procfs: let every task read its own /proc/self

[congwang-mk]

Fixes #218.

Problem

/proc/self resolves per caller, but a Landlock rule binds to the inode that exists when the rule is added. A read grant on /proc/self/maps therefore covered only the first process; every forked child has a different /proc/<pid>/maps and was denied. Landlock cannot express "the caller's own entry", and granting all of /proc instead would widen the policy and rely on a check-then-Continue that a CLONE_VM peer can race.

Change

What a task reads under /proc/self describes the task itself, so there is nothing for a grant to protect, while runtimes that read their own maps or status fail in obscure ways without one. These reads are now served for every task, with no grant:

• handle_proc_open opens the path inside /proc/<tgid> of the caller (task/<tid> for /proc/thread-self) with openat2(RESOLVE_BENEATH | RESOLVE_NO_SYMLINKS) and injects the fd. The kernel never re-reads the child's path string.
• Whatever the handler does not serve is left to Landlock, which holds no rule for it: writes are refused, and cwd, root, exe and fd/N are judged by their real target.
• fs_deny is honored under the numeric spelling of the caller's own directory too, which the string precheck would miss.
• /proc/self entries in the read list no longer become Landlock rules when a supervisor runs, so the first process is not treated differently from its children. With no_supervisor and in-process confine the rule stays, since it is then all there is. Chroot mode already services /proc on behalf of the child and is unchanged.
• learn stops recording these reads.

Also fixed: /proc/net virtualization bypass

First commit, independent of #218. /proc/net is a link to self/net, and every /proc/<pid> and /proc/<pid>/task/<tid> carries the same tree, but the handler only matched the /proc/net spelling. With /proc readable, /proc/self/net/dev and /proc/self/net/tcp showed the host's interfaces and sockets that /proc/net/dev and /proc/net/tcp hide. All per-task spellings are now rewritten to /proc/net before matching. This also keeps the net subtree (the host's network namespace, not the task's own data) out of the always-allowed reads; it still needs a /proc grant.

Not covered

Write grants under /proc/self still only cover the first process: #232.

Tests

• New integration tests in test_procfs.rs: forked child, the fd describing the caller rather than the first pid, a non-leader thread (/proc/self vs /proc/thread-self), and the refusals (writes, links out of /proc, the net subtree, fs_deny under both spellings), plus no_supervisor keeping a listed entry. Each refusal is paired with a read that must succeed, since /dev/null is not writable in these sandboxes. Disabling the link guard and the deny check each makes the matching test fail.
• test_proc_net_virt_covers_per_task_spellings reads net/dev through five spellings and expects loopback only.
• Two learn tests from fix(learn): agent workload bug fixes #209 that asserted /proc/self reads are recorded are replaced by one asserting they are not.
• Locally: sandlock-core 774 lib and 455 integration tests pass; learn_test 39 pass. Python and Go suites were not run locally.

🤖 Generated with Claude Code