fix symlink handling in checkpoint restore

Under normal circumstances this is not a problem as the archive file
created podman container checkpoint will no create symlinks.
However if a user passes a custom archive they could contain symlinks
that point outside our root. To resolve them within the root use
securejoin.

Note this is not a security problem because the full archive must be
trusted by a user to begin with as it contain the full container config.

Fixes: #27977

Signed-off-by: Paul Holzinger <pholzing@redhat.com>
(cherry picked from commit abb5120)
Signed-off-by: Paul Holzinger <pholzing@redhat.com>

Author: Luap99

pkg/checkpoint/crutils/checkpoint_restore_utils.go

@@ -11,6 +11,7 @@ import (
 
 	metadata "github.com/checkpoint-restore/checkpointctl/lib"
 	"github.com/checkpoint-restore/go-criu/v7/stats"
+	securejoin "github.com/cyphar/filepath-securejoin"
 	"github.com/opencontainers/selinux/go-selinux/label"
 	"go.podman.io/storage/pkg/archive"
 )
@@ -87,7 +88,11 @@ func CRRemoveDeletedFiles(id, baseDirectory, containerRootDirectory string) erro
 	for _, deleteFile := range deletedFiles {
 		// Using RemoveAll as deletedFiles, which is generated from 'podman diff'
 		// lists completely deleted directories as a single entry: 'D /root'.
-		if err := os.RemoveAll(filepath.Join(containerRootDirectory, deleteFile)); err != nil {
+		path, err := securejoin.SecureJoin(containerRootDirectory, deleteFile)
+		if err != nil {
+			return fmt.Errorf("failed to resolve path %q in container %s: %w", deleteFile, id, err)
+		}
+		if err := os.RemoveAll(path); err != nil {
 			return fmt.Errorf("failed to delete files from container %s during restore: %w", id, err)
 		}
 	}