libct/exeseal: add annotation to choose runc binary protection mechanism

Introduce the org.opencontainers.runc.clone-self-exe annotation to let
users explicitly choose how runc protects the host runc binary against
tampering by the container. Previously, runc attempted sealed overlayfs
and silently fell back to the clone-binary path on failure, with no way
for users to express a preference.

Recognized values:
  - independent-data-copy: use the clone-binary path only (memfd, with
                           an internal fallback to a classic unlinked
                           tmpfile on older kernels).
  - ro-shared-page:        use sealed overlayfs only.

When the annotation is absent, runc's existing default behavior is
preserved unchanged (sealed overlayfs, then clone-binary fallback).

The annotation is registered in PotentiallyUnsafeConfigAnnotations
because it configures runc's own execution path.

Signed-off-by: Mohammed Aminu Futa <mohammedfuta2000@gmail.com>

Author: captainmo1

features.go

@@ -80,6 +80,7 @@ var featuresCommand = &cli.Command{
 				"bundle",
 				"org.systemd.property.", // prefix form
 				"org.criu.config",
+				"org.opencontainers.runc.clone-self-exe",
 			},
 		}
 

libcontainer/configs/config.go

@@ -19,6 +19,7 @@ import (
 	"github.com/opencontainers/cgroups"
 	devices "github.com/opencontainers/cgroups/devices/config"
 	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/opencontainers/runc/libcontainer/exeseal"
 )
 
 type Rlimit struct {
@@ -206,6 +207,9 @@ type Config struct {
 	// Labels are user defined metadata that is stored in the config and populated on the state
 	Labels []string `json:"labels"`
 
+	// CloneSelfExe selects how runc protects runc binary against tampering.
+	CloneSelfExe exeseal.Mode `json:"clone_self_exe,omitempty"`
+
 	// NoNewKeyring will not allocated a new session keyring for the container.  It will use the
 	// callers keyring in this case.
 	NoNewKeyring bool `json:"no_new_keyring,omitempty"`

libcontainer/container_linux.go

@@ -538,7 +538,7 @@ func (c *Container) newParentProcess(p *Process) (parentProcess, error) {
 		exePath = "/proc/self/exe"
 	} else {
 		var err error
-		safeExe, err = exeseal.CloneSelfExe(c.stateDir)
+		safeExe, err = exeseal.CloneSelfExe(c.stateDir, c.config.CloneSelfExe)
 		if err != nil {
 			return nil, fmt.Errorf("unable to create safe /proc/self/exe clone for runc init: %w", err)
 		}

libcontainer/exeseal/cloned_binary_linux.go

@@ -215,24 +215,45 @@ func IsCloned(exe *os.File) bool {
 // /proc/self/exe). This binary can then be used for "runc init" in order to
 // make sure the container process can never resolve the original runc binary.
 // For more details on why this is necessary, see CVE-2019-5736.
-func CloneSelfExe(tmpDir string) (*os.File, error) {
-	// Try to create a temporary overlayfs to produce a readonly version of
-	// /proc/self/exe that cannot be "unwrapped" by the container. In contrast
-	// to CloneBinary, this technique does not require any extra memory usage
-	// and does not have the (fairly noticeable) performance impact of copying
-	// a large binary file into a memfd.
-	//
-	// Based on some basic performance testing, the overlayfs approach has
-	// effectively no performance overhead (it is on par with both
-	// MS_BIND+MS_RDONLY and no binary cloning at all) while memfd copying adds
-	// around ~60% overhead during container startup.
-	overlayFile, err := sealedOverlayfs("/proc/self/exe", tmpDir)
-	if err == nil {
+func CloneSelfExe(tmpDir string, mode Mode) (*os.File, error) {
+	switch mode {
+	case ModeROSharedPage:
+		overlayFile, err := sealedOverlayfs("/proc/self/exe", tmpDir)
+		if err != nil {
+			return nil, fmt.Errorf("%s=ro-shared-page requested but overlayfs unavailable: %w",
+				AnnotationKey, err)
+		}
 		logrus.Debug("runc exeseal: using overlayfs for sealed /proc/self/exe") // used for tests
 		return overlayFile, nil
+
+	case ModeIndependentDataCopy:
+		return cloneSelfExeViaCloneBinary(tmpDir)
+
+	case ModeUnset:
+		// Try to create a temporary overlayfs to produce a readonly version of
+		// /proc/self/exe that cannot be "unwrapped" by the container. In contrast
+		// to CloneBinary, this technique does not require any extra memory usage
+		// and does not have the (fairly noticeable) performance impact of copying
+		// a large binary file into a memfd.
+		//
+		// Based on some basic performance testing, the overlayfs approach has
+		// effectively no performance overhead (it is on par with both
+		// MS_BIND+MS_RDONLY and no binary cloning at all) while memfd copying adds
+		// around ~60% overhead during container startup.
+		overlayFile, err := sealedOverlayfs("/proc/self/exe", tmpDir)
+		if err == nil {
+			logrus.Debug("runc exeseal: using overlayfs for sealed /proc/self/exe") // used for tests
+			return overlayFile, nil
+		}
+		logrus.WithError(err).Debugf("could not use overlayfs for /proc/self/exe sealing -- falling back to making a temporary copy")
+		return cloneSelfExeViaCloneBinary(tmpDir)
+
+	default:
+		return nil, fmt.Errorf("internal error: unhandled CloneSelfExe mode %v", mode)
 	}
-	logrus.WithError(err).Debugf("could not use overlayfs for /proc/self/exe sealing -- falling back to making a temporary copy")
+}
 
+func cloneSelfExeViaCloneBinary(tmpDir string) (*os.File, error) {
 	selfExe, err := os.Open("/proc/self/exe")
 	if err != nil {
 		return nil, fmt.Errorf("opening current binary: %w", err)
@@ -244,7 +265,7 @@ func CloneSelfExe(tmpDir string) (*os.File, error) {
 		return nil, fmt.Errorf("checking /proc/self/exe size: %w", err)
 	}
 	size := stat.Size()
-
+	logrus.Debug("runc exeseal: using clone-binary path") // used for tests
 	return CloneBinary(selfExe, size, "/proc/self/exe", tmpDir)
 }
 

libcontainer/exeseal/mode.go

@@ -0,0 +1,65 @@
+package exeseal
+
+import "fmt"
+
+// AnnotationKey is the OCI annotation that selects how runc protects
+// the host runc binary against tampering by the container. See
+// ParseMode for the recognized values and behavior.
+const AnnotationKey = "org.opencontainers.runc.clone-self-exe"
+
+// Mode the selected mechanism used to protect the host runc binary.
+// See ParseMode for the recognized annotation values.
+type Mode int
+
+const (
+	// ModeUnset means the annotation was not present in the config.
+	ModeUnset Mode = iota
+	ModeIndependentDataCopy
+	ModeROSharedPage
+)
+
+// String returns the canonical annotation value for a Mode, or
+// "<unset>" for ModeUnset (which has no annotation form).
+func (m Mode) String() string {
+	switch m {
+	case ModeUnset:
+		return "<unset>"
+	case ModeIndependentDataCopy:
+		return "independent-data-copy"
+	case ModeROSharedPage:
+		return "ro-shared-page"
+	default:
+		return fmt.Sprintf("unknown(%d)", int(m))
+	}
+}
+
+// ParseMode converts an annotation value string into a Mode.
+//
+// Recognized values:
+//   - "independent-data-copy": use the clone-binary path (memfd, with
+//        an internal fallback to a classic unlinked tmpfile on older
+//        kernels). Sealed overlayfs is not attempted.
+//   - "ro-shared-page":        use sealed overlayfs only; fail
+//        container creation if it is not available.
+//
+// If the annotation is absent, use ModeUnset.
+//
+// Explicit values do not fall back to the other mechanism on failure; this is intentional.
+// if a caller has expressed a preference, getting the other mechanism silently defeats the
+// purpose of the annotation.
+// 
+// Unrecognized values, including empty string, return an error.
+func ParseMode(value string) (Mode, error) {
+	switch value {
+	case "independent-data-copy":
+		return ModeIndependentDataCopy, nil
+	case "ro-shared-page":
+		return ModeROSharedPage, nil
+	default:
+		return ModeUnset, fmt.Errorf(
+			"invalid %s value %q (want %q or %q)",
+			AnnotationKey, value,
+			"independent-data-copy", "ro-shared-page",
+		)
+	}
+}

libcontainer/exeseal/mode_test.go

@@ -0,0 +1,53 @@
+package exeseal
+
+import "testing"
+
+func TestParseMode(t *testing.T) {
+	cases := []struct {
+		in      string
+		want    Mode
+		wantErr bool
+	}{
+		{"independent-data-copy", ModeIndependentDataCopy, false},
+		{"ro-shared-page", ModeROSharedPage, false},
+		{"", ModeUnset, true},                       // empty must error, not default
+		{"auto", ModeUnset, true},                   // not a valid value in this scheme
+		{"independent_data_copy", ModeUnset, true},  // underscore typo
+		{"INDEPENDENT-DATA-COPY", ModeUnset, true},  // case-sensitive
+		{"ro-shared", ModeUnset, true},              // truncated
+		{"memfd-clone", ModeUnset, true},            // an earlier name we considered
+		{"clone-binary", ModeUnset, true},           // an even earlier name
+		{"ro-overlayfs", ModeUnset, true},           // implementation-named alternative
+	}
+	for _, tc := range cases {
+		t.Run(tc.in, func(t *testing.T) {
+			got, err := ParseMode(tc.in)
+			if (err != nil) != tc.wantErr {
+				t.Fatalf("ParseMode(%q) err=%v, wantErr=%v", tc.in, err, tc.wantErr)
+			}
+			if !tc.wantErr && got != tc.want {
+				t.Errorf("ParseMode(%q) = %v, want %v", tc.in, got, tc.want)
+			}
+		})
+	}
+}
+
+func TestModeStringRoundTrip(t *testing.T) {
+	// For every Mode that has a parseable string form, String() should
+	// produce something ParseMode accepts (and vice versa).
+	for _, m := range []Mode{ModeIndependentDataCopy, ModeROSharedPage} {
+		s := m.String()
+		got, err := ParseMode(s)
+		if err != nil {
+			t.Errorf("ParseMode(%q) (from Mode(%d).String()) failed: %v", s, int(m), err)
+			continue
+		}
+		if got != m {
+			t.Errorf("round trip: Mode %v -> %q -> Mode %v", m, s, got)
+		}
+	}
+	// ModeUnset deliberately has no parseable string form.
+	if s := ModeUnset.String(); s == "independent-data-copy" || s == "ro-shared-page" {
+		t.Errorf("ModeUnset.String() = %q collides with a valid annotation value", s)
+	}
+}

libcontainer/specconv/spec_linux.go

@@ -27,6 +27,7 @@ import (
 	"github.com/opencontainers/runc/libcontainer/configs"
 	"github.com/opencontainers/runc/libcontainer/internal/userns"
 	"github.com/opencontainers/runc/libcontainer/seccomp"
+	"github.com/opencontainers/runc/libcontainer/exeseal"
 )
 
 var (
@@ -432,6 +433,13 @@ func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error) {
 	}
 
 	config.Cgroups = c
+
+	cloneSelfExe, err := initCloneSelfExeMode(spec)
+	if err != nil {
+		return nil, err
+	}
+	config.CloneSelfExe = cloneSelfExe
+	
 	// set linux-specific config
 	if spec.Linux != nil {
 		initMaps()
@@ -775,6 +783,14 @@ func initSystemdProps(spec *specs.Spec) ([]systemdDbus.Property, error) {
 	return sp, nil
 }
 
+func initCloneSelfExeMode(spec *specs.Spec) (exeseal.Mode, error) {
+	value, ok := spec.Annotations[exeseal.AnnotationKey]
+	if !ok {
+		return exeseal.ModeUnset, nil
+	}
+	return exeseal.ParseMode(value)
+}
+
 func CreateCgroupConfig(opts *CreateOpts, defaultDevs []*devices.Device) (*cgroups.Cgroup, error) {
 	var (
 		myCgroupPath string