COW: mediate openat2 and renameat; build the restore stub without SSP

[congwang-mk]

Summary

Two COW mediation gaps and one restore-stub build fix.

• openat2 bypassed COW. The COW dispatch registration and the notif syscall list covered only openat and legacy open, so a raw openat2 under the workdir went straight to the kernel with the child's Landlock write grant. An O_CREAT/O_TRUNC open mutated the real workdir and survived an abort; a read-only open could see stale lower content past a whiteout. The handler now uses the shared decode_open_args, which reads flags and mode out of struct open_how for openat2.
• renameat bypassed COW. Same shape: renameat2 and legacy rename were registered, renameat was not. On aarch64 this covered every ordinary rename, since libc's rename() compiles to renameat there. The chroot lists already carried it for that reason.
• Restore stub built with a stack protector. A compiler that enables SSP by default (vanilla GCC; Ubuntu's spec exempts -ffreestanding) emits a canary load from %fs:0x28 in the freestanding stub, which runs with a zero thread pointer until it restores the checkpoint's. Every restore then died with SIGSEGV at address 0x28 before the READY handshake. build.rs now passes -fno-stack-protector, and build_static also treats the binary as stale when it is older than build.rs, since a flag change previously never recompiled an existing stub.

Tests

• test_seccomp_cow_openat2_syscall: raw openat2 with a 24-byte open_how under an abort branch; asserts the file is visible inside and gone after abort.
• test_seccomp_cow_renameat_syscall: raw renameat (264 on x86_64, 38 on aarch64, renameat2 fallback on riscv64) under an abort branch; asserts the original name is back after abort.
• stub_carries_no_stack_protector: scans the built stub for the x86_64 canary load bytes. Validated against a stub deliberately compiled with -fstack-protector-all (3 hits) and the fixed stub (0 hits).

Both COW tests were confirmed to fail before their fix.

🤖 Generated with Claude Code