fix(security): confine CRI localhostProfile seccomp path to the seccomp root

LOW. `parse_localhost_seccomp_deny` did `std::fs::read_to_string(localhost_ref)`
with no path confinement. `localhost_ref` is the pod's
`securityContext.seccompProfile.localhostProfile` — attacker-settable through the
CRI by anyone who can create pods — so it was an arbitrary host-file OPEN
primitive (a path-traversal / file-existence oracle). Information disclosure is
limited (the parse error is only warn-logged, never returned to the gRPC caller,
and content only escapes as syscall names from valid OCI-seccomp JSON into the
attacker's own container), hence LOW — but the missing guard is real.

Fix: `confined_seccomp_path` mirrors kubelet/containerd semantics — resolve the
ref under the configured seccomp root (default /var/lib/kubelet/seccomp, override
A3S_BOX_SECCOMP_PROFILE_ROOT), reject any `..` component, and require an absolute
ref to lie within the root. An out-of-root or traversing ref is rejected, and the
caller falls back to RuntimeDefault (never unconfined).

Test: confines_localhost_profile_to_root_and_rejects_traversal — accepts
in-root relative/absolute refs; rejects `../../etc/passwd`, `sub/../../escape`,
`/etc/passwd`, `/etc/shadow`, and `/var/lib/kubelet/seccomp-evil/x`
(prefix-confusion). Neuter-verified on the KVM server (disabling the
root check makes it FAIL on /etc/passwd); fmt + clippy clean.

Completes the untrusted-input security audit (4/4): after #141 (CRITICAL digest
traversal), #142 (HIGH/MED bombs), #140 (HIGH whiteout deletion).

Author: Roy Lin

src/cri/src/runtime_service/mod.rs

@@ -210,6 +210,43 @@ struct OciSeccompSyscall {
     action: String,
 }
 
+/// Confine a CRI `localhostProfile` path to the node's seccomp profile root and
+/// reject `..` traversal.
+///
+/// `localhost_ref` comes from a pod's
+/// `securityContext.seccompProfile.localhostProfile` (attacker-settable through
+/// the CRI) and is read off the host disk — without confinement it is an
+/// arbitrary host-file open primitive. Mirrors kubelet/containerd semantics:
+/// profiles live under the configured seccomp root (default
+/// `/var/lib/kubelet/seccomp`, override with `A3S_BOX_SECCOMP_PROFILE_ROOT`). A
+/// relative ref resolves under the root; an absolute ref must lie within it.
+fn confined_seccomp_path(localhost_ref: &str) -> Result<PathBuf, String> {
+    let root = std::env::var("A3S_BOX_SECCOMP_PROFILE_ROOT")
+        .unwrap_or_else(|_| "/var/lib/kubelet/seccomp".to_string());
+    let root = std::path::Path::new(&root);
+    let r = std::path::Path::new(localhost_ref);
+    if r.components()
+        .any(|c| matches!(c, std::path::Component::ParentDir))
+    {
+        return Err(format!(
+            "seccomp profile path contains '..': {localhost_ref}"
+        ));
+    }
+    let candidate = if r.is_absolute() {
+        r.to_path_buf()
+    } else {
+        root.join(r)
+    };
+    if !candidate.starts_with(root) {
+        return Err(format!(
+            "seccomp profile {} is outside the seccomp root {}",
+            candidate.display(),
+            root.display()
+        ));
+    }
+    Ok(candidate)
+}
+
 /// Parse a CRI localhost seccomp profile file and return the syscall names it
 /// blocks with `SCMP_ACT_ERRNO`/`SCMP_ACT_KILL*`.
 ///
@@ -219,8 +256,9 @@ struct OciSeccompSyscall {
 /// supported; returns an error so the caller can fall back rather than silently
 /// run unconfined.
 fn parse_localhost_seccomp_deny(localhost_ref: &str) -> Result<Vec<String>, String> {
-    let raw = std::fs::read_to_string(localhost_ref)
-        .map_err(|e| format!("read seccomp profile {localhost_ref}: {e}"))?;
+    let path = confined_seccomp_path(localhost_ref)?;
+    let raw = std::fs::read_to_string(&path)
+        .map_err(|e| format!("read seccomp profile {}: {e}", path.display()))?;
     let profile: OciSeccompProfile =
         serde_json::from_str(&raw).map_err(|e| format!("parse seccomp profile: {e}"))?;
     if !matches!(
@@ -249,6 +287,36 @@ fn parse_localhost_seccomp_deny(localhost_ref: &str) -> Result<Vec<String>, Stri
     Ok(deny)
 }
 
+#[cfg(test)]
+mod seccomp_confine_tests {
+    use super::confined_seccomp_path;
+
+    #[test]
+    fn confines_localhost_profile_to_root_and_rejects_traversal() {
+        // Default root is /var/lib/kubelet/seccomp (no env set). The check is
+        // lexical, so files need not exist.
+        assert!(confined_seccomp_path("audit.json").is_ok());
+        assert!(confined_seccomp_path("profiles/audit.json").is_ok());
+        assert!(confined_seccomp_path("/var/lib/kubelet/seccomp/audit.json").is_ok());
+
+        // SECURITY: a malicious localhostProfile must not open arbitrary host
+        // files — traversal, out-of-root absolute paths, and prefix-confusion
+        // are all rejected (caller then falls back to RuntimeDefault).
+        for evil in [
+            "../../../../etc/passwd",
+            "sub/../../escape",
+            "/etc/passwd",
+            "/etc/shadow",
+            "/var/lib/kubelet/seccomp-evil/x",
+        ] {
+            assert!(
+                confined_seccomp_path(evil).is_err(),
+                "must reject malicious seccomp path: {evil}"
+            );
+        }
+    }
+}
+
 #[derive(Debug, Clone)]
 pub struct CriRuntimeOptions {
     pub default_agent_image: String,