exeseal: refactor to string-based mode and strategy callbacks

- Drop Mode int enum in favor of plain strings; state.json now stores
  the annotation value.
- Refactor CloneSelfExe to dispatch via a per-mode list of strategy
  callbacks, eliminating duplication between explicit modes and the
  unset fallback path.
- Skip the IsSelfExeCloned shortcut when an explicit mode is set.

Signed-off-by: Mohammed Aminu Futa <mohammedfuta2000@gmail.com>

Author: captainmo1

libcontainer/configs/config.go

@@ -18,7 +18,6 @@ import (
 
 	"github.com/opencontainers/cgroups"
 	devices "github.com/opencontainers/cgroups/devices/config"
-	"github.com/opencontainers/runc/libcontainer/exeseal"
 	"github.com/opencontainers/runtime-spec/specs-go"
 )
 
@@ -208,7 +207,7 @@ type Config struct {
 	Labels []string `json:"labels"`
 
 	// CloneSelfExe selects how runc protects runc binary against tampering.
-	CloneSelfExe exeseal.Mode `json:"clone_self_exe,omitempty"`
+	CloneSelfExe string `json:"clone_self_exe,omitempty"`
 
 	// NoNewKeyring will not allocated a new session keyring for the container.  It will use the
 	// callers keyring in this case.

libcontainer/container_linux.go

@@ -529,7 +529,7 @@ func (c *Container) newParentProcess(p *Process) (parentProcess, error) {
 		exePath string
 		safeExe *os.File
 	)
-	if exeseal.IsSelfExeCloned() {
+	if c.config.CloneSelfExe == exeseal.ModeUnset && exeseal.IsSelfExeCloned() {
 		// /proc/self/exe is already a cloned binary -- no need to do anything
 		logrus.Debug("skipping binary cloning -- /proc/self/exe is already cloned!")
 		// We don't need to use /proc/thread-self here because the exe mm of a

libcontainer/exeseal/cloned_binary_linux.go

@@ -215,58 +215,24 @@ func IsCloned(exe *os.File) bool {
 // /proc/self/exe). This binary can then be used for "runc init" in order to
 // make sure the container process can never resolve the original runc binary.
 // For more details on why this is necessary, see CVE-2019-5736.
-func CloneSelfExe(tmpDir string, mode Mode) (*os.File, error) {
-	switch mode {
-	case ModeROSharedPage:
-		overlayFile, err := sealedOverlayfs("/proc/self/exe", tmpDir)
-		if err != nil {
-			return nil, fmt.Errorf("%s=ro-shared-page requested but overlayfs unavailable: %w",
-				AnnotationKey, err)
-		}
-		logrus.Debug("runc exeseal: using overlayfs for sealed /proc/self/exe") // used for tests
-		return overlayFile, nil
-
-	case ModeIndependentDataCopy:
-		return cloneSelfExeViaCloneBinary(tmpDir)
+func CloneSelfExe(tmpDir string, mode string) (*os.File, error) {
+	strategies := strategiesFor(mode)
+	if len(strategies) == 0 {
+		return nil, fmt.Errorf("internal: no strategies for clone-self-exe mode %q", mode)
+	}
 
-	case ModeUnset:
-		// Try to create a temporary overlayfs to produce a readonly version of
-		// /proc/self/exe that cannot be "unwrapped" by the container. In contrast
-		// to CloneBinary, this technique does not require any extra memory usage
-		// and does not have the (fairly noticeable) performance impact of copying
-		// a large binary file into a memfd.
-		//
-		// Based on some basic performance testing, the overlayfs approach has
-		// effectively no performance overhead (it is on par with both
-		// MS_BIND+MS_RDONLY and no binary cloning at all) while memfd copying adds
-		// around ~60% overhead during container startup.
-		overlayFile, err := sealedOverlayfs("/proc/self/exe", tmpDir)
+	var lastErr error
+	for i, strategy := range strategies {
+		f, err := strategy(tmpDir)
 		if err == nil {
-			logrus.Debug("runc exeseal: using overlayfs for sealed /proc/self/exe") // used for tests
-			return overlayFile, nil
+			return f, nil
+		}
+		lastErr = err
+		if i < len(strategies)-1 {
+			logrus.WithError(err).Debugf("clone-self-exe strategy %d/%d failed, trying next", i+1, len(strategies))
 		}
-		logrus.WithError(err).Debugf("could not use overlayfs for /proc/self/exe sealing -- falling back to making a temporary copy")
-		return cloneSelfExeViaCloneBinary(tmpDir)
-
-	default:
-		return nil, fmt.Errorf("internal error: unhandled CloneSelfExe mode %v", mode)
-	}
-}
-
-func cloneSelfExeViaCloneBinary(tmpDir string) (*os.File, error) {
-	selfExe, err := os.Open("/proc/self/exe")
-	if err != nil {
-		return nil, fmt.Errorf("opening current binary: %w", err)
-	}
-	defer selfExe.Close()
-
-	stat, err := selfExe.Stat()
-	if err != nil {
-		return nil, fmt.Errorf("checking /proc/self/exe size: %w", err)
 	}
-	size := stat.Size()
-	logrus.Debug("runc exeseal: using clone-binary path") // used for tests
-	return CloneBinary(selfExe, size, "/proc/self/exe", tmpDir)
+	return nil, fmt.Errorf("clone-self-exe failed (mode=%q): %w", mode, lastErr)
 }
 
