Merge pull request #13 from A3S-Lab/feat/user-time-namespaces

feat(executor): create user and time namespaces

Author: ZhiXiao-Lin

.github/scripts/native-linux-smoke.sh

@@ -2,9 +2,45 @@
 
 set -euo pipefail
 
-runner_temp="${RUNNER_TEMP:?RUNNER_TEMP must identify the CI job temporary directory}"
-run_id="${GITHUB_RUN_ID:?GITHUB_RUN_ID must identify the CI run}"
-run_attempt="${GITHUB_RUN_ATTEMPT:?GITHUB_RUN_ATTEMPT must identify the CI attempt}"
+qualification_root=""
+saved_kvm="/dev/a3s-oci-kvm-$$"
+kvm_original_moved=false
+kvm_test_directory_created=false
+
+restore_host() {
+  local command_status=$?
+  local cleanup_status=0
+  local status
+  trap - EXIT
+  set +e
+
+  if [[ "$kvm_test_directory_created" == true && -d /dev/kvm ]]; then
+    sudo rmdir /dev/kvm
+    status=$?
+    if ((status != 0)); then
+      cleanup_status=$status
+    fi
+  fi
+  if [[ -n "$qualification_root" && -d "$qualification_root" ]]; then
+    sudo rm -rf --one-file-system "$qualification_root"
+    status=$?
+    if ((status != 0)); then
+      cleanup_status=$status
+    fi
+  fi
+  if [[ "$kvm_original_moved" == true ]]; then
+    sudo mv "$saved_kvm" /dev/kvm
+    status=$?
+    if ((status != 0)); then
+      cleanup_status=$status
+    fi
+  fi
+  if ((command_status != 0)); then
+    exit "$command_status"
+  fi
+  exit "$cleanup_status"
+}
+trap restore_host EXIT
 
 sudo apt-get update
 sudo apt-get install --yes busybox-static jq
@@ -23,24 +59,83 @@ jq --exit-status \
    )' \
   <<<"$features" >/dev/null
 
-bundle="$runner_temp/a3s-native-bundle"
-bundle_b="$runner_temp/a3s-native-bundle-b"
-work_parent="$runner_temp/a3s-native-work"
-mkdir -p "$bundle/rootfs/bin" "$bundle_b/rootfs/bin" "$work_parent"
+qualification_root="$(mktemp -d /var/tmp/a3s-oci-native.XXXXXXXX)"
+bundle="$qualification_root/bundle"
+bundle_b="$qualification_root/bundle-b"
+work_parent="$qualification_root/work"
+mkdir -p \
+  "$bundle/rootfs/bin" "$bundle/rootfs/proc" \
+  "$bundle_b/rootfs/bin" "$bundle_b/rootfs/proc" \
+  "$work_parent"
 for candidate in "$bundle" "$bundle_b"; do
   cp fixtures/native-linux/config.json "$candidate/config.json"
   cp "$(command -v busybox)" "$candidate/rootfs/bin/busybox"
   ln -s busybox "$candidate/rootfs/bin/sh"
 done
+sudo chown -R 0:0 "$qualification_root"
+sudo chmod 0755 "$qualification_root"
+
+report_native_failure() {
+  local rootfs="$1"
+  local status
+
+  printf '%s\n' 'Native Linux host diagnostics:'
+  uname -a || true
+  printf 'LSM stack: '
+  cat /sys/kernel/security/lsm 2>/dev/null || printf '%s\n' unavailable
+  printf 'Runner profile: '
+  cat /proc/self/attr/current 2>/dev/null || printf '%s\n' unavailable
+  findmnt --target / --output TARGET,SOURCE,FSTYPE,OPTIONS --noheadings || true
+  findmnt --target "$rootfs" \
+    --output TARGET,SOURCE,FSTYPE,OPTIONS --noheadings || true
+  namei --long "$rootfs" || true
+  sudo sh -c \
+    'grep -E "^(NoNewPrivs|Seccomp|Cap(Inh|Prm|Eff|Bnd|Amb)):" /proc/self/status' ||
+    true
+  if sudo timeout 10s unshare \
+      --user --map-root-user --mount --fork -- \
+      sh -c \
+        'mount --make-rprivate / && mount --rbind "$1" "$1"' \
+        sh "$rootfs"; then
+    printf '%s\n' 'Combined user/mount namespace rbind probe: succeeded'
+  else
+    status=$?
+    printf 'Combined user/mount namespace rbind probe: failed (%s)\n' "$status"
+  fi
+
+  if sudo timeout 10s unshare \
+      --user --map-root-user --fork -- \
+      unshare --mount --fork -- \
+      sh -c \
+        'mount --make-rprivate / && mount --rbind "$1" "$1"' \
+        sh "$rootfs"; then
+    printf '%s\n' 'Sequential user-then-mount namespace rbind probe: succeeded'
+  else
+    status=$?
+    printf 'Sequential user-then-mount namespace rbind probe: failed (%s)\n' \
+      "$status"
+  fi
+
+  sudo dmesg --ctime 2>/dev/null | tail -n 120 || true
+}
 
