jail: harden CLONE_NEWUSER handling, fix dependency RPATH/RUNPATH support

container.h

@@ -18,6 +18,9 @@
 #include <stdbool.h>
 #include <sys/stat.h>
 
+#define PROCD_NOAFILE_DIR "/tmp/.ujail"
+#define PROCD_NOAFILE PROCD_NOAFILE_DIR "/noafile"
+
 static inline bool is_container() {
 	struct stat s;
 	int r = stat("/.dockerenv", &s);

initd/early.c

@@ -52,6 +52,25 @@ early_console(const char *dev)
 	fcntl(STDERR_FILENO, F_SETFL, fcntl(STDERR_FILENO, F_GETFL) | O_NONBLOCK);
 }
 
+static void
+early_noafile(void)
+{
+	int fd;
+
+	mkdir(PROCD_NOAFILE_DIR, 0000);
+	if (mount("tmpfs", PROCD_NOAFILE_DIR, "tmpfs",
+		  MS_NOSUID | MS_NODEV | MS_NOEXEC, "size=4k,mode=000"))
+		return;
+
+	fd = creat(PROCD_NOAFILE, 0000);
+	if (fd >= 0)
+		close(fd);
+
+	if (mount(NULL, PROCD_NOAFILE_DIR, NULL,
+		  MS_REMOUNT | MS_RDONLY | MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL))
+		ERROR("failed to lock %s read-only: %m\n", PROCD_NOAFILE_DIR);
+}
+
 static void
 early_mounts(void)
 {
@@ -73,6 +92,7 @@ early_mounts(void)
 	early_console("/dev/console");
 
 	mount("tmpfs", "/tmp", "tmpfs", MS_NOSUID | MS_NODEV | MS_NOATIME, "mode=01777");
+	early_noafile();
 	mkdir("/tmp/shm", 01777);
 
 	mkdir("/tmp/run", 0755);

jail/cgroups.c

@@ -96,6 +96,8 @@ void cgroups_free(void)
 			free(valp);
 		}
 		free(cgroup_path);
+		cgroup_path = NULL;
+		initialized = false;
 	}
 }