Unnecessary UDS Bind Mount (/tmp/container_launcher/) in image/kps_runner.sh

[atulpatildbz]

Problem Description

In image/kps_runner.sh, the container launcher runs ctr run with the following bind mount:
--mount "type=bind,src=/tmp/container_launcher/,dst=/run/container_launcher/,options=rbind:rw"

However, kps_runner.sh explicitly sets:

• SERVICE_ROLE="SERVICE_ROLE_KPS"
• KEY_PROTECTION_MECHANISM="KEY_PROTECTION_VM"

Under SERVICE_ROLE_KPS and KEY_PROTECTION_VM, the agent binary (cmd/agent/main.go) initializes runKps(), which listens exclusively on network gRPC over TCP port 50050 (--net-host). It never opens or communicates over the Unix Domain Socket at /run/container_launcher/kmaserver.sock (which is used by runWsd() on the Workload VM in Vanguard/WSD mode).

Impact & Security Risk

Exposing /tmp/container_launcher/ as read-write (rbind:rw) to the KPS container introduces:

1. Unnecessary Host Attack Surface: Exposes host /tmp/ filesystem state to the container.
2. Directory Pollution Vector: Allows potential container processes to write symlinks/files or exhaust disk inodes on host /tmp.

Recommended Remediation

Remove the --mount "type=bind,src=/tmp/container_launcher/,dst=/run/container_launcher/,options=rbind:rw" argument from image/kps_runner.sh.

Context

Referenced in PR #66 (#66).