fix(box): avoid CString panic on a NUL workdir without a rootfs

configure_child_process built a CString from the working directory
unconditionally and .expect()ed it, but build_command only rejects an
embedded NUL in the workdir when a rootfs is set. A rootfs-less exec with
a NUL byte in working_dir could therefore panic the exec connection
thread. The workdir CString is now built only when a rootfs is present
(its sole use is chdir after chroot), where the NUL was already rejected.

Closes the last of the 16 findings from this session's adversarial review.
Verified: build + clippy clean; ReadonlyPaths / seccomp-default / RunAsUser
critest specs still pass (chroot+rootfs exec path unaffected).

Author: Roy Lin

src/guest/init/src/exec_server.rs

@@ -851,7 +851,13 @@ fn configure_child_process(
 
     let rootfs = rootfs
         .map(|rootfs| CString::new(rootfs.as_bytes()).expect("rootfs path was pre-validated"));
-    let workdir = CString::new(workdir.as_bytes()).expect("working directory was pre-validated");
+    // workdir (for chdir) is only used when chrooting into a rootfs, where
+    // build_command has already rejected an embedded NUL. Build the CString only
+    // in that case so a workdir containing a NUL with no rootfs set cannot panic
+    // this exec thread.
+    let workdir = rootfs
+        .as_ref()
+        .map(|_| CString::new(workdir.as_bytes()).expect("working directory was pre-validated"));
 
     // Build the seccomp BPF filter BEFORE fork: building allocates, and
     // allocating in the post-fork child is not async-signal-safe (malloc may
@@ -870,8 +876,10 @@ fn configure_child_process(
                 if libc::chroot(rootfs.as_ptr()) != 0 {
                     return Err(std::io::Error::last_os_error());
                 }
-                if libc::chdir(workdir.as_ptr()) != 0 {
-                    return Err(std::io::Error::last_os_error());
+                if let Some(workdir) = workdir.as_ref() {
+                    if libc::chdir(workdir.as_ptr()) != 0 {
+                        return Err(std::io::Error::last_os_error());
+                    }
                 }
             }
             // Apply supplemental groups while still privileged — setgroups