images/tests: Globally-writeable /etc/passwd
images/tests: Globally-writeable /etc/passwd

This lets us SSH from the teardown container into the cluster without
hitting:

  $ ssh -A core@$bootstrap_ip
  No user exists for uid 1051910000

OpenSSH has a very early getpwuid call [1] with no provision for
bypassing via HOME or USER environment variables like we did for Bazel
[2].  OpenShift runs with the random UIDs by default [3]:

  By default, all containers that we try and launch within OpenShift,
  are set blocked from “RunAsAny” which basically means that they are
  not allowed to use a root user within the container.  This prevents
  root actions such as chown or chmod from being run and is a sensible
  security precaution as, should a user be able to perform a local
  exploit to break out of the container, then they would not be
  running as root on the underlying container host.  NB what about
  user-namespaces some of you are no doubt asking, these are
  definitely coming but the testing/hardening process is taking a
  while and whilst companies such as Red Hat are working hard in this
  space, there is still a way to go until they are ready for the
  mainstream.

while Kubernetes sorts out user namespacing [4].  Despite the high
UIDs, all users on the cluster are GID 0, so the g+w is sufficient
(vs. a+w), and maybe this mitigates concerns about increased
writability for such an important file.  The main mitigation is that
these are throw-away CI containers, and not long-running production
containers where we are concerned about malicious entry.

A more polished fix has landed in CRI-O [5], but the CI cluster is
stuck on OpenShift 3.11 and Docker at the moment.

Our SSH usecase is for gathering logs in the teardown container [6],
but we've been using the tests image for both tests and teardown since
b16dcfc7ce (images/tests/Dockerfile*: Install gzip for compressing
logs, 2019-02-19, #22094).

[1]: https://github.com/openssh/openssh-portable/blob/V_7_4_P1/ssh.c#L577
[2]: https://github.com/openshift/release/pull/1185
[3]: https://blog.openshift.com/getting-any-docker-image-running-in-your-own-openshift-cluster/
[4]: https://github.com/kubernetes/enhancements/issues/127
[5]: https://github.com/cri-o/cri-o/pull/2022
[6]: https://github.com/openshift/release/pull/3475

sallyom/origin,akram/origin,mfojtik/origin,akram/origin,coreydaley/origin,jim-minter/origin,ingvagabund/origin,enj/origin,bparees/origin,anpingli/origin,csrwng/origin,mkumatag/origin,sjug/origin,Miciah/origin,soltysh/origin,nak3/origin,hroyrh/origin,ironcladlou/origin,anpingli/origin,sjug/origin,tnozicka/origin,xiuwang/origin,dinhxuanvu/origin,spadgett/origin,dinhxuanvu/origin,sdminonne/origin,tnozicka/origin,gabemontero/origin,openshift/origin,dinhxuanvu/origin,spadgett/origin,pecameron/origin,pecameron/origin,jsafrane/origin,ingvagabund/origin,enj/origin,mfojtik/origin,pecameron/origin,JacobTanenbaum/origin,Miciah/origin,openshift/origin,sdminonne/origin,anpingli/origin,tnozicka/origin,sallyom/origin,akram/origin,mfojtik/origin,gabemontero/origin,ingvagabund/origin,mkumatag/origin,coreydaley/origin,mahak/origin,mahak/origin,nak3/origin,pweil-/origin,hroyrh/origin,jeremyeder/origin,jsafrane/origin,jeremyeder/origin,deads2k/origin,spadgett/origin,sdminonne/origin,jeremyeder/origin,mkumatag/origin,tnozicka/origin,jsafrane/origin,hroyrh/origin,gabemontero/origin,JacobTanenbaum/origin,deads2k/origin,openshift/origin,csrwng/origin,soltysh/origin,dinhxuanvu/origin,coreydaley/origin,jim-minter/origin,sferich888/origin,ironcladlou/origin,sallyom/origin,jeremyeder/origin,sferich888/origin,pweil-/origin,enj/origin,xiuwang/origin,dinhxuanvu/origin,tnozicka/origin,spadgett/origin,bparees/origin,tnozicka/origin,jeremyeder/origin,soltysh/origin,jim-minter/origin,xiuwang/origin,pweil-/origin,deads2k/origin,Miciah/origin,nak3/origin,JacobTanenbaum/origin,ironcladlou/origin,csrwng/origin,sferich888/origin,spadgett/origin,mahak/origin,sjug/origin,bparees/origin