sandboy: S0 GitHub-hosted-runner feasibility gate — ACCEPTED - #277
Conversation
…be, hostile fixtures) Scope: Sandboy S0 capability probe for the QODEC Scope N2 sourcing addendum. Determines whether the existing Sandboy commit (Landlock + seccomp, no VM — Layer 2 of the isolation ADR) actually confines a hostile process tree on a standard ubuntu-24.04 GitHub-hosted runner, which supplies the disposable-VM boundary this gate assumes rather than builds. No third-party repository is executed, no RepoLogMiner, no microVM layer. - sandboy: env_clear() + env_allow allowlist before exec — closes a real gap found while designing the gate's credential-canary test (sandboy previously passed its full launcher environment straight through to the wrapped command). Default (no env_allow) is deny-all. - sandboy: new `probe` subcommand — reuses the same landlock_status/ apply_seccomp code `run` uses against a synthetic default policy, reports host capability (Landlock ABI/status via both the crate and a raw landlock_create_ruleset(..., VERSION) syscall, seccomp, no_new_privs, close_range, kernel/uid/container signals) as JSON. Always exits 0; a caller decides pass/fail. Distinct from the still-unimplemented `run --report` (per-step outcome) noted in the README. - tests/feasibility/: argv-only (no shell strings) synthetic hostile fixtures — filesystem escape (incl. symlink, unix-socket-bind), seccomp syscall denial with fork/child/grandchild/compiler-tree-shaped process trees and an unsandboxed baseline to isolate seccomp's actual contribution, credential-canary leak scanning, and TCP port-scope network tests — plus run_gate.py, which also runs the existing tests/demo.sh smoke and writes sandboy-host-capabilities.json, sandboy-feasibility-report.json, sandbox-enforcement-matrix.json, and sandboy-feasibility-summary.md. Documents (without live-testing against a real address) the two structural network gaps: no UDP coverage, and TCP scoped by port only, never destination address — so a metadata-endpoint port collision is not something Landlock can distinguish. - .github/workflows/sandboy-feasibility-gate.yml: read-only, pinned actions, no secrets, ubuntu-24.04, injects fake canary env vars, always uploads the four reports as CI artifacts even when the gate fails. - policy.rs unit tests for env_allow parsing/default and seccomp_deny resolution/hard-error-on-unknown-name. Locally (this dev container) the gate fails closed end-to-end: Landlock is not implemented in this kernel, so every sandboxed invocation is refused before it ever execs — which is exactly the scenario this gate exists to tell apart from a real ubuntu-24.04 runner. Real verification happens in CI. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0146FG6sjNiVaQEbCUZkzSy6
|
Warning Review limit reached
Next review available in: 28 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (11)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…assification Two real bugs found by actually running the gate on a GitHub-hosted ubuntu-24.04 runner (Landlock ABI v7, fully_enforced there): - python_fs_ro_dirs() walked dirname() up from the interpreter path with no floor, so a shallow system `/usr/bin/python3` reached "/" itself within a few hops and silently allowlisted the ENTIRE filesystem for reads. Every fs_read_* denial probe passed regardless of Landlock, because the policy itself was wrong, not because confinement failed — writes were correctly denied (fs_ro only grants read+exec) but reads were not exercised at all. Fixed: never add "/" (or an empty path) to the walk-up, and stop the walk before reaching it. - The credential-canary controls compared env_probe.py's own CLEAN/LEAK judgement against the generic ALLOWED/DENIED classifier, so every clean run was misreported as "fail" in the per-control table (the overall credential_canaries_absent acceptance criterion was unaffected — it reads the independent leak scan directly, not pass_fail). Added a category=="credential_canary" branch that classifies on CLEAN/LEAK. Also ruff/mypy cleanup (line length, unused imports, iterable unpacking) — the repo's existing CI lint job runs ruff across the whole tree, including this new script. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0146FG6sjNiVaQEbCUZkzSy6
Sandboy S0 result: PASS ✅Real run on Host:
Note on the first run (commit Decision per the N2 Sandboy-dogfooding addendum: gate passes → accepted Sandboy commit for N2 is Artifacts: Still Generated by Claude Code |
PhysShell
changed the title
2 participants
Что и зачем
Sandboy S0: ACCEPTED. Capability-probe gate (часть sourcing addendum к QODEC Scope N2), проверяющий, реально ли текущий коммит Sandboy (Landlock + seccomp, без VM) конфайнит враждебное дерево процессов на обычном GitHub-hosted
ubuntu-24.04runner'е — до того, как N2 начнёт майнить реальные публичные репозитