Fix missing setuid flags on COPY --from=build operation

[tonydelanuez]

Fixes #2075

When a file with the setuid bit is copied from one stage to another the permissions were not copied over properly after
setting ownership on directory and the file itself. This PR ensures that the file permissions are synced after ownership is set on the file/directory which fixes the regression in SUID bit behavior.

• Includes unit tests
• Adds integration tests if needed.

Images available:

docker.io/tonydelanuez/kaniko-executor:latest
docker.io/tonydelanuez/kaniko-executor:debug
docker.io/tonydelanuez/kaniko-executor:slim
docker.io/tonydelanuez/kaniko-warmer:latest

Reviewer Notes

• The code flow looks good.
• Unit tests and or integration tests added.

Release Notes

- fixes a regression in file permissions when copying files

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

For more information, open the CLA check for this pull request.

[imjasonh]

Thanks for including an integration test! 👍

[tonydelanuez]

Judging by some other PRs with similar failures I think y'all had some broken integration tests, would you mind re-running builds for this PR?

Thanks!

[imjasonh]

This seems to only test that the existence of chowned/chmoded files doesn't break this build, but AFAIK it doesn't do any checks to ensure the resulting file in the output image is actually chowned/chmoded as expected. Can you add some RUN commands here that check that the permissions are set?

[tonydelanuez]

Sure can; added a run command to test for setuid on the binary.
Bails as-expected on a binary that doesn't have setuid unmodified (/usr/bin/top in example below)

INFO[0005] Unpacking rootfs as cmd COPY --from=build ["/usr/local/bin/top1", "/usr/local/bin/"] requires it. 
INFO[0006] COPY --from=build ["/usr/local/bin/top1", "/usr/local/bin/"] 
INFO[0006] Taking snapshot of files...                  
INFO[0006] RUN [ -u /usr/bin/top ]                      
INFO[0006] Taking snapshot of full filesystem...        
INFO[0006] cmd: /bin/sh                                 
INFO[0006] args: [-c [ -u /usr/bin/top ]]               
INFO[0006] Running: [/bin/sh -c [ -u /usr/bin/top ]]    
error building image: error building stage: failed to execute command: waiting for process to exit: exit status 1

With the copied binary from the build:

INFO[0006] Taking snapshot of full filesystem...        
INFO[0006] cmd: /bin/sh                                 
INFO[0006] args: [-c [ -u /usr/local/bin/top1 ]]        
INFO[0006] Running: [/bin/sh -c [ -u /usr/local/bin/top1 ]] 
INFO[0006] Taking snapshot of full filesystem...        
INFO[0007] No files were changed, appending empty layer to config. No layer added to image. 
INFO[0007] LABEL   description="Testing setuid behavior in Kaniko" 
INFO[0007] Applying label description=Testing setuid behavior in Kaniko 
INFO[0007] Pushing image to docker.io/tonydelanuez/suid-test 
INFO[0008] Pushed index.docker.io/tonydelanuez/suid-test@sha256:237464e4442d995338c21eef9b2362a864c71d24922280cebe7640160945f1d1