 run_smoke() {
   local expected_kvm_present="$1"
   local output
-  output="$(sudo "$PWD/target/debug/a3s-oci" native-linux-smoke \
-    --agent "$PWD/target/debug/a3s-oci-agent" \
-    --bundle "$bundle" \
-    --work-parent "$work_parent")"
+  local status
+  if output="$(sudo "$PWD/target/debug/a3s-oci" native-linux-smoke \
+      --agent "$PWD/target/debug/a3s-oci-agent" \
+      --bundle "$bundle" \
+      --work-parent "$work_parent")"; then
+    status=0
+  else
+    status=$?
+  fi
   printf '%s\n' "$output"
+  if ((status != 0)); then
+    report_native_failure "$bundle/rootfs"
+    return "$status"
+  fi
   jq --exit-status \
     --argjson expected "$expected_kvm_present" \
     '.schema_version == "a3s.oci.native-linux-smoke.v2"
@@ -76,13 +171,22 @@ run_smoke() {
 run_multi_container_smoke() {
   local expected_kvm_present="$1"
   local output
-  output="$(sudo "$PWD/target/debug/a3s-oci" \
-    native-linux-multi-container-smoke \
-    --agent "$PWD/target/debug/a3s-oci-agent" \
-    --bundle-a "$bundle" \
-    --bundle-b "$bundle_b" \
-    --work-parent "$work_parent")"
+  local status
+  if output="$(sudo "$PWD/target/debug/a3s-oci" \
+      native-linux-multi-container-smoke \
+      --agent "$PWD/target/debug/a3s-oci-agent" \
+      --bundle-a "$bundle" \
+      --bundle-b "$bundle_b" \
+      --work-parent "$work_parent")"; then
+    status=0
+  else
+    status=$?
+  fi
   printf '%s\n' "$output"
+  if ((status != 0)); then
+    report_native_failure "$bundle/rootfs"
+    return "$status"
+  fi
   jq --exit-status \
     --argjson expected "$expected_kvm_present" \
     '.schema_version == "a3s.oci.native-linux-multi-container-smoke.v2"
@@ -144,13 +248,22 @@ run_multi_container_smoke() {
 run_fault_cleanup() {
   local phase
   local output
+  local status
   for phase in after-create after-start after-kill; do
-    output="$(sudo "$PWD/target/debug/a3s-oci" native-linux-fault-cleanup \
-      --agent "$PWD/target/debug/a3s-oci-agent" \
-      --bundle "$bundle" \
-      --work-parent "$work_parent" \
-      --fault-after "$phase")"
+    if output="$(sudo "$PWD/target/debug/a3s-oci" native-linux-fault-cleanup \
+        --agent "$PWD/target/debug/a3s-oci-agent" \
+        --bundle "$bundle" \
+        --work-parent "$work_parent" \
+        --fault-after "$phase")"; then
+      status=0
+    else
+      status=$?
+    fi
     printf '%s\n' "$output"
+    if ((status != 0)); then
+      report_native_failure "$bundle/rootfs"
+      return "$status"
+    fi
     jq --exit-status --arg phase "$phase" \
       '.schema_version == "a3s.oci.native-linux-fault-cleanup.v2"
        and .platform == "linux" and .status == "available"
@@ -188,24 +301,15 @@ run_fault_cleanup() {
   done
 }
 
