init: write sysctls using safe procfs API

sysctls could in principle also be used as a write gadget for arbitrary
procfs files. As this requires getting a non-subset=pid /proc handle we
amortise this by only allocating a single procfs handle for all sysctl
writes.

Fixes: GHSA-cgrx-mc8f-2prm CVE-2025-52881
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>

internal/sys/sysctl_linux.go

@@ -0,0 +1,54 @@
+package sys
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"golang.org/x/sys/unix"
+
+	"github.com/cyphar/filepath-securejoin/pathrs-lite"
+	"github.com/cyphar/filepath-securejoin/pathrs-lite/procfs"
+)
+
+func procfsOpenRoot(proc *procfs.Handle, subpath string, flags int) (*os.File, error) {
+	handle, err := proc.OpenRoot(subpath)
+	if err != nil {
+		return nil, err
+	}
+	defer handle.Close()
+
+	return pathrs.Reopen(handle, flags)
+}
+
+// WriteSysctls sets the given sysctls to the requested values.
+func WriteSysctls(sysctls map[string]string) error {
+	// We are going to write multiple sysctls, which require writing to an
+	// unmasked procfs which is not going to be cached. To avoid creating a new
+	// procfs instance for each one, just allocate one handle for all of them.
+	proc, err := procfs.OpenUnsafeProcRoot()
+	if err != nil {
+		return err
+	}
+	defer proc.Close()
+
+	for key, value := range sysctls {
+		keyPath := strings.ReplaceAll(key, ".", "/")
+
+		sysctlFile, err := procfsOpenRoot(proc, "sys/"+keyPath, unix.O_WRONLY|unix.O_TRUNC|unix.O_CLOEXEC)
+		if err != nil {
+			return fmt.Errorf("open sysctl %s file: %w", key, err)
+		}
+		defer sysctlFile.Close()
+
+		n, err := io.WriteString(sysctlFile, value)
+		if n != len(value) && err == nil {
+			err = fmt.Errorf("short write to file (%d bytes != %d bytes)", n, len(value))
+		}
+		if err != nil {
+			return fmt.Errorf("failed to write sysctl %s = %q: %w", key, value, err)
+		}
+	}
+	return nil
+}