libct: don't send config to nsexec when joining an existing timens

[lifubang]

Fix #4635

When we exec a process in a container has private timens, we need to
join the init process's timens path, so, we should not send the timens
config to nsexec, otherwise, runc will try to update the process's time
ns configuration when joining the timens path.
We should configure the process's timens offset only when we need to
create new time namespace, we shouldn't do it if we are joining an
existing time namespace.

[kolyshkin]

Nice find, nice fix, thanks! Just a single nit about the test case.

Also, we might need to backport it to 1.2.

[cyphar]

Unless I'm mistaken this will stop us from detecting broken configurations (i.e. configurations with timens offsets configured but not joining a time namespace). Of course it's easy to add a step to the validator but the previous version already did validation by getting an error from the kernel if appropriate.

Also, it is theoretically possible for someone to want to join a timens that hasn't been used yet and so configuring a timens offset of a timens we didn't create (while a little weird) is perfectly valid.

Personally, I think the old behaviour was better -- the user gets the same error from the kernel they would get if they tried to apply an incorrect configuration manually.

[lifubang]

Unless I'm mistaken this will stop us from detecting broken configurations (i.e. configurations with timens offsets configured but not joining a time namespace). Of course it's easy to add a step to the validator but the previous version already did validation by getting an error from the kernel if appropriate.

Also, it is theoretically possible for someone to want to join a timens that hasn't been used yet and so configuring a timens offset of a timens we didn't create (while a little weird) is perfectly valid.

Personally, I think the old behaviour was better -- the user gets the same error from the kernel they would get if they tried to apply an incorrect configuration manually.

Yes, make sense, I changed the logic to the same way as USERNS.

runc/libcontainer/container_linux.go

Lines 1082 to 1084 in ad09197

	// write namespace paths only when we are not joining an existing user ns
	_, joinExistingUser := nsMaps[configs.NEWUSER]
	if !joinExistingUser {

[cyphar]

It is theoretically possible someone will want to be able to do this, but I guess it's a fairly esoteric thing.

[rata]

LGTM, thanks!