"Sudo" and other suid binaries cannot be used inside containers

[nollium]

Hello,

By default, crun sets the "no new privileges" flag to true, which prevents using suid binaries like sudo inside containers.
dockerc does not allow modifying this flag.

POC

Dockerfile:

FROM debian:bookworm-slim

COPY flag.txt /flag.txt
RUN chmod 400 /flag.txt

RUN apt-get update && \
    apt-get install -y openssh-server sudo gawk && \
    useradd -m apt42 && \
    echo 'apt42:apt42' | chpasswd && \
    mkdir /var/run/sshd && \
    echo "apt42 ALL=(ALL) NOPASSWD: /usr/bin/gawk" > /etc/sudoers.d/apt42 && \
    chmod 440 /etc/sudoers.d/apt42 && \
    echo "Port 2222" >> /etc/ssh/sshd_config

EXPOSE 2222

CMD ["/usr/sbin/sshd", "-Dd"]

Running sudo

ssh -p 2222 apt42@localhost 
apt42@localhost's password: 
...

$ sudo -l
sudo: The "no new privileges" flag is set, which prevents sudo from running as root.
sudo: If sudo is running in a container, you may need to adjust the container configuration to disable the flag.

Fix

This can be solved in the same way as #52 , by modifying src/main.zig and passing the flag to crun:

diff --git a/src/main.zig b/src/main.zig
index 0a87ef8..6ecf34d 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -180,6 +180,7 @@ fn getContainerFromArgs(file: std.fs.File, rootfs_absolute_path: []const u8, par
             switch (processVal.*) {
                 .object => |*process| {
                     try process.put("terminal", std.json.Value{ .bool = false });
+                    try process.put("noNewPrivileges", std.json.Value{ .bool = false });
 
                     const argsVal = process.getPtr("args") orelse @panic("no args key");
                     switch (argsVal.*) {

After this fix, the "expected" behavior is met:

ssh -p 2222 apt42@localhost 
apt42@localhost's password: 
...

$ sudo -l

sudo: unable to resolve host umoci-default: Name or service not known
Matching Defaults entries for apt42 on umoci-default:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, use_pty

User apt42 may run the following commands on umoci-default:
    (ALL) NOPASSWD: /usr/bin/gawk

By default, docker/podman allows "new privileges", so, to avoid confusing users, dockerc should probably do the same.