session-wrapper: refactor child setup for fork safety, credentials, Landlock, and seccomp ordering

[Rod-Persky]

Parent epic: #152

session-wrapper: refactor child setup for fork safety, credentials, Landlock, and seccomp ordering

Objective

Refactor child process setup so TACACS+ profile fetch, descriptor hygiene, credential setup, Landlock, seccomp user notification, and final privilege drop compose safely.

Breaking changes are allowed. The final order should match the secure production model even if it requires changing current APIs or tests.

Required Setup Order

After the parent has fetched and validated the TACACS+ profile, the child setup should follow this shape:

child after fork:
  close inherited profile-fetch/runtime descriptors
  prepare target group credentials while privileged
  if privilege elevation is none, set no_new_privs
  if privilege elevation is sudo, retain setup capability and do not set no_new_privs
  apply Landlock ruleset
  close Landlock rule descriptors
  install seccomp user-notification filter
  send seccomp notification fd to parent
  wait for parent ready byte
  drop final UID privileges
  exec shell

Credential Requirements

• Split the current privilege-drop helper. Do not move it wholesale.
• Group setup can consult NSS and must happen before Landlock narrows read access.
• Final UID drop happens after Landlock/seccomp setup and before shell exec.
• No untrusted code may run between privileged setup phases and final shell exec.
• Default landlock-privilege-elevation=none sessions set no_new_privs before Landlock.
• landlock-privilege-elevation=sudo sessions do not set no_new_privs, because doing so would break setuid sudo. They must instead apply Landlock while still privileged enough to call landlock_restrict_self.

Descriptor Hygiene

• The child must close inherited TACACS+ IPC/profile-fetch descriptors.
• The child may use Landlock path fds only while building the ruleset, then must close them.
• The only descriptors intentionally inherited into the shell should be stdio and explicit session plumbing.
• Add a test or debug assertion strategy to prevent accidental descriptor inheritance.

Seccomp Requirements

• Install seccomp user notification before the initial shell exec so the shell exec is mediated.
• Keep existing P0 syscall denies unless a later issue deliberately revisits them.
• Send the seccomp notification fd to the parent and wait for parent readiness before shell exec.

Acceptance Criteria

• Tests prove profile-fetch descriptors are not inherited into the shell.
• Tests cover default mode setting no_new_privs.
• Tests cover sudo mode not setting no_new_privs and still applying Landlock/seccomp before shell exec.
• Existing process lifecycle tests are updated to match the new order.
• The child never execs the shell when Landlock/seccomp setup fails in enforce mode.