Require exact ACME mount boundary failure

Author: eldryoth

crates/fluxheim-acme/src/acme_directory.rs

@@ -321,14 +321,20 @@ mod tests {
         let _mount = BindMount(mount_point.clone());
 
         let boundary_directory = open_directory_no_symlinks(&boundary).unwrap();
-        assert!(
-            reconcile_private_directory_subtree(
-                &boundary,
-                &boundary_directory,
-                &mount_point.join("child"),
-                (65_534, 65_534),
-            )
-            .is_err()
+        let error = reconcile_private_directory_subtree(
+            &boundary,
+            &boundary_directory,
+            &mount_point.join("child"),
+            (
+                rustix::process::geteuid().as_raw(),
+                rustix::process::getegid().as_raw(),
+            ),
+        )
+        .unwrap_err();
+        assert_eq!(
+            error.raw_os_error(),
+            Some(rustix::io::Errno::XDEV.raw_os_error()),
+            "bind-mount traversal must be rejected by RESOLVE_NO_XDEV"
         );
 
         let after = std::fs::symlink_metadata(&outside).unwrap();

release-notes/RELEASE_NOTES_1.7.9.md

@@ -55,7 +55,10 @@ products.
   dedicated smoke using root-mapped user and private mount namespaces, without
   a privileged container. Hosts that disable user namespaces use a
   digest-pinned, network-isolated, read-only container with every capability
-  dropped except the mount operation's required `SYS_ADMIN` capability.
+  dropped except the mount operation's required `SYS_ADMIN` capability. The
+  regression requires the precise `EXDEV` result from Linux `RESOLVE_NO_XDEV`
+  using the namespace's mapped identity, so a later ownership error cannot
+  produce a false pass.
 - Managed ACME account generation now creates P-256 material in zeroizing
   RustCrypto secret/document types before importing it into Ring and retaining
   the durable copy in `sanitization::SecretVec`, removing the transient

scripts/validate-acme-mount-boundary-plan.sh

@@ -19,6 +19,8 @@ require_text() {
 }
 
 require_text "$test_source" '#[ignore = "requires an isolated privileged mount namespace"]'
+require_text "$test_source" 'Some(rustix::io::Errno::XDEV.raw_os_error())'
+require_text "$test_source" 'bind-mount traversal must be rejected by RESOLVE_NO_XDEV'
 require_text "$smoke" 'unshare --user --map-root-user --mount --propagation private --fork'
 require_text "$smoke" '--cap-drop ALL'
 require_text "$smoke" '--cap-add SYS_ADMIN'