fix: add nosuid/nodev to /etc/alternatives mount and block pidfd_getfd syscall

Address security audit findings N-1 and S-1:
- N-1: add missing nosuid and nodev flags to /etc/alternatives bind mount
  for consistency with other bind mounts
- S-1: block pidfd_getfd syscall in seccomp policy to prevent cross-process
  FD duplication within the PID namespace

Co-Authored-By: Claude <noreply@anthropic.com>

Author: koki-develop

e2e/tests/security/bind_mount_flags.yml

@@ -59,3 +59,23 @@ tests:
               exit_code: 0
               status: "OK"
               signal: null
+
+  - name: "/etc/alternatives is mounted with nosuid and nodev"
+    requests:
+      - input:
+          runtime: bash
+          files:
+            - name: main.sh
+              type: plain
+              content: |
+                grep ' /etc/alternatives ' /proc/mounts | tr ' ' '\n' | sed -n '4p' | tr ',' '\n' | grep -E '^(nosuid|nodev)$' | sort
+        output:
+          status: 200
+          body:
+            run:
+              stdout: "nodev\nnosuid\n"
+              stderr: ""
+              output: "nodev\nnosuid\n"
+              exit_code: 0
+              status: "OK"
+              signal: null

e2e/tests/security/seccomp_process.yml

@@ -144,3 +144,23 @@ tests:
               exit_code: 159
               status: "SIGNAL"
               signal: "SIGSYS"
+
+  - name: "pidfd_getfd is blocked by seccomp (ruby)"
+    requests:
+      - input:
+          runtime: ruby
+          files:
+            - name: main.rb
+              type: plain
+              content: |
+                syscall(438, -1, 0, 0)
+        output:
+          status: 200
+          body:
+            run:
+              stdout: ""
+              stderr: ""
+              output: ""
+              exit_code: 159
+              status: "SIGNAL"
+              signal: "SIGSYS"

internal/sandbox/configs/nsjail.cfg

@@ -135,6 +135,8 @@ mount {
     src: "/etc/alternatives"
     dst: "/etc/alternatives"
     is_bind: true
+    nosuid: true
+    nodev: true
 }
 
 # Device files commonly opened by sandboxed programs.

internal/sandbox/configs/seccomp.kafel

@@ -111,6 +111,14 @@ POLICY blocked {
         // process_vm_readv/process_vm_writev.
         process_madvise,
 
+        // -- Cross-process FD duplication --
+        // pidfd_getfd (Linux 5.6+): can duplicate file descriptors from other
+        // processes within the PID namespace, bypassing normal permission checks.
+        // pidfd_open and pidfd_send_signal are intentionally allowed as they are
+        // constrained by PID namespace and provide no additional capability
+        // beyond kill()/waitpid().
+        pidfd_getfd,
+
         // -- Kernel keyring --
         // The kernel keyring is not namespaced and can leak information between
         // containers. Also used in kernel exploit chains.