[FEATURE] Allocate container console PTY from container's private devpts instance to prevent host /dev/pts leakage` #369

Problem Description

Currently, when Droidspaces initializes a container console (e.g., in src/daemon.c / src/terminal.c), the PTY pair is allocated from the host's mount namespace by opening /dev/ptmx on the host side before or during container startup.

On Android, this causes two noticeable issues:

1. Host /dev/pts Pollution & Detection Leakage:
   A slave PTY node (e.g., /dev/pts/2) is created under the host's /dev/pts directory with uid=0 (root) and SELinux context u:object_r:devpts:s0. On Android, normal apps (untrusted_app, UID >= 10000) own their respective PTYs, and ADB shell sessions belong to AID_SHELL (2000). A persistent uid=0 PTY slave on the host's /dev/pts never occurs naturally on stock Android and immediately exposes the presence of a running root daemon/container to runtime environment detectors (flagged as Abnormal Permission: Found ROOT PTY).
2. Namespace Isolation & Security:
   Sharing the host's devpts instance with the container violates standard Linux container isolation practices and historically exposes containers to terminal injection boundary issues (e.g., TIOCSTI concerns if FDs are ever inherited across contexts).

Proposed Solution (Container-Private devpts)

Following industry-standard container runtimes (runc, LXC, systemd-nspawn), the console PTY should be allocated strictly from the container's own isolated devpts instance:

1. Mount a private devpts instance inside the container's Mount Namespace

Inside the container child process (after CLONE_NEWNS), mount a dedicated devpts with newinstance and bind-mount/symlink /dev/pts/ptmx to /dev/ptmx:

// 1. Mount isolated devpts instance (gid=5 is standard 'tty' group)
mount("devpts", "/dev/pts", "devpts", MS_NOSUID | MS_NOEXEC, "newinstance,ptmxmode=0666,mode=0620,gid=5");

// 2. Ensure /dev/ptmx points to the isolated instance for in-container apps (sshd, tmux, etc.)
mount("/dev/pts/ptmx", "/dev/ptmx", NULL, MS_BIND, NULL); 
// Or symlink("/dev/pts/ptmx", "/dev/ptmx") after unlinking the old node

2. Allocate the PTY from the private instance & obtain master_fd on the host

Note: To guarantee the kernel allocates from the new instance, we must open the ptmx node belonging to that specific devpts mount (/dev/pts/ptmx).

There are three clean ways for the host daemon (droidspacesd) to obtain the master_fd while keeping the slave node (/dev/pts/0) strictly inside the container:

• Approach A (Simplest code change - Direct /proc path traversal):
  Once the child process finishes mounting its private /dev/pts (synchronized via a pipe/eventfd), the host daemon can directly open the child's private ptmx from the host side:

  snprintf(ptmx_path, sizeof(ptmx_path), "/proc/%d/root/dev/pts/ptmx", child_pid);
  int host_master_fd = open(ptmx_path, O_RDWR | O_NOCTTY | O_CLOEXEC);

  Why this works: Opening /dev/pts/ptmx through /proc/<pid>/root resolves the dentry inside the container's mount namespace. The slave node /dev/pts/0 is created exclusively inside the container, while the host daemon immediately gets the master_fd without needing IPC FD-passing!

• Approach B (Industry Standard - socketpair + SCM_RIGHTS):
  The container child opens /dev/pts/ptmx locally, sets up /dev/pts/0 as its controlling terminal (setsid() + TIOCSCTTY), and sends the master_fd back to the host daemon over a pre-established AF_UNIX socketpair() using SCM_RIGHTS. (100% kernel version compatibility).

• Approach C (Modern Syscall - pidfd_getfd on Kernel 5.6+):
  The child opens /dev/pts/ptmx, and the host daemon duplicates the descriptor using pidfd_open() + pidfd_getfd().

Benefits

• Zero Host Pollution: The host's /dev/pts remains 100% clean and untainted—no root-owned slave nodes are ever created on the host.
• Native Stealth: Completely eliminates Found ROOT PTY detections at the architectural root cause, without needing kernel-level LKM hooks or VFS getattr spoofing.
• Standards Compliance: Aligns Droidspaces with the official Linux kernel devpts multi-instance container specification.