[Low] RemountReadOnly is non-recursive, so submounts under a recursively bound image volume stay writable #2933

Summary

StageImageVolume bind-mounts an image volume into the virtio-fs share with MS_BIND|MS_REC, then calls RemountReadOnly, which remounts with MS_BIND|MS_REMOUNT|MS_RDONLY and no MS_REC. Only the top mount becomes read-only. Any mount nested under the source keeps its original flags.

Details

cmd/ateworker-microvm/internal/kata/overlay_linux.go#L211-L222:

func RemountReadOnly(dst string) error {
	var st unix.Statfs_t
	if err := unix.Statfs(dst, &st); err != nil {
		return fmt.Errorf("statfs %q: %w", dst, err)
	}
	flags := unix.MS_BIND | unix.MS_REMOUNT | unix.MS_RDONLY |
		int(st.Flags&(unix.ST_NOSUID|unix.ST_NODEV|unix.ST_NOEXEC|unix.ST_NOATIME|unix.ST_NODIRATIME))
	if err := unix.Mount("", dst, "", uintptr(flags), ""); err != nil {
		return err
	}
	return nil
}

Impact

Low: image volumes are currently either a single bind of an unpacked layer or an overlayfs with empty upper/work dirs (internal/imagecache/bundle_linux.go), so there are no submounts to leave writable. If a composed volume ever gains nested mounts, a guest could write through them into host-side layer data shared with other actors.

Suggested fix

Use mount_setattr(2) with AT_RECURSIVE and MOUNT_ATTR_RDONLY (unix.MountSetattr) on the bind, or create the bind with open_tree(OPEN_TREE_CLONE|AT_RECURSIVE) and set it read-only before move_mount. Add a test with a nested mount under the source.