cli: Handle PermissionDenied when reading /proc/1/ns/ipc

In restricted build environments such as Tekton/Buildah containers,
/proc/1/ns/ipc can be masked even when the process has CAP_SYS_ADMIN.
The read_link() call fails with EACCES, which causes bootc to exit
with a fatal error.

Handle PermissionDenied by logging at debug level and skipping the
IPC namespace join, consistent with the existing CAP_SYS_ADMIN gate.

Fixes: d250000
Assisted-by: OpenCode (Claude Opus 4.6)
Signed-off-by: Joseph Marrero Corchado <jmarrero@redhat.com>

Author: jmarrero

crates/lib/src/cli.rs

@@ -1595,6 +1595,9 @@ async fn usroverlay(access_mode: FilesystemOverlayAccessMode) -> Result<()> {
 ///
 /// Requires `CAP_SYS_ADMIN` (needed for `setns()`); silently skipped when
 /// running unprivileged (e.g. during RPM build for manpage generation).
+/// Also skipped when `/proc/1/ns/ipc` is not accessible, which can happen
+/// in restricted build environments (e.g. Tekton/Buildah containers) where
+/// `/proc` is masked even for processes with `CAP_SYS_ADMIN`.
 fn join_host_ipc_namespace() -> Result<()> {
     let caps = rustix::thread::capabilities(None).context("capget")?;
     if !caps
@@ -1603,7 +1606,14 @@ fn join_host_ipc_namespace() -> Result<()> {
     {
         return Ok(());
     }
-    let ns_pid1 = std::fs::read_link("/proc/1/ns/ipc").context("reading /proc/1/ns/ipc")?;
+    let ns_pid1 = match std::fs::read_link("/proc/1/ns/ipc") {
+        Ok(v) => v,
+        Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => {
+            tracing::debug!("Skipping IPC namespace join: /proc/1/ns/ipc not accessible: {e}");
+            return Ok(());
+        }
+        Err(e) => return Err(e).context("reading /proc/1/ns/ipc"),
+    };
     let ns_self = std::fs::read_link("/proc/self/ns/ipc").context("reading /proc/self/ns/ipc")?;
     if ns_pid1 != ns_self {
         let pid1ipcns = std::fs::File::open("/proc/1/ns/ipc").context("open pid1 ipcns")?;