docs: Clarify that all jailer inputs must be trusted

Document that the operator invoking the jailer is part of the trusted
computing base and that all paths provided to the jailer are considered
trusted. It is the operator's responsibility to ensure these paths and
their parent directories have appropriate permissions to prevent
unauthorized modification by other local users.

Signed-off-by: Ilias Stamatis <ilstam@amazon.com>

Author: ilstam

docs/jailer.md

@@ -263,6 +263,15 @@ Note: default value for `<api-sock>` is `/run/firecracker.socket`.
 
 ### Observations
 
+- All inputs to the jailer are considered trusted, including the paths provided
+  via `--exec-file`, `--chroot-base-dir`, and `--netns`, as well as any
+  resources placed inside the jail root directory. Cgroup mount points are
+  discovered from `/proc/mounts` and are managed by the kernel, so they are
+  inherently trusted. The operator invoking the jailer is part of the trusted
+  computing base. It is the operator's responsibility to ensure that these paths
+  and their parent directories have appropriate ownership and permissions (e.g.,
+  root-owned, not world-writable) to prevent unauthorized modification by other
+  local users.
 - The user must create hard links for (or copy) any resources which will be
   provided to the VM via the API (disk images, kernel images, named pipes, etc)
   inside the jailed root folder. Also, permissions must be properly managed for

docs/prod-host-setup.md

@@ -96,6 +96,11 @@ namespace isolation and drops privileges of the Firecracker process.
 
 To set up the jailer correctly, you'll need to:
 
+- Ensure that all paths provided to the jailer (`--exec-file`,
+  `--chroot-base-dir`, `--netns`) and their parent directories are not writable
+  by unprivileged users. The jailer treats all its inputs as trusted; it is the
+  operator's responsibility to ensure that these paths cannot be tampered with
+  by other local users.
 - Create a dedicated non-privileged POSIX user and group to run Firecracker
   under. Use the created POSIX user and group IDs in Jailer's `--uid <uid>` and
   `--gid <gid>` flags, respectively. This will run the Firecracker as the