+	        offset := id - uint64(v.ParentID)
+	        return uint64(v.ID) + offset, nil;
+	    }
+	}
+	return uint64(0), fmt.Errorf("Parent ID %s %d is not mapped/delegated.", mapSetting, id)
+}
+
+// Extension of idTools.parseTriple that parses idmap triples from string.
+// This extension covers the "@" syntax: The "101001:@1001:1" mapping
+// means "take the 1001 id from the parent namespace and map it to 101001"
+// See https://github.com/containers/podman/issues/18333 for details
+func parseTriple(spec []string, parentMapping []ruser.IDMap, mapSetting string) (container, host, size uint32, err error) {
+	cid, err := strconv.ParseUint(spec[0], 10, 32)
+	if err != nil {
+		return 0, 0, 0, fmt.Errorf("parsing id map value %q: %w", spec[0], err)
+	}
+	hid := uint64(0)
+	if spec[1][0] != '@' {
+		hid, err = strconv.ParseUint(spec[1], 10, 32)
+	} else {
+		hparentid, err := strconv.ParseUint(spec[1][1:], 10, 32)
+		if err != nil {
+			return 0, 0, 0, fmt.Errorf("parsing id map value %q: %w", spec[1], err)
+		}
+		hid, err = mapIDwithMapping(hparentid, parentMapping, mapSetting)
+		if err != nil {
+			return 0, 0, 0, err
+		}
+	}
+	if err != nil {
+		return 0, 0, 0, fmt.Errorf("parsing id map value %q: %w", spec[1], err)
+	}
+	sz, err := strconv.ParseUint(spec[2], 10, 32)
+	if err != nil {
+		return 0, 0, 0, fmt.Errorf("parsing id map value %q: %w", spec[2], err)
+	}
+	return uint32(cid), uint32(hid), uint32(sz), nil
+}
+
+// Extension of idTools.ParseIDMap that parses idmap triples from string.
+// This extension covers the "@" syntax: The "101001:@1001:1" mapping
+// means "take the 1001 id from the parent namespace and map it to 101001"
+// See https://github.com/containers/podman/issues/18333 for details
+func ParseIDMap(mapSpec []string, mapSetting string, parentMapping []ruser.IDMap) (idmap []idtools.IDMap, err error) {
+	stdErr := fmt.Errorf("aaa initializing ID mappings: %s setting is malformed expected [\"uint32:[@]uint32:uint32\"] : %q", mapSetting, mapSpec)
+	for _, idMapSpec := range mapSpec {
+		if idMapSpec == "" {
+			continue
+		}
+		idSpec := strings.Split(idMapSpec, ":")
+		if len(idSpec)%3 != 0 {
+			return nil, stdErr
+		}
+		for i := range idSpec {
+			if i%3 != 0 {
+				continue
+			}
+			cid, hid, size, err := parseTriple(idSpec[i : i+3], parentMapping, mapSetting)
+			if err != nil {
+				return nil, err
+			}
+			// Avoid possible integer overflow on 32bit builds
+			if bits.UintSize == 32 && (cid > math.MaxInt32 || hid > math.MaxInt32 || size > math.MaxInt32) {
+				return nil, stdErr
+			}
+			mapping := idtools.IDMap{
+				ContainerID: int(cid),
+				HostID:      int(hid),
+				Size:        int(size),
+			}
+			idmap = append(idmap, mapping)
+		}
+	}
+	return idmap, nil
+}
+
+
 // ParseIDMapping takes idmappings and subuid and subgid maps and returns a storage mapping
 func ParseIDMapping(mode namespaces.UsernsMode, uidMapSlice, gidMapSlice []string, subUIDMap, subGIDMap string) (*stypes.IDMappingOptions, error) {
 	options := stypes.IDMappingOptions{