runsc:gofer: don't mount a new proc instance

If the existing proc instance has over-mounted areas, it can be
impossible to mount a new /proc instance (look at SB_I_USERNS_VISIBLE
for more details).

Actually, runsc-gofer needs /proc just to open /proc/self/fd and to read
a few generic files, so it doesn't need a proc instance of the target
pid namespace.

Fixes #8205

PiperOrigin-RevId: 609634818

runsc/boot/loader_test.go

@@ -42,7 +42,7 @@ import (
 func init() {
 	log.SetLevel(log.Debug)
 	rand.Seed(time.Now().UnixNano())
-	if err := fsgofer.OpenProcSelfFD(); err != nil {
+	if err := fsgofer.OpenProcSelfFD("/proc/self/fd"); err != nil {
 		panic(err)
 	}
 }

runsc/cmd/gofer.go

@@ -219,7 +219,11 @@ func (g *Gofer) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcomm
 	// modes exactly as sent by the sandbox, which will have applied its own umask.
 	unix.Umask(0)
 
-	if err := fsgofer.OpenProcSelfFD(); err != nil {
+	procFDPath := procFDBindMount
+	if conf.TestOnlyAllowRunAsCurrentUserWithoutChroot {
+		procFDPath = "/proc/self/fd"
+	}
+	if err := fsgofer.OpenProcSelfFD(procFDPath); err != nil {
 		util.Fatalf("failed to open /proc/self/fd: %v", err)
 	}
 
@@ -358,6 +362,10 @@ func (g *Gofer) writeMounts(mounts []specs.Mount) error {
 	return nil
 }
 
+// Redhat distros don't allow to create bind-mounts in /proc/self directories.
+// It is protected by selinux rules.
+const procFDBindMount = "/proc/fs"
+
 func (g *Gofer) setupRootFS(spec *specs.Spec, conf *config.Config) error {
 	// Convert all shared mounts into slaves to be sure that nothing will be
 	// propagated outside of our namespace.
@@ -375,36 +383,38 @@ func (g *Gofer) setupRootFS(spec *specs.Spec, conf *config.Config) error {
 		// We need a directory to construct a new root and we know that
 		// runsc can't start without /proc, so we can use it for this.
 		flags := uintptr(unix.MS_NOSUID | unix.MS_NODEV | unix.MS_NOEXEC)
-		if err := specutils.SafeMount("runsc-root", "/proc", "tmpfs", flags, "", procPath); err != nil {
+		if err := specutils.SafeMount("runsc-root", "/proc/fs", "tmpfs", flags, "", procPath); err != nil {
 			util.Fatalf("error mounting tmpfs: %v", err)
 		}
-
+		if err := unix.Mount("", "/proc/fs", "", unix.MS_UNBINDABLE, ""); err != nil {
+			util.Fatalf("error setting MS_UNBINDABLE")
+		}
 		// Prepare tree structure for pivot_root(2).
-		if err := os.Mkdir("/proc/proc", 0755); err != nil {
-			util.Fatalf("error creating /proc/proc: %v", err)
+		if err := os.Mkdir("/proc/fs/proc", 0755); err != nil {
+			util.Fatalf("error creating /proc/fs/proc: %v", err)
 		}
-		if err := os.Mkdir("/proc/root", 0755); err != nil {
-			util.Fatalf("error creating /proc/root: %v", err)
+		if err := os.Mkdir("/proc/fs/root", 0755); err != nil {
+			util.Fatalf("error creating /proc/fs/root: %v", err)
 		}
-		if err := os.Mkdir("/proc/etc", 0755); err != nil {
-			util.Fatalf("error creating /proc/etc: %v", err)
+		if err := os.Mkdir("/proc/fs/etc", 0755); err != nil {
+			util.Fatalf("error creating /proc/fs/etc: %v", err)
 		}
 		// This cannot use SafeMount because there's no available procfs. But we
-		// know that /proc is an empty tmpfs mount, so this is safe.
-		if err := unix.Mount("runsc-proc", "/proc/proc", "proc", flags|unix.MS_RDONLY, ""); err != nil {
-			util.Fatalf("error mounting proc: %v", err)
+		// know that /proc/fs is an empty tmpfs mount, so this is safe.
+		if err := unix.Mount("/proc", "/proc/fs/proc", "", flags|unix.MS_RDONLY|unix.MS_BIND|unix.MS_REC, ""); err != nil {
+			util.Fatalf("error mounting /proc/fs/proc: %v", err)
 		}
 		// self/fd is bind-mounted, so that the FD return by
 		// OpenProcSelfFD() does not allow escapes with walking ".." .
-		if err := unix.Mount("/proc/proc/self/fd", "/proc/proc/self/fd",
-			"", unix.MS_RDONLY|unix.MS_BIND|unix.MS_NOEXEC, ""); err != nil {
+		if err := unix.Mount("/proc/fs/proc/self/fd", "/proc/fs/"+procFDBindMount,
+			"", unix.MS_RDONLY|unix.MS_BIND|flags, ""); err != nil {
 			util.Fatalf("error mounting proc/self/fd: %v", err)
 		}
-		if err := copyFile("/proc/etc/localtime", "/etc/localtime"); err != nil {
+		if err := copyFile("/proc/fs/etc/localtime", "/etc/localtime"); err != nil {
 			log.Warningf("Failed to copy /etc/localtime: %v. UTC timezone will be used.", err)
 		}
-		root = "/proc/root"
-		procPath = "/proc/proc"
+		root = "/proc/fs/root"
+		procPath = "/proc/fs/proc"
 	}
 
 	rootfsConf := g.mountConfs[0]
@@ -461,7 +471,7 @@ func (g *Gofer) setupRootFS(spec *specs.Spec, conf *config.Config) error {
 	}
 
 	if !conf.TestOnlyAllowRunAsCurrentUserWithoutChroot {
-		if err := pivotRoot("/proc"); err != nil {
+		if err := pivotRoot("/proc/fs"); err != nil {
 			util.Fatalf("failed to change the root file system: %v", err)
 		}
 		if err := os.Chdir("/"); err != nil {

runsc/fsgofer/lisafs.go

@@ -69,8 +69,8 @@ var procSelfFD *rwfd.FD
 
 // OpenProcSelfFD opens the /proc/self/fd directory, which will be used to
 // reopen file descriptors.
-func OpenProcSelfFD() error {
-	d, err := unix.Open("/proc/self/fd", unix.O_RDONLY|unix.O_DIRECTORY, 0)
+func OpenProcSelfFD(path string) error {
+	d, err := unix.Open(path, unix.O_RDONLY|unix.O_DIRECTORY, 0)
 	if err != nil {
 		return fmt.Errorf("error opening /proc/self/fd: %v", err)
 	}

runsc/fsgofer/lisafs_test.go

@@ -28,7 +28,7 @@ import (
 
 func init() {
 	log.SetLevel(log.Debug)
-	if err := fsgofer.OpenProcSelfFD(); err != nil {
+	if err := fsgofer.OpenProcSelfFD("/proc/self/fd"); err != nil {
 		panic(err)
 	}
 }