[antlir2][container_subtarget] support booted rootless containers

Summary: Finally support `--boot` on `[container]` subtargets with rootless images.

Test Plan:
```
❯ buck2 test fbcode//antlir/antlir2/container_subtarget/tests:test -- test_rooted_boot_exit_code test_rootless_boot_exit_code
Buck UI: https://www.internalfb.com/buck2/97729d52-cef4-4b10-b06f-f4460618a6d7
Tests finished: Pass 2. Fail 0. Timeout 0. Fatal 0. Skip 0. Omit 0. Infra Failure 0. Build failure 0
```
https://www.internalfb.com/intern/testinfra/testrun/18014398697563779

Reviewed By: sergeyfd

Differential Revision: D113495962

fbshipit-source-id: d059f16cece7a72c1c1e9703597b1a40fae7511d

Author: vmagro

antlir/antlir2/antlir2_isolate/isolate_unshare/isolate_unshare_preexec/src/isolation.rs

@@ -18,6 +18,7 @@ use anyhow::Result;
 use cap_std::fs::Dir;
 use cap_std::fs::OpenOptionsExt as _;
 use isolate_cfg::Ephemeral;
+use isolate_cfg::InvocationType;
 use isolate_cfg::IsolationContext;
 use nix::mount::MsFlags;
 use nix::mount::mount;
@@ -233,6 +234,30 @@ pub(crate) fn setup_isolation(isol: &IsolationContext) -> Result<()> {
                 .with_context(|| format!("while mounting device node '{devname}'"))?;
             }
 
+            // For an interactive booted container, systemd (as PID 1) provides
+            // a login shell bound to /dev/console. Bind the controlling
+            // terminal (inherited as stdin) onto /dev/console so console I/O
+            // flows back to the caller, mirroring what
+            // `systemd-nspawn --console=interactive` does.
+            // SAFETY: `isatty` merely queries whether the given fd refers to a
+            // terminal and has no preconditions or memory safety concerns.
+            let stdin_is_tty = unsafe { libc::isatty(0) } == 1;
+            if matches!(invocation_type, InvocationType::BootInteractive) && stdin_is_tty {
+                let tty = std::fs::read_link("/proc/self/fd/0")
+                    .context("while resolving controlling terminal for /dev/console")?;
+                let console = tmpfs
+                    .create("console")
+                    .context("while creating device file 'console'")?;
+                nix::mount::mount(
+                    Some(tty.as_path()),
+                    &console.abspath(),
+                    None::<&str>,
+                    MsFlags::MS_BIND | MS_NOSYMFOLLOW,
+                    None::<&str>,
+                )
+                .context("while mounting device node 'console'")?;
+            }
+
             // Things like `sem_open` requires a usable `/dev/shm`.
             tmpfs
                 .create_dir("shm")

antlir/antlir2/antlir2_isolate/isolate_unshare/isolate_unshare_preexec/src/main.rs

@@ -17,6 +17,7 @@ use anyhow::Result;
 use anyhow::anyhow;
 use clap::Parser;
 use isolate_cfg::Ephemeral;
+use isolate_cfg::InvocationType;
 use isolate_cfg::IsolationContext;
 use json_arg::Json;
 use nix::sched::CloneFlags;
@@ -100,6 +101,25 @@ fn do_main(args: Main) -> Result<()> {
         ctx.ephemeral = None;
     }
 
+    // For an interactive booted container, the login shell launched by systemd
+    // wants to acquire the container's console (/dev/console, which we bind to
+    // our inherited controlling terminal) as its controlling terminal. That
+    // terminal is owned by the parent user namespace, so the container cannot
+    // *steal* it (TIOCSCTTY force requires CAP_SYS_ADMIN in the owning
+    // namespace). Release it from our session here — while it is unowned, the
+    // container can acquire it cleanly without any capability.
+    //
+    // SAFETY: these libc calls only manipulate this process's controlling
+    // terminal / signal disposition and have no memory safety implications.
+    if ctx.invocation_type == InvocationType::BootInteractive && unsafe { libc::isatty(0) } == 1 {
+        unsafe {
+            // Ignore the SIGHUP that releasing the controlling terminal sends to
+            // our (foreground) process group, so it does not kill us.
+            libc::signal(libc::SIGHUP, libc::SIG_IGN);
+            libc::ioctl(0, libc::TIOCNOTTY);
+        }
+    }
+
     let mut pid1 = Command::new(std::env::current_exe().context("while getting current exe")?);
     pid1.arg("pid1")
         .arg(serde_json::to_string(&ctx).context("while serializing isolation info")?);

antlir/antlir2/antlir2_isolate/isolate_unshare/src/lib.rs

@@ -11,7 +11,6 @@ compile_error!("only supported on linux");
 use std::ffi::OsStr;
 use std::process::Command;
 
-use isolate_cfg::InvocationType;
 use isolate_cfg::IsolationContext;
 
 pub mod mount;
@@ -36,12 +35,6 @@ impl<'a> IsolatedContext<'a> {
         if self.0.register {
             return Err(Error::UnsupportedSetting("register"));
         }
-        // TODO: support this when we can bind the controlling terminal to
-        // /dev/console, otherwise don't lie about providing an interactive
-        // console
-        if self.0.invocation_type == InvocationType::BootInteractive {
-            return Err(Error::UnsupportedSetting("invocation_type=BootInteractive"));
-        }
 
         let mut cmd = Command::new(
             buck_resources::get("antlir/antlir2/antlir2_isolate/isolate_unshare/preexec")

antlir/antlir2/container_subtarget/src/main.rs

@@ -40,7 +40,7 @@ struct Args {
     user: String,
     #[clap(long, conflicts_with_all = ["boot"])]
     pipe: bool,
-    #[clap(long, conflicts_with_all = ["pipe", "rootless"])]
+    #[clap(long, conflicts_with_all = ["pipe"])]
     boot: bool,
     #[clap(long)]
     chdir: Option<PathBuf>,
@@ -101,14 +101,13 @@ fn main() -> anyhow::Result<()> {
         .ephemeral(true)
         .tmpfs(Path::new("/tmp"))
         .enable_network(args.enable_network);
-    if !args.rootless {
-        cmd_builder.invocation_type(match (args.boot, args.pipe) {
-            (true, false) => InvocationType::BootInteractive,
-            (true, true) => unreachable!("--boot and --pipe are mutually exclusive"),
-            (false, true) => InvocationType::Pid2Pipe,
-            (false, false) => InvocationType::Pid2Interactive,
-        });
-    } else {
+    cmd_builder.invocation_type(match (args.boot, args.pipe) {
+        (true, false) => InvocationType::BootInteractive,
+        (true, true) => unreachable!("--boot and --pipe are mutually exclusive"),
+        (false, true) => InvocationType::Pid2Pipe,
+        (false, false) => InvocationType::Pid2Interactive,
+    });
+    if args.rootless {
         cmd_builder.devtmpfs(Path::new("/dev"));
     }
     if args.artifacts_require_repo {
@@ -133,6 +132,22 @@ fn main() -> anyhow::Result<()> {
             PathBuf::from("/run/systemd/system/container-subtarget.service"),
             container_subtarget_service,
         ));
+        // In rootless mode there is no `systemd-nspawn --boot` to locate and
+        // exec the init binary, so it must be invoked explicitly. In rooted
+        // mode systemd-nspawn interprets the trailing argument as a kernel
+        // command line and boots init itself.
+        if args.rootless {
+            // systemd mounts a fresh tmpfs over /run early in boot, which would
+            // otherwise mask the unit file bind-mounted above.
+            cmd_builder.tmpfs(Path::new("/run"));
+            // Provide a fake sysfs (with a cgroup2 hierarchy mounted underneath)
+            // so systemd does not mount the host's real sysfs. Otherwise
+            // systemd resolves /dev/console via /sys/class/tty/console/active to
+            // the host's console device (e.g. /dev/hvc0), which does not exist
+            // in the container.
+            cmd_builder.sysfs(Path::new("/sys"));
+            cmd.insert(0, "/usr/lib/systemd/systemd".into());
+        }
         cmd.push("systemd.unit=container-subtarget.service".into());
     }
     let mut cmd = cmd.into_iter();

antlir/antlir2/container_subtarget/tests/test.rs

@@ -77,3 +77,23 @@ fn test_rooted_boot_exit_code() {
         status => panic!("unexpected exit status: {status:?}"),
     }
 }
+
+#[test]
+fn test_rootless_boot_exit_code() {
+    let exe = std::env::var("ROOTLESS").expect("missing env var");
+    let mut p = rexpect::spawn(&format!("{exe} --boot --no-register"), TIMEOUT_MS)
+        .expect("failed to spawn");
+    p.exp_regex("[^\n\r](.*?)# ")
+        .expect("didn't get bash prompt");
+    p.send_line("systemctl is-system-running")
+        .expect("failed to write shell command line");
+    p.exp_regex("running")
+        .expect("didn't get 'running' response from systemctl is-system-running");
+    p.send_line("exit 42")
+        .expect("failed to write shell command line");
+    let status = p.process.wait().expect("failed to wait for process");
+    match status {
+        WaitStatus::Exited(_, real_code) => assert_eq!(42, real_code),
+        status => panic!("unexpected exit status: {status:?}"),
+    }
+}