Follow up auth

docs/containers-auth.json.5.md

@@ -6,16 +6,23 @@ containers-auth.json - syntax for the registry authentication file
 # DESCRIPTION
 
 A file in JSON format controlling authentication against container image registries.
-The primary (read/write) file is stored at `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux;
+The primary (read/write) per-user file is stored at `${XDG_RUNTIME_DIR}/containers/auth.json` on Linux;
 on Windows and macOS, at `$HOME/.config/containers/auth.json`.
 
-When searching for the credential for a registry, the following files will be read in sequence until the valid credential is found:
+There is also a system-global `/etc/containers/auth.json` path and `/etc/containers/auth.d/` directory with drop-in per-repo files.
+When the current process is executing inside systemd as root, these paths will be preferred.
+Drop-ins always have higher precedence than the configuration file they refer to. Drop-ins are sorted in the lexicographic order. The drop-ins that are later in this order have higher precedence.
+
+When running as a user and searching for the credential for a registry, the following files will be read in sequence until the valid credential is found:
 first reading the primary (read/write) file, or the explicit override using an option of the calling application.
 If credentials are not present there,
 the search continues in `${XDG_CONFIG_HOME}/containers/auth.json` (usually `~/.config/containers/auth.json`), `$HOME/.docker/config.json`, `$HOME/.dockercfg`.
 
+If the current process is not running in systemd, but is running as root, the system-global `/etc/containers/auth.json` path  and `/etc/containers/auth.d/` directory will be read last.
+
 Except for the primary (read/write) file, other files are read-only unless the user, using an option of the calling application, explicitly points at it as an override.
 
+Note that the `/etc/containers/auth.json` file and drop-in files from `/etc/containers/auth.d/` directory must not be readable by group or world (i.e. mode `044`), or a fatal error will occur.
 
 ## FORMAT
 

pkg/docker/config/config.go

@@ -5,15 +5,18 @@ import (
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"io/fs"
 	"os"
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"strings"
 
 	"github.com/containers/image/v5/docker/reference"
 	"github.com/containers/image/v5/internal/multierr"
+	"github.com/containers/image/v5/internal/rootless"
 	"github.com/containers/image/v5/internal/set"
 	"github.com/containers/image/v5/pkg/sysregistriesv2"
 	"github.com/containers/image/v5/types"
@@ -35,6 +38,11 @@ type dockerConfigFile struct {
 	CredHelpers map[string]string           `json:"credHelpers,omitempty"`
 }
 
+// systemPath is the global auth path preferred for systemd services.
+// systemDir is the global auth directory with drop-ins preferred for systemd services.
+// These paths are also considered when the process is running as root ( not in systemd).
+var systemPath = authPath{path: filepath.FromSlash("/etc/containers/auth.json"), legacyFormat: false, requireUserOnly: true}
+var systemDir = filepath.FromSlash("/etc/containers/auth.d")
 var (
 	defaultPerUIDPathFormat = filepath.FromSlash("/run/containers/%d/auth.json")
 	xdgConfigHomePath       = filepath.FromSlash("containers/auth.json")
@@ -56,6 +64,8 @@ var (
 type authPath struct {
 	path         string
 	legacyFormat bool
+	// requireUserOnly will cause a fatal error if the file is readable by group or other
+	requireUserOnly bool
 }
 
 // newAuthPathDefault constructs an authPath in non-legacy format.
@@ -143,8 +153,21 @@ func GetAllCredentials(sys *types.SystemContext) (map[string]types.DockerAuthCon
 // The homeDir parameter should always be homedir.Get(), and is only intended to be overridden
 // by tests.
 func getAuthFilePaths(sys *types.SystemContext, homeDir string) []authPath {
+	runningInSystemd := os.Getenv("INVOCATION_ID") != ""
+	runningAsRoot := rootless.GetRootlessEUID() == 0
+	runningSystemdPrivileged := runningInSystemd && runningAsRoot
+
 	paths := []authPath{}
 	pathToAuth, userSpecifiedPath, err := getPathToAuth(sys)
+
+	// If we're in systemd, prefer the system global auth with drop-ins first.
+	insertedGlobalPath := false
+	if !userSpecifiedPath && runningSystemdPrivileged {
+		rootpaths, _ := walkAuthDir()
+		paths = append(paths, rootpaths...)
+		insertedGlobalPath = true
+	}
+
 	if err == nil {
 		paths = append(paths, pathToAuth)
 	} else {
@@ -169,10 +192,60 @@ func getAuthFilePaths(sys *types.SystemContext, homeDir string) []authPath {
 		paths = append(paths,
 			authPath{path: filepath.Join(homeDir, dockerLegacyHomePath), legacyFormat: true},
 		)
+		// If we didn't already insert the global path and drop-in files from the auth.d dir,
+		// do it at the end if we're running as root.
+		// This will ensure the same semantics for code executed as systemd units and run
+		// from an interactive shell (as root) as long as there's no user-root owned configs.
+		if !insertedGlobalPath && runningAsRoot {
+			rootpaths, _ := walkAuthDir()
+			paths = append(paths, rootpaths...)
+		}
 	}
 	return paths
 }
 
