validate: Test config.json and rootfs sibling-hood

Test the spec's [1]:

  While these artifacts MUST all be present in a single directory on
  the local filesystem, ...

which is a condition it imposes on config.json and the directory
referenced by root.path.

I think we should drop that restriction from the spec, but my attempt
to remove the restriction was rejected [2].  If a future spec drops
the restriction, we can revert this commit.

Using path/filepath for the path manipulation will break when
validating cross-platform configs (e.g. trying to validate a Windows
bundle on a Linux machine).  But that's a bigger issue than this
commit, so I've left it alone for now.

[1]: https://github.com/opencontainers/runtime-spec/blob/v1.0.0-rc5/bundle.md#container-format
[2]: opencontainers/runtime-spec#469

Signed-off-by: W. Trevor King <wking@tremily.us>

Author: wking

validate/validate.go

@@ -115,11 +115,23 @@ func (v *Validator) CheckAll() (msgs []string) {
 func (v *Validator) CheckRootfsPath() (msgs []string) {
 	logrus.Debugf("check rootfs path")
 
+	absBundlePath, err := filepath.Abs(v.bundlePath)
+	if err != nil {
+		msgs = append(msgs, fmt.Sprintf("unable to convert %q to an absolute path", v.bundlePath))
+	}
+
 	var rootfsPath string
+	var absRootPath string
 	if filepath.IsAbs(v.spec.Root.Path) {
 		rootfsPath = v.spec.Root.Path
+		absRootPath = filepath.Clean(rootfsPath)
 	} else {
+		var err error
 		rootfsPath = filepath.Join(v.bundlePath, v.spec.Root.Path)
+		absRootPath, err = filepath.Abs(rootfsPath)
+		if err != nil {
+			msgs = append(msgs, fmt.Sprintf("unable to convert %q to an absolute path", rootfsPath))
+		}
 	}
 
 	if fi, err := os.Stat(rootfsPath); err != nil {
@@ -128,6 +140,11 @@ func (v *Validator) CheckRootfsPath() (msgs []string) {
 		msgs = append(msgs, fmt.Sprintf("The root path %q is not a directory.", rootfsPath))
 	}
 
+	rootParent := filepath.Dir(absRootPath)
+	if absRootPath == string(filepath.Separator) || rootParent != absBundlePath {
+		msgs = append(msgs, fmt.Sprintf("root.path is %q, but it MUST be a child of %q", v.spec.Root.Path, absBundlePath))
+	}
+
 	return
 
 }