privileged helper: uname fails on RHEL 9 when /proc/sys/kernel/arch is absent #702

Summary

Privileged uname requests fail on RHEL 9 because the Landlock trusted-path list treats /proc/sys/kernel/arch as mandatory, but that procfs entry does not exist on RHEL 9.6.

This was found while QAing #700, but it appears to be pre-existing and unrelated to that PR's socket changes.

Environment

• RHEL 9.6 (Plow)
• Kernel 5.14.0-570.141.1.el9_6.x86_64
• SELinux: enforcing
• rshell commit tested: d57cc35c5040d8cc8e096551a39b4cf0d5c7eeb0

/proc/sys/kernel/arch is absent on this host. The other procfs files listed for rshell:uname are present.

Reproduction

Run the root privileged-helper integration test on RHEL 9:

sudo env \
  RSHELL_ROOT_INTEGRATION=1 \
  RSHELL_BINARY=/tmp/rshell \
  /tmp/rshell.test \
  -test.v \
  -test.run='^TestPrivilegedHelperRootIntegration$'

The preceding privileged commands (ps, ss, ip, and df) succeed. The uname -a request fails while building the Landlock policy:

execution_failed: apply privileged worker sandbox: apply Landlock policy:
build Landlock policy: open Landlock path "/proc/sys/kernel/arch":
no such file or directory

The failure originates from the fixed trusted-path list in cmd/rshell/privileged_worker_linux.go:

if allowed["rshell:uname"] {
    for _, path := range []string{
        "/proc/sys/kernel/ostype",
        "/proc/sys/kernel/hostname",
        "/proc/sys/kernel/osrelease",
        "/proc/sys/kernel/version",
        "/proc/sys/kernel/arch",
    } {
        trusted = append(trusted, trustedReadOnlyFile(path))
    }
}

Expected behavior

A permitted privileged uname command should run on supported RHEL 9 kernels. An optional procfs entry that is absent on a distro should not prevent construction of the entire worker sandbox.

Suggested direction

Treat /proc/sys/kernel/arch as optional when constructing/opening the trusted paths, or avoid granting it when the builtin can obtain the architecture through another source. Please retain fail-closed behavior for unexpected errors rather than ignoring every path-open failure.

For comparison, the same root integration test passed on Ubuntu 24.04 and Amazon Linux 2023, where /proc/sys/kernel/arch exists.