+// Walk the /etc/containers/auth.d/ directory and return the drop-in paths with global system path /etc/containers/auth.json.
+// Drop-ins always have higher precedence than the configuration file they refer to and are sorted in the lexicographic order.
+// The drop-ins that are later in this order have higher precedence.
+func walkAuthDir() ([]authPath, error) {
+	paths := []authPath{}
+	// append global system path
+	paths = append(paths, systemPath)
+
+	err := filepath.WalkDir(systemDir,
+		// WalkFunc to read additional configs
+		func(path string, d fs.DirEntry, err error) error {
+			switch {
+			case err != nil:
+				// return error (could be a permission problem)
+				return err
+			case d.IsDir():
+				if path != systemDir {
+					// make sure to not recurse into sub-directories
+					return filepath.SkipDir
+				}
+				// ignore directories
+				return nil
+			default:
+				// only add *.json files
+				if strings.HasSuffix(path, ".json") {
+					systemDropinPath := authPath{path: filepath.FromSlash(path), legacyFormat: false, requireUserOnly: true}
+					paths = append(paths, systemDropinPath)
+				}
+				return nil
+			}
+		},
+	)
+	// reverse the order so latest appended file from drop-ins has precedence
+	slices.Reverse(paths)
+	if err != nil && !os.IsNotExist(err) {
+		// Ignore IsNotExist errors: most systems won't have a auth.d directory.
+		return paths, fmt.Errorf("reading auth.d: %w", err)
+	}
+
+	return paths, nil
+}
+
 // GetCredentials returns the registry credentials matching key, appropriate for
 // sys and the users’ configuration.
 // If an entry is not found, an empty struct is returned.
@@ -567,7 +640,7 @@ func getPathToAuthWithOS(sys *types.SystemContext, goOS string) (authPath, bool,
 		}
 		// Note: RootForImplicitAbsolutePaths should not affect paths starting with $HOME
 		if sys.RootForImplicitAbsolutePaths != "" && goOS == "linux" {
-			return newAuthPathDefault(filepath.Join(sys.RootForImplicitAbsolutePaths, fmt.Sprintf(defaultPerUIDPathFormat, os.Getuid()))), false, nil
+			return newAuthPathDefault(filepath.Join(sys.RootForImplicitAbsolutePaths, fmt.Sprintf(defaultPerUIDPathFormat, rootless.GetRootlessEUID()))), false, nil
 		}
 	}
 	if goOS != "linux" {
@@ -587,7 +660,7 @@ func getPathToAuthWithOS(sys *types.SystemContext, goOS string) (authPath, bool,
 		} // else ignore err and let the caller fail accessing xdgRuntimeDirPath.
 		return newAuthPathDefault(filepath.Join(runtimeDir, xdgRuntimeDirPath)), false, nil
 	}
-	return newAuthPathDefault(fmt.Sprintf(defaultPerUIDPathFormat, os.Getuid())), false, nil
+	return newAuthPathDefault(fmt.Sprintf(defaultPerUIDPathFormat, rootless.GetRootlessEUID())), false, nil
 }
 
 // parse unmarshals the credentials stored in the auth.json file and returns it
@@ -596,14 +669,29 @@ func getPathToAuthWithOS(sys *types.SystemContext, goOS string) (authPath, bool,
 func (path authPath) parse() (dockerConfigFile, error) {
 	var fileContents dockerConfigFile
 
-	raw, err := os.ReadFile(path.path)
+	f, err := os.Open(path.path)
 	if err != nil {
 		if os.IsNotExist(err) {
 			fileContents.AuthConfigs = map[string]dockerAuthConfig{}
 			return fileContents, nil
 		}
 		return dockerConfigFile{}, err
 	}
+	defer f.Close()
+	if path.requireUserOnly {
+		st, err := f.Stat()
+		if err != nil {
+			return dockerConfigFile{}, fmt.Errorf("stat %s: %w", path.path, err)
+		}
+		perms := st.Mode().Perm()
+		if (perms & 044) != 0 {
+			return dockerConfigFile{}, fmt.Errorf("refusing to process %s with group or world read permissions", path.path)
+		}
+	}
+	raw, err := io.ReadAll(f)
+	if err != nil {
+		return dockerConfigFile{}, fmt.Errorf("reading %s: %w", path.path, err)
+	}
 
 	if path.legacyFormat {
 		if err = json.Unmarshal(raw, &fileContents.AuthConfigs); err != nil {