[0intro]

fsdev_init reads the local file systems from /etc/mtab, which on
Linux is a link to /proc/self/mounts. containerd 1.7.18 and
podman 1.6.4 create containers without the link, and in them every
object with recurse_file_system="local" comes out "does not exist":
a check that no such file exists passes.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[jamesconwaydev]

I reproduced this through oscap oval eval rather than the unit test. Fedora 44 arm64 container, main at 099cd84 against this branch at 26c2514. The OVAL is a file_test with check_existence="at_least_one_exists", and a file_object with recurse_file_system="local" on a directory where the file does exist:

/etc/mtab	main	this branch
normal symlink	true	true
removed	false, object flag does not exist	true, flag complete
dangling symlink	false	true
empty regular file	false	false

The dangling link is covered too. An empty regular file still gives false, which looks out of scope here but seemed worth mentioning.

ctest -R fsdev passes on the branch. As far as I can see fsdev.c is the only place reading the mtab path, since partition_probe.c and selinuxboolean_probe.c use /proc/mounts.

I removed the link by hand instead of running containerd 1.7.18 or podman 1.6.4, so that part I'm taking from your description.