 // IsSelfExeCloned returns whether /proc/self/exe is a cloned binary that can

libcontainer/exeseal/mode.go

@@ -0,0 +1,85 @@
+package exeseal
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/sirupsen/logrus"
+)
+
+// AnnotationKey is the OCI annotation that selects how runc protects
+// the host runc binary against tampering. See ValidateMode for the
+// recognized values.
+const AnnotationKey = "org.opencontainers.runc.clone-self-exe"
+
+const (
+	ModeUnset               = ""
+	ModeIndependentDataCopy = "independent-data-copy"
+	ModeROSharedPage        = "ro-shared-page"
+)
+
+// ValidateMode reports whether value is a recognized annotation value.
+//
+// Recognized values:
+//   - "":                      annotation absent; use the default fallback chain.
+//   - "independent-data-copy": use the clone-binary path (memfd, with
+//     an internal fallback to a classic unlinked tmpfile on older
+//     kernels). Sealed overlayfs is not attempted.
+//   - "ro-shared-page":        use sealed overlayfs only; fail
+//     container creation if it is not available.
+func ValidateMode(value string) error {
+	switch value {
+	case ModeUnset, ModeIndependentDataCopy, ModeROSharedPage:
+		return nil
+	default:
+		return fmt.Errorf("invalid %s value %q (want %q or %q)",
+			AnnotationKey, value,
+			ModeIndependentDataCopy, ModeROSharedPage)
+	}
+}
+
+// strategy produces a sealed /proc/self/exe handle by one specific
+// mechanism. Returns the file on success, or an error on failure.
+type strategy func(tmpDir string) (*os.File, error)
+
+func overlayfsStrategy(tmpDir string) (*os.File, error) {
+	f, err := sealedOverlayfs("/proc/self/exe", tmpDir)
+	if err != nil {
+		return nil, err
+	}
+	logrus.Debug("runc exeseal: using overlayfs for sealed /proc/self/exe") // used for tests
+	return f, nil
+}
+
+func cloneBinaryStrategy(tmpDir string) (*os.File, error) {
+	selfExe, err := os.Open("/proc/self/exe")
+	if err != nil {
+		return nil, fmt.Errorf("opening current binary: %w", err)
+	}
+	defer selfExe.Close()
+
+	stat, err := selfExe.Stat()
+	if err != nil {
+		return nil, fmt.Errorf("checking /proc/self/exe size: %w", err)
+	}
+	logrus.Debug("runc exeseal: using clone-binary path") // used for tests
+	return CloneBinary(selfExe, stat.Size(), "/proc/self/exe", tmpDir)
+}
+
+// strategiesFor returns the ordered list of strategies to try for a
+// given annotation value. The first successful strategy wins; if all
+// fail, the last error is returned to the caller.
+func strategiesFor(mode string) []strategy {
+	switch mode {
+	case ModeROSharedPage:
+		return []strategy{overlayfsStrategy}
+	case ModeIndependentDataCopy:
+		return []strategy{cloneBinaryStrategy}
+	case ModeUnset:
+		// Historical default: overlayfs first, clone-binary fallback.
+		// The order may be reversed in a future release.
+		return []strategy{overlayfsStrategy, cloneBinaryStrategy}
+	default:
+		return nil
+	}
+}

libcontainer/exeseal/mode_linux.go

@@ -0,0 +1,26 @@
+package exeseal
+
+import "testing"
+
+func TestValidateMode(t *testing.T) {
+	cases := []struct {
+		desc    string
+		in      string
+		wantErr bool
+	}{
+		{"absent (empty string) is valid", "", false},
+		{"recognized: independent-data-copy", "independent-data-copy", false},
+		{"recognized: ro-shared-page", "ro-shared-page", false},
+		{"unrecognized errors", "not-a-real-mode", true},
+		{"case-sensitive", "INDEPENDENT-DATA-COPY", true},
+		{"no whitespace trimming", " independent-data-copy ", true},
+	}
+	for _, tc := range cases {
+		t.Run(tc.desc, func(t *testing.T) {
+			err := ValidateMode(tc.in)
+			if (err != nil) != tc.wantErr {
+				t.Errorf("ValidateMode(%q) err=%v, wantErr=%v", tc.in, err, tc.wantErr)
+			}
+		})
+	}
+}

libcontainer/exeseal/mode_linux_test.go

@@ -434,11 +434,10 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
 
 	config.Cgroups = c
 
-	cloneSelfExe, err := initCloneSelfExeMode(spec)
-	if err != nil {
+	config.CloneSelfExe = spec.Annotations[exeseal.AnnotationKey]
+	if err := exeseal.ValidateMode(config.CloneSelfExe); err != nil {
 		return nil, err
 	}
-	config.CloneSelfExe = cloneSelfExe
 
 	// set linux-specific config
 	if spec.Linux != nil {