feat(box): CRI applies RuntimeDefault seccomp filter to containers

A container whose SecurityContext requests seccomp RuntimeDefault now gets
the default BPF filter installed in its child before execve
(A3S_SEC_SECCOMP=default → guest-init configure_child_process →
namespace::apply_default_seccomp, applied last, after chroot + privilege
drop). The filter blocks the dangerous syscalls Docker's default profile
blocks and puts the process in SECCOMP_MODE_FILTER (Seccomp: 2).
Unconfined / unset containers stay unfiltered (Seccomp: 0).

Verified on the KVM server: the CRI "should support seccomp default on the
container" conformance spec now passes (SeccompProfilePath bucket 4 -> 5).
The localhost-profile specs (incl. the SYS_ADMIN sethostname block) remain
— they need the host profile file plumbed into the VM, a separate effort.

Also fixes a clippy while-let lint in the sysctls boot-env loop.

Author: Roy Lin

src/cri/src/runtime_service/mod.rs

@@ -809,6 +809,15 @@ impl RuntimeService for BoxRuntimeService {
                     sc.readonly_paths.join(":"),
                 ));
             }
+            // CRI seccomp: RuntimeDefault installs the default BPF filter in the
+            // guest (Seccomp: 2); Unconfined / unset leave the container
+            // unconfined. Localhost profiles are not yet plumbed into the VM.
+            if let Some(profile) = sc.seccomp.as_ref() {
+                use crate::cri_api::security_profile::ProfileType;
+                if profile.profile_type() == ProfileType::RuntimeDefault {
+                    env.push(("A3S_SEC_SECCOMP".to_string(), "default".to_string()));
+                }
+            }
         }
         let user = container_user_from_linux_config(config.linux.as_ref())
             .or_else(|| image_config.and_then(|image| image.user.clone()));

src/guest/init/src/exec_server.rs

@@ -461,12 +461,20 @@ fn build_command(
                 .collect()
         })
         .unwrap_or_default();
+    // CRI seccomp: A3S_SEC_SECCOMP=default applies the default BPF filter
+    // (RuntimeDefault) in the child; unconfined/unset leave the process
+    // unfiltered.
+    let apply_seccomp = spec
+        .env
+        .iter()
+        .any(|entry| entry == "A3S_SEC_SECCOMP=default");
     configure_child_process(
         &mut command,
         spec.rootfs,
         workdir,
         process_user,
         supplemental_groups,
+        apply_seccomp,
     );
     if spec.rootfs.is_none() {
         if let Some(dir) = spec.working_dir {
@@ -831,6 +839,7 @@ fn configure_child_process(
     workdir: &str,
     user: Option<ProcessUser>,
     supplemental_groups: Vec<u32>,
+    apply_seccomp: bool,
 ) {
     use std::ffi::CString;
     use std::os::unix::process::CommandExt;
@@ -866,6 +875,15 @@ fn configure_child_process(
             if let Some(user) = user {
                 user.apply()?;
             }
+            // Install the seccomp filter last — after chroot and the privilege
+            // drop — so it is active across execve. The default filter allows
+            // execve and the syscalls the child still needs.
+            #[cfg(target_os = "linux")]
+            if apply_seccomp {
+                crate::namespace::apply_default_seccomp()?;
+            }
+            #[cfg(not(target_os = "linux"))]
+            let _ = apply_seccomp;
             Ok(())
         });
     }
@@ -878,6 +896,7 @@ fn configure_child_process(
     _workdir: &str,
     _user: Option<ProcessUser>,
     _supplemental_groups: Vec<u32>,
+    _apply_seccomp: bool,
 ) {
 }
 

src/guest/init/src/host_config.rs

@@ -20,10 +20,7 @@ pub fn apply_from_env() -> Result<(), Box<dyn std::error::Error>> {
 /// VM startup.
 fn apply_sysctls_from_env() {
     let mut index = 0;
-    loop {
-        let Ok(spec) = std::env::var(format!("BOX_SYSCTL_{index}")) else {
-            break;
-        };
+    while let Ok(spec) = std::env::var(format!("BOX_SYSCTL_{index}")) {
         index += 1;
         let Some((name, value)) = spec.split_once('=') else {
             continue;

src/guest/init/src/namespace.rs

@@ -497,7 +497,7 @@ fn cap_name_to_number(name: &str) -> Option<i32> {
 /// Based on Docker's default seccomp profile — blocks syscalls that could
 /// escape the sandbox or compromise the host.
 #[cfg(target_os = "linux")]
-fn apply_default_seccomp() -> Result<(), std::io::Error> {
+pub(crate) fn apply_default_seccomp() -> Result<(), std::io::Error> {
     // Use SECCOMP_SET_MODE_FILTER via prctl
     // The default profile uses a BPF filter that blocks:
     // - kexec_load, kexec_file_load (kernel replacement)