-saved_kvm="/dev/a3s-oci-kvm-${run_id}-${run_attempt}"
-restore_kvm() {
-  if [[ -d /dev/kvm ]]; then
-    sudo rmdir /dev/kvm
-  fi
-  if [[ -e "$saved_kvm" || -L "$saved_kvm" ]]; then
-    sudo mv "$saved_kvm" /dev/kvm
-  fi
-}
-trap restore_kvm EXIT
-
 if [[ -e /dev/kvm || -L /dev/kvm ]]; then
   sudo mv /dev/kvm "$saved_kvm"
+  kvm_original_moved=true
 fi
 
 run_smoke false
 run_multi_container_smoke false
 run_fault_cleanup
 sudo mkdir /dev/kvm
+kvm_test_directory_created=true
 run_smoke true
 run_multi_container_smoke true

.github/workflows/ci.yml

@@ -325,6 +325,7 @@ jobs:
           mkdir -p "$container_rootfs"
           cp fixtures/utility-vm/config.json "$bundle_dir/config.json"
           tar -xzf "$rootfs_archive" -C "$container_rootfs"
+          sudo chown -R 0:0 "$container_rootfs"
 
           endpoint_baseline="$(
             find /private/tmp -maxdepth 1 \
@@ -468,6 +469,7 @@ jobs:
           mkdir -p "$bundle_b/rootfs"
           cp fixtures/utility-vm/config.json "$bundle_b/config.json"
           tar -xzf "$rootfs_archive" -C "$bundle_b/rootfs"
+          sudo chown -R 0:0 "$bundle_b/rootfs"
 
           endpoint_baseline="$(
             find /private/tmp -maxdepth 1 \

README.md

@@ -148,10 +148,11 @@ cargo build -p a3s-oci-agent -p a3s-oci-cli
 demo_root="$(mktemp -d)"
 bundle="$demo_root/bundle"
 work_parent="$demo_root/work"
-mkdir -p "$bundle/rootfs/bin" "$work_parent"
+mkdir -p "$bundle/rootfs/bin" "$bundle/rootfs/proc" "$work_parent"
 cp fixtures/native-linux/config.json "$bundle/config.json"
 cp "$(command -v busybox)" "$bundle/rootfs/bin/busybox"
 ln -s busybox "$bundle/rootfs/bin/sh"
+sudo chown -R 0:0 "$bundle/rootfs"
 
 sudo target/debug/a3s-oci native-linux-smoke \
   --agent "$PWD/target/debug/a3s-oci-agent" \
@@ -170,10 +171,11 @@ Create a second distinct bundle to run the multi-container gate:
 
 ```sh
 bundle_b="$demo_root/bundle-b"
-mkdir -p "$bundle_b/rootfs/bin"
+mkdir -p "$bundle_b/rootfs/bin" "$bundle_b/rootfs/proc"
 cp fixtures/native-linux/config.json "$bundle_b/config.json"
 cp "$(command -v busybox)" "$bundle_b/rootfs/bin/busybox"
 ln -s busybox "$bundle_b/rootfs/bin/sh"
+sudo chown -R 0:0 "$bundle_b/rootfs"
 
 sudo target/debug/a3s-oci native-linux-multi-container-smoke \
   --agent "$PWD/target/debug/a3s-oci-agent" \
@@ -314,6 +316,7 @@ bundle="$rootfs_dir/rootfs/var/lib/a3s-oci-smoke/bundle"
 mkdir -p "$bundle/rootfs"
 cp fixtures/utility-vm/config.json "$bundle/config.json"
 tar -xzf "$rootfs_archive" -C "$bundle/rootfs"
+sudo chown -R 0:0 "$bundle/rootfs"
 
 target/debug/a3s-oci oci-vm-smoke \
   --shim "$smoke_dir/a3s-oci-krun-shim" \
@@ -337,6 +340,7 @@ bundle_b="$rootfs_dir/rootfs/var/lib/a3s-oci-smoke/bundle-b"
 mkdir -p "$bundle_b/rootfs"
 cp fixtures/utility-vm/config.json "$bundle_b/config.json"
 tar -xzf "$rootfs_archive" -C "$bundle_b/rootfs"
+sudo chown -R 0:0 "$bundle_b/rootfs"
 
 target/debug/a3s-oci oci-vm-multi-container-smoke \
   --shim "$smoke_dir/a3s-oci-krun-shim" \
@@ -425,17 +429,22 @@ state transition and replay remains container-scoped.
 
 The current executor implements a reviewed bootstrap vertical slice:
 
-- new UTS, mount, IPC, network, cgroup, and PID namespaces;
+- new UTS, mount, IPC, network, cgroup, PID, user, and time namespaces;
+- parent-authenticated rootful UID/GID mappings plus read-back verification,
+  with normalized monotonic and boottime offsets applied before the first
+  time-namespace child;
 - hostname and domain name configuration;
 - recursively private mount propagation and `pivot_root`;
 - ordered existing-target OCI mounts with bind/rbind and common VFS options;
-- PID-authenticated create/start barrier;
+- PID- and namespace-authenticated create/start barrier;
 - credentials, umask, `no_new_privileges`, `execve`, PID-reuse-safe pidfd
   signaling, exact normal-or-signal exit status, repeated wait, observation,
   and scoped cleanup.
 
-Unimplemented OCI fields are rejected instead of ignored. User and time
-namespaces, namespace joins, complete mount semantics, cgroup resources,
+The supported user-namespace slice is rootful: it requires both UID and GID
+mappings, coverage for every configured process ID, and an `allow` setgroups
+policy. Unimplemented OCI fields are rejected instead of ignored. Rootless
+mapping policy, namespace joins, complete mount semantics, cgroup resources,
 capabilities, hooks, seccomp, full I/O, recovery, and the remaining SDK
 operations are still release gates.
 
@@ -475,24 +484,37 @@ runtime prerequisite.
 
 ## Architecture
 
-The control plane is platform-neutral. Platform-specific isolation and native
-libraries stay behind explicit driver and shim boundaries:
-
-```mermaid
-flowchart TB
-    consumers["Consumers<br/>A3S Box · a3s-oci CLI · planned containerd shim"]
-    control["Platform-neutral control plane<br/>RuntimeClient → OciRuntimeService → HostRuntimeService<br/>validation · lifecycle · reconciliation"]
-    state[("Durable state<br/>exact bundle · generations · operation journal")]
-    selection{"RuntimeDriver<br/>explicit isolation selection"}
-    native["Native Linux<br/>NativeLinuxDriver · experimental opt-in"]
-    utility["Utility VM host · qualification path<br/>isolated a3s-oci-krun-shim → libkrun<br/>KVM · HVF · WHPX"]
-    agent["A3S Linux guest<br/>authenticated AF_VSOCK → a3s-oci-agent"]
-    executor["Shared LinuxExecutor<br/>namespaces · mounts · PID 1 · pidfd process control"]
-
-    consumers --> control --> selection
-    control <--> state
-    selection --> native --> executor
-    selection --> utility --> agent --> executor
+The platform-neutral control plane is independent of the host isolation
+mechanism. Native libraries and Linux-specific execution stay behind explicit
+driver, shim, and guest-agent boundaries:
+
+```text
+A3S Box / a3s-oci CLI / Rust SDK consumers
+                    │
+        RuntimeClient / OciRuntimeService
+                    │
+      in-process call or bounded local IPC
+                    │
+          OCI validation and lifecycle
+                    │
+            HostRuntimeService
+ exact bundle · generations · journal · reconciliation
+                    │
+               RuntimeDriver
+          ┌─────────┴──────────┐
+          │                    │
+ Native Linux host      Utility VM qualification
+ NativeLinuxDriver      a3s-oci-krun-shim → libkrun
+          │             KVM · HVF · WHPX
+          │                    │
+          │          authenticated guest protocol
+          │                    │
+          │              a3s-oci-agent
+          │                    │
+          └─────────┬──────────┘
+                    │
+             LinuxExecutor
+ namespaces · mounts · PID 1 · pidfds · wait · cleanup
 ```
 
 The same `LinuxExecutor` is called directly on Linux and through the guest