fix(guest): give TTY containers the exec path's cgroup + path-restriction setup (#11 follow-up) (#117)

* fix(guest): give TTY containers a per-container cgroup (#11 follow-up)

The PTY path (CRI tty:true workloads) never created a ContainerCgroup, so tty
containers escaped ALL resource limits — cpu.max, pids.max, memory.* were
unenforced even though the pod requested them. (The seccomp/caps/no_new_privs
gap was closed separately.)

Create the per-container cgroup from the same A3S_SEC_* limit vars the exec
path consumes (memory.max/low/swap, cpu.max/weight, pids.max) in the parent
before the fork, and have the child join it (write its PID to cgroup.procs)
FIRST — before chroot makes /sys/fs/cgroup unreachable — with the same
async-signal-safe open+getpid+itoa+write used by the exec path. The handle
lives for the connection so the cgroup dir is reclaimed once the child exits.

Completes #11: tty containers now get the same cgroup + security confinement as
the exec path.

* fix(guest): apply MaskedPaths/ReadonlyPaths/readonly-rootfs on the PTY path (#11)

The PTY path also skipped the container rootfs path-restrictions the exec path
applies — a tty container's securityContext MaskedPaths (e.g. /proc/kcore),
ReadonlyPaths and readOnlyRootFilesystem went unenforced. Apply them in the PTY
parent before the fork (the child shares the mount namespace and chroots in),
reusing the exec path's critest-validated apply_container_path_restrictions /
remount_rootfs_readonly (now pub(crate)) so the behavior is identical. Best-
effort, matching exec: a masked path that doesn't exist is skipped.

Together with the cgroup commit this closes the remaining #11 surface: tty
containers now get the same security confinement, cgroup limits, and rootfs
path restrictions as the exec path. (parse/apply reuse the exec functions, so
they inherit the exec path's conformance coverage; a CRI-tty-with-rootfs harness
to measure masking directly is a follow-up — exec -t carries no rootfs.)

* fix(guest): set up /proc + /dev on the PTY rootfs path too (#11)

The PTY path with a rootfs (a CRI tty container main carries the container
rootfs) never mounted the container pseudo-filesystems (/proc, /sys) or the
standard /dev nodes — only the exec path did, per spawn. A tty container was
therefore missing /proc and /dev entirely (many workloads read /proc/self/* or
/dev/urandom and won't start), AND the masked-paths added in the previous commit
were no-ops because /proc wasn't mounted to mask under.

Mirror the exec path's full rootfs setup in the PTY parent before the fork
(ensure_container_pseudo_filesystems + ensure_container_dev_nodes, now
pub(crate)), in the exec path's order: pseudo-fs -> dev -> masked/readonly ->
readonly-rootfs. All reuse the exec path's critest-validated functions, so the
behavior is identical; idempotent and best-effort.

With this the PTY path performs the SAME container setup as the exec path —
closing the functionality gap and making the masked-path restrictions effective.

---------

Co-authored-by: Roy Lin <roylin@a3s.box>

Author: ZhiXiao-Lin

src/guest/init/src/exec_server.rs

@@ -1518,7 +1518,7 @@ fn configure_child_process(
 /// existing mount (detected by a differing `st_dev`) is left untouched, and any
 /// failure is logged without aborting the exec.
 #[cfg(target_os = "linux")]
-fn ensure_container_pseudo_filesystems(rootfs: &str) {
+pub(crate) fn ensure_container_pseudo_filesystems(rootfs: &str) {
     use nix::mount::{mount, MsFlags};
     use std::os::unix::fs::MetadataExt;
 
@@ -1559,7 +1559,7 @@ fn ensure_container_pseudo_filesystems(rootfs: &str) {
 /// still holds `CAP_MKNOD` (before the privilege drop and chroot). Best-effort
 /// and idempotent: an existing node is left as-is.
 #[cfg(target_os = "linux")]
-fn ensure_container_dev_nodes(rootfs: &str) {
+pub(crate) fn ensure_container_dev_nodes(rootfs: &str) {
     let dev = format!("{rootfs}/dev");
     if let Err(e) = std::fs::create_dir_all(&dev) {
         warn!("Failed to create container /dev {dev}: {e}");
@@ -1635,7 +1635,7 @@ fn parse_sec_int(env: &[String], prefix: &str) -> Option<i64> {
 
 /// Parse a `':'`-separated absolute-path list from an `A3S_SEC_*` env entry.
 #[cfg(target_os = "linux")]
-fn parse_sec_path_list<'a>(env: &'a [String], prefix: &str) -> Vec<&'a str> {
+pub(crate) fn parse_sec_path_list<'a>(env: &'a [String], prefix: &str) -> Vec<&'a str> {
     env.iter()
         .find_map(|entry| entry.strip_prefix(prefix))
         .map(|value| value.split(':').filter(|path| !path.is_empty()).collect())
@@ -1654,7 +1654,7 @@ fn parse_sec_path_list<'a>(env: &'a [String], prefix: &str) -> Vec<&'a str> {
 ///
 /// Best-effort: an absent path is skipped and any mount failure is logged.
 #[cfg(target_os = "linux")]
-fn apply_container_path_restrictions(rootfs: &str, masked: &[&str], readonly: &[&str]) {
+pub(crate) fn apply_container_path_restrictions(rootfs: &str, masked: &[&str], readonly: &[&str]) {
     use nix::mount::{mount, MsFlags};
 
     use std::os::unix::fs::MetadataExt;
@@ -1790,7 +1790,7 @@ fn apply_container_path_restrictions(rootfs: &str, masked: &[&str], readonly: &[
 /// rootfs that is already read-only is left untouched, so re-exec into the
 /// container does not stack mounts.
 #[cfg(target_os = "linux")]
-fn remount_rootfs_readonly(rootfs: &str) {
+pub(crate) fn remount_rootfs_readonly(rootfs: &str) {
     use nix::mount::{mount, MsFlags};
 
     if nix::sys::statvfs::statvfs(rootfs)

src/guest/init/src/pty_server.rs

@@ -233,6 +233,72 @@ fn handle_pty_connection(fd: std::os::fd::OwnedFd) -> Result<(), Box<dyn std::er
     #[cfg(not(target_os = "linux"))]
     let _ = (&sec_cap_drop, &sec_cap_keep, sec_no_new_privs);
 
+    // Create the per-container cgroup from the A3S_SEC_* limits so the TTY
+    // workload is bounded by cpu.max / pids.max / memory.* like the exec path —
+    // the PTY path previously created NO cgroup, so tty containers escaped every
+    // resource limit. Created here in the parent (allocates); the child joins it
+    // (writes its PID to cgroup.procs) before chroot. The handle lives for the
+    // connection so the cgroup dir is removed once the child exits.
+    #[cfg(target_os = "linux")]
+    let parse_u64 = |prefix: &str| {
+        request
+            .env
+            .iter()
+            .find_map(|entry| entry.strip_prefix(prefix))
+            .and_then(|value| value.trim().parse::<u64>().ok())
+    };
+    #[cfg(target_os = "linux")]
+    let parse_i64 = |prefix: &str| {
+        request
+            .env
+            .iter()
+            .find_map(|entry| entry.strip_prefix(prefix))
+            .and_then(|value| value.trim().parse::<i64>().ok())
+    };
+    #[cfg(target_os = "linux")]
+    let _container_cgroup = crate::cgroup::ContainerCgroup::create(
+        parse_u64("A3S_SEC_MEM_LIMIT="),
+        parse_u64("A3S_SEC_MEM_LOW="),
+        parse_i64("A3S_SEC_MEM_SWAP="),
+        parse_i64("A3S_SEC_CPU_QUOTA="),
+        parse_u64("A3S_SEC_CPU_PERIOD="),
+        parse_u64("A3S_SEC_CPU_SHARES="),
+        parse_u64("A3S_SEC_PIDS_LIMIT="),
+    );
+    #[cfg(target_os = "linux")]
+    let cgroup_procs: Option<std::ffi::CString> = _container_cgroup
+        .as_ref()
+        .and_then(|cgroup| std::ffi::CString::new(cgroup.procs_path()).ok());
+
+    // Set up the container rootfs before the fork — the child shares this mount
+    // namespace and chroots into it. The exec path does all of this per spawn;
+    // the PTY path did NONE of it, so a tty container was missing /proc + /dev and
+    // its securityContext path restrictions went unenforced. Mirror the exec path
+    // exactly (same critest-validated functions), in the same order.
+    #[cfg(target_os = "linux")]
+    if let Some(ref rootfs) = request.rootfs {
+        // /proc + /sys, then the standard /dev nodes — many workloads read
+        // /proc/self/* or /dev/urandom and won't start without them. Idempotent.
+        crate::exec_server::ensure_container_pseudo_filesystems(rootfs);
+        crate::exec_server::ensure_container_dev_nodes(rootfs);
+        // CRI MaskedPaths / ReadonlyPaths (best-effort; a path that doesn't exist
+        // is skipped) — these need /proc + /sys mounted above.
+        let masked = crate::exec_server::parse_sec_path_list(&request.env, "A3S_SEC_MASKED_PATHS=");
+        let readonly =
+            crate::exec_server::parse_sec_path_list(&request.env, "A3S_SEC_READONLY_PATHS=");
+        if !masked.is_empty() || !readonly.is_empty() {
+            crate::exec_server::apply_container_path_restrictions(rootfs, &masked, &readonly);
+        }
+        // readOnlyRootFilesystem — last, after /proc, /sys and inner mounts are up.
+        if request
+            .env
+            .iter()
+            .any(|entry| entry == "A3S_SEC_READONLY_ROOTFS=1")
+        {
+            crate::exec_server::remount_rootfs_readonly(rootfs);
+        }
+    }
+
     // Step 2: Allocate PTY
     let pty = openpty(None, None)?;
     let master_fd = pty.master;
@@ -247,6 +313,37 @@ fn handle_pty_connection(fd: std::os::fd::OwnedFd) -> Result<(), Box<dyn std::er
             // Child: set up PTY slave as stdin/stdout/stderr, then exec
             drop(master_fd);
 
+            // Join the per-container cgroup FIRST, before chroot makes
+            // /sys/fs/cgroup unreachable, so this process and everything it forks
+            // is bounded from birth. Async-signal-safe: open + getpid + a
+            // stack-only itoa + write + close, no allocation.
+            #[cfg(target_os = "linux")]
+            if let Some(ref procs) = cgroup_procs {
+                let fd = unsafe { libc::open(procs.as_ptr(), libc::O_WRONLY) };
+                if fd >= 0 {
+                    let mut buf = [0u8; 20];
+                    let mut i = buf.len();
+                    let mut n = unsafe { libc::getpid() } as u64;
+                    if n == 0 {
+                        i -= 1;
+                        buf[i] = b'0';
+                    }
+                    while n > 0 {
+                        i -= 1;
+                        buf[i] = b'0' + (n % 10) as u8;
+                        n /= 10;
+                    }
+                    unsafe {
+                        libc::write(
+                            fd,
+                            buf[i..].as_ptr() as *const libc::c_void,
+                            (buf.len() - i) as libc::size_t,
+                        );
+                        libc::close(fd);
+                    }
+                }
+            }
+
             // Create new session (detach from controlling terminal)
             setsid().ok();