buildah: Use either openat2(RESOLVE_BENEATH) or don't follow links

[cgwalters]

I came across this bit of code that runs after the just-built image is mounted (to be passed to scanners):

https://github.com/konflux-ci/build-definitions/blame/38c6cd3f4733ed1ee638ce43bacd1096e3e5076d/task/buildah-remote/0.2/buildah-remote.yaml#L487

What would be a lot less ugly than just blowing away all symbolic links is using Linux's openat2 system call has RESOLVE_IN_ROOT which allows a process to safely inspect a distinct root and resolve any symlinks as if they're in that root.

Or perhaps simpler often, just...don't follow symlinks in whatever is doing this scanning. (Why would it traverse symlinks?)

[chmeliik]

We delete the symlinks from the mounted container filesystem before running syft and/or the Java SBOM thingy on it

build-definitions/task/buildah/0.2/buildah.yaml

Line 519 in 421ee9f

/opt/jboss/container/java/run/run-java.sh analyse-dependencies path $(cat /shared/container_path) -s $(workspaces.source.path)/sbom-image.json --task-run-name $(context.taskRun.name) --publishers $(results.SBOM_JAVA_COMPONENTS_COUNT.path)

For syft, the better solution would be to run it on an oci-archive: of the image rather than the exported filesystem. The Java thingy doesn't support that, but it's also pretty much dead code at this point, AFAIK nobody uses the Java support this way anymore. Once we get rid of that, we can change the task to run syft on an oci-archive: and this will become irrelevant

Until then, this is a minor issue and IMO not worth solving (it doesn't affect anything, the exported filesystem never leaves the buildah task pod)