runsc: Terminal support for "docker exec -ti".

This CL adds terminal support for "docker exec".  We previously only supported
consoles for the container process, but not exec processes.

The SYS_IOCTL syscall was added to the default seccomp filter list, but only
for ioctls that get/set winsize and termios structs. We need to allow these
ioctl for all containers because it's possible to run "exec -ti" on a
container that was started without an attached console, after the filters
have been installed.

Note that control-character signals are still not properly supported.

Tested with:
	$ docker run --runtime=runsc -it alpine
In another terminial:
	$ docker exec -it <containerid> /bin/sh

PiperOrigin-RevId: 210185456
Change-Id: I6d2401e53a7697bb988c120a8961505c335f96d9

1 files changed, 7 insertions, 10 deletions

diff --git a/pkg/sentry/control/proc.go b/pkg/sentry/control/proc.go
index d94ae560f..2493c5175 100644
--- a/pkg/sentry/control/proc.go
+++ b/pkg/sentry/control/proc.go
@@ -19,7 +19,6 @@ import (
 	"encoding/json"
 	"fmt"
 	"sort"
-	"syscall"
 	"text/tabwriter"
 	"time"
 
@@ -73,6 +72,10 @@ type ExecArgs struct {
 	// Capabilities is the list of capabilities to give to the process.
 	Capabilities *auth.TaskCapabilities
 
+	// StdioIsPty indicates that FDs 0, 1, and 2 are connected to a host
+	// pty fd.
+	StdioIsPty bool
+
 	// FilePayload determines the files to give to the new process.
 	urpc.FilePayload
 }
@@ -108,17 +111,11 @@ func (proc *Proc) Exec(args *ExecArgs, waitStatus *uint32) error {
 	mounter := fs.FileOwnerFromContext(ctx)
 
 	for appFD, f := range args.FilePayload.Files {
-		// Copy the underlying FD.
-		newFD, err := syscall.Dup(int(f.Fd()))
-		if err != nil {
-			return err
-		}
-		f.Close()
+		enableIoctl := args.StdioIsPty && appFD <= 2
 
-		// Install the given file as an FD.
-		file, err := host.NewFile(ctx, newFD, mounter)
+		// Import the given file FD. This dups the FD as well.
+		file, err := host.ImportFile(ctx, int(f.Fd()), mounter, enableIoctl)
 		if err != nil {
-			syscall.Close(newFD)
 			return err
 		}
 		defer file.DecRef()