fix(daemon): accept single-uid userns overflow-owned ancestors (#1830) - #2138

Problem

Inside a single-uid user namespace (unshare -U --map-current-user, podman --userns=keep-id), the root-owned top-level ancestors (/, /tmp) appear owned by the kernel overflow uid (nobody). The daemon's directory-security walk refused every overflow-owned ancestor, so it could not create its private runtime directory and refused to start in that legitimate setup.

Fix (#1830)

Accept an overflow-owned ancestor only when /proc/self/uid_map is a single-uid map (exactly one line, count == 1, inside == euid) and /proc/sys/kernel/overflowuid is readable (the value is read from /proc, never hardcoded; unreadable ⇒ no tolerance). No environment escape hatch. Group-writable-overflow ancestors are refused (an unmapped owner's host group is unknowable); world-writable-overflow is tolerated only with the sticky bit (the /tmp shape).

Why it's safe

The tolerance is confined to the ancestor walk (posix_directory_parent_secure, posix_directory_transition_secure). The directories that actually hold data stay strict == geteuid(): the created-dir recheck (ipc.c:1687) and the final-dir gate (ipc.c:1714). These two euid gates are the security-critical backstop — a host-squatted, overflow-owned private directory is still refused there, so the overflow tolerance only widens which ancestors the walk may traverse, never the destination. In a single-uid namespace uid_map is write-once/immutable and no in-namespace principal can own or mutate an overflow-owned file, so an overflow-owned ancestor is exactly as safe as a root-owned one on the host.

Verification

• The single-uid gate refuses a multi-uid map, count != 1, inside != euid, and any second mapping line; a mapped-out foreign uid is refused even with tolerance ON.
• macOS 52 / 1-skip; Linux (Colima arm64, gcc) 47 / 1-skip — exercises the __linux__ /proc path, plus a real unshare(CLONE_NEWUSER) end-to-end smoke (whitelisted-skip where userns is unavailable).
• RED-on-revert: neutering the overflow clause fails the ancestor-decision test; restoring is byte-identical and green.
• clang-format + cppcheck clean; localized to src/daemon/ipc.c (+ test seams).

Adversarially reviewed as a security-boundary change: no privilege-boundary fail-open found; the safety rests on the two == geteuid() gates above staying strict.