A zone binds its images' /usr through a descriptor opened as host root, as it does the broker's socket

[DevomB]

Round 4 (Distro 38765674759) mounted every image once #531 gave them 4 KiB blocks. Every zone that names images then failed one step later, building its root:

kryptikd[zone upimg]: could not build the zone root: mount(bind)(/var/lib/kryptik/zones/upimg/usr): Permission denied (os error 13)

It failed on all four probe runs in the update, install and build/production parts, and the zones that carry the browser would hit the same error.

Cause. images::prepare stacks the set at /run/kryptik/usr/<set>, and /run/kryptik is 0700 host root. rootfs::pivot_into binds that path onto the zone's /usr from pid 1, after the zone's ids are taken. As the mapped root, pid 1 cannot search /run/kryptik, so looking up the bind's source fails with EACCES. The ext4 and overlay mounts are fine, because kryptikd makes them as host root and overlayfs reads its lowers with the mounter's credentials. Only zones that name images take this path, and none do on main.

Fix. This is the broker socket's pattern. intermediate_main opens the set's directory O_PATH | O_DIRECTORY | O_NOFOLLOW where it opens the broker's and the Wayland socket's descriptors:

• after the mount namespace is unshared, so a bind from /proc/self/fd passes the mount-namespace check;
• before setresuid, while its kuid is still host 0, the owner of /run/kryptik.

pivot_into then binds /proc/self/fd/N, and bind_ro_dir follows the magic link. pid 1 inherits the descriptor, and its descriptor sweep closes it, as with the broker's. A zone with no images keeps the root's /usr path. /run/kryptik stays 0700, and software-delivery.md says how the bind reaches the set.

No unit test can show this without a user namespace and a real mount. The proof is acceptance's probe checks (update, install, production) and the zones and desktop parts' zones that carry the browser.