Repository: containers/podman (Go)

Issue:
Error: opening seccomp profile failed: open /mnt/c/Some-directory/unconfined: no such file or directory on Windows
### Issue Description

Using `--security-opt seccomp=unconfined` fails on Windows:

~~~
❯ podman run --rm -it --security-opt seccomp=unconfined quay.io/podman/hello
Trying to pull quay.io/podman/hello:latest...
Getting image source signatures
Copying blob sha256:81df7ff16254ed9756e27c8de9ceb02a9568228fccadbf080f41cc5eb5118a44
Copying config sha256:5dd467fce50b56951185da365b5feee75409968cbab5767b9b59e325fb2ecbc0
Writing manifest to image destination
Error: opening seccomp profile failed: open /mnt/c/Some-directory/unconfined: no such file or directory
Exception: podman exited with 125
  [tty 110]:1:1-74: podman run --rm -it --security-opt seccomp=unconfined quay.io/podman/hello
~~~


### Steps to reproduce the issue

Steps to reproduce the issue:

#### 1. First, install Podman v5.6.0 using your preferred method:

~~~
❯ scoop install podman
Installing 'podman' (5.6.0) [64bit] from 'main' bucket
podman-5.6.0-setup.exe (26,4 MB) [======================================================================================] 100%
Checking hash of podman-5.6.0-setup.exe ... ok.
Running pre_install script...done.
Running installer script...done.
Linking ~\Scoop\apps\podman\current => ~\Scoop\apps\podman\5.6.0
Creating shim for 'podman'.
Persisting data
Persisting config
Persisting connections
Running post_install script...done.
'podman' (5.6.0) was installed successfully!
~~~

#### 2. Then, initialize and start a default machine:

~~~
❯ podman machine init
Looking up Podman Machine image at quay.io/podman/machine-os:5.6 to create VM
Getting image source signatures
Copying blob 0491a61133f9 done   |
Copying config 44136fa355 done   |
Writing manifest to image destination
0491a61133f94e8645c562f31255dc37d5fe0bf45750ce5e227fd86f6fb5cfe2
Extracting compressed file: podman-machine-default-amd64: done
Importing operating system into WSL (this may take a few minutes on a new WSL install)...
La operación se completó correctamente.
Configuring system...
Machine init complete
To start your machine run:

        podman machine start

❯ podman machine start
Starting machine "podman-machine-default"

This machine is currently configured in rootless mode. If your containers
require root permissions (e.g. ports < 1024), or if you run into compatibility
issues with non-podman clients, you can switch using the following command:

        podman machine set --rootful

API forwarding listening on: npipe:////./pipe/docker_engine

Docker API clients default to this address. You do not need to set DOCKER_HOST.
Machine "podman-machine-default" started successfully

~~~

#### 3. Finally, reproduce the issue with a minimal example:

~~~
❯ mkdir C:\Some-directory

❯ cd C:\Some-directory

❯ podman run --rm -it --security-opt seccomp=unconfined quay.io/podman/hello
Trying to pull quay.io/podman/hello:latest...
Getting image source signatures
Copying blob sha256:81df7ff16254ed9756e27c8de9ceb02a9568228fccadbf080f41cc5eb5118a44
Copying config sha256:5dd467fce50b56951185da365b5feee75409968cbab5767b9b59e325fb2ecbc0
Writing manifest to image destination
Error: opening seccomp profile failed: open /mnt/c/Some-directory/unconfined: no such file or directory
Exception: podman exited with 125
  [tty 110]:1:1-74: podman run --rm -it --security-opt seccomp=unconfined quay.io/podman/hello

~~~


### Describe the results you received

The underlying issue is that Podman interprets `unconfined` as a file path on the Windows host:

~~~
C:\Some-directory\unconfined
~~~

### Describe the results you expected

I would expect Podman to correctly handle `seccomp=unconfined`, disabling seccomp confinement for the container.

### podman info output

```yaml
I'm unable to run podman info, because currently I downgraded to v5.5.2 to check it run without the error.

My *podman version is `v5.6.0`*, and my host is *Windows 10.0.26100.4349*.
```

### Podman in a container

No

### Privileged Or Rootless

None

### Upstream Latest Release

Yes

### Additional environment details

Using WSL2 (updated today):

~~~
❯ wsl --version
Versión de WSL: 2.5.10.0
Versión de kernel: 6.6.87.2-1
Versión de WSLg: 1.0.66
Versión de MSRDC: 1.2.6074
Versión de Direct3D: 1.611.1-81528511
Versión de DXCore: 10.0.26100.1-240331-1435.ge-release
Versión de Windows: 10.0.26100.4349
~~~

### Additional information

This seems to be a consequence of fixing #26558, possibly at /pkg/specgenutil/specgen.go#L740.


Discussion:

Patch:
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
index 2a3171e8c33..791110312c7 100644
--- a/pkg/specgenutil/specgen.go
+++ b/pkg/specgenutil/specgen.go
@@ -737,10 +737,15 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 		case "proc-opts":
 			s.ProcOpts = strings.Split(val, ",")
 		case "seccomp":
-			convertedPath, err := specgen.ConvertWinMountPath(val)
-			if err != nil {
-				// If the conversion fails, use the original path
-				convertedPath = val
+			convertedPath := val
+			// Do not try to convert special value "unconfined",
+			// https://github.com/containers/podman/issues/26855
+			if val != "unconfined" {
+				convertedPath, err = specgen.ConvertWinMountPath(val)
+				if err != nil {
+					// If the conversion fails, use the original path
+					convertedPath = val
+				}
 			}
 			s.SeccompProfilePath = convertedPath
 			s.Annotations[define.InspectAnnotationSeccomp] = convertedPath


Test patch:
diff --git a/pkg/machine/e2e/basic_test.go b/pkg/machine/e2e/basic_test.go
index 499d2730b18..22a878311b2 100644
--- a/pkg/machine/e2e/basic_test.go
+++ b/pkg/machine/e2e/basic_test.go
@@ -44,7 +44,8 @@ var _ = Describe("run basic podman commands", func() {
 		Expect(newImgs).To(Exit(0))
 		Expect(newImgs.outputToStringSlice()).To(HaveLen(1))
 
-		runAlp, err := mb.setCmd(bm.withPodmanCommand([]string{"run", TESTIMAGE, "cat", "/etc/os-release"})).run()
+		// seccomp option as regression test for https://github.com/containers/podman/issues/26855
+		runAlp, err := mb.setCmd(bm.withPodmanCommand([]string{"run", "--security-opt", "seccomp=unconfined", TESTIMAGE, "cat", "/etc/os-release"})).run()
 		Expect(err).ToNot(HaveOccurred())
 		Expect(runAlp).To(Exit(0))
 		Expect(runAlp.outputToString()).To(ContainSubstring("Alpine Linux"))
diff --git a/pkg/specgenutil/specgenutil_windows_test.go b/pkg/specgenutil/specgenutil_windows_test.go
index 88c97e3bda1..e011d884305 100644
--- a/pkg/specgenutil/specgenutil_windows_test.go
+++ b/pkg/specgenutil/specgenutil_windows_test.go
@@ -32,6 +32,7 @@ func TestSeccompProfilePath(t *testing.T) {
 		{`c`, cwd_wsl + "/c"},
 		{`\\computer\loc`, `\\computer\loc`},
 		{`\\.\drive\loc`, "/mnt/wsl/drive/loc"},
+		{"unconfined", "unconfined"},
 	}
 
 	f := func(secopt string) (*specgen.SpecGenerator, error) {