windows: do not convert unconfined seccomp path

unconfined is a special value and not a path as such it must not be
converted otherwise --security-opt seccomp=unconfined fails as it tries
to access a file called unconfined.

Fixes: 3e8b2d7d96 ("Fix seccomp profile path on Windows")
Fixes: #26855

Signed-off-by: Paul Holzinger <pholzing@redhat.com>

pkg/machine/e2e/basic_test.go

@@ -44,7 +44,8 @@ var _ = Describe("run basic podman commands", func() {
 		Expect(newImgs).To(Exit(0))
 		Expect(newImgs.outputToStringSlice()).To(HaveLen(1))
 
-		runAlp, err := mb.setCmd(bm.withPodmanCommand([]string{"run", TESTIMAGE, "cat", "/etc/os-release"})).run()
+		// seccomp option as regression test for https://github.com/containers/podman/issues/26855
+		runAlp, err := mb.setCmd(bm.withPodmanCommand([]string{"run", "--security-opt", "seccomp=unconfined", TESTIMAGE, "cat", "/etc/os-release"})).run()
 		Expect(err).ToNot(HaveOccurred())
 		Expect(runAlp).To(Exit(0))
 		Expect(runAlp.outputToString()).To(ContainSubstring("Alpine Linux"))

pkg/specgenutil/specgen.go

@@ -737,10 +737,15 @@ func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions
 		case "proc-opts":
 			s.ProcOpts = strings.Split(val, ",")
 		case "seccomp":
-			convertedPath, err := specgen.ConvertWinMountPath(val)
-			if err != nil {
-				// If the conversion fails, use the original path
-				convertedPath = val
+			convertedPath := val
+			// Do not try to convert special value "unconfined",
+			// https://github.com/containers/podman/issues/26855
+			if val != "unconfined" {
+				convertedPath, err = specgen.ConvertWinMountPath(val)
+				if err != nil {
+					// If the conversion fails, use the original path
+					convertedPath = val
+				}
 			}
 			s.SeccompProfilePath = convertedPath
 			s.Annotations[define.InspectAnnotationSeccomp] = convertedPath

pkg/specgenutil/specgenutil_windows_test.go

@@ -32,6 +32,7 @@ func TestSeccompProfilePath(t *testing.T) {
 		{`c`, cwd_wsl + "/c"},
 		{`\\computer\loc`, `\\computer\loc`},
 		{`\\.\drive\loc`, "/mnt/wsl/drive/loc"},
+		{"unconfined", "unconfined"},
 	}
 
 	f := func(secopt string) (*specgen.SpecGenerator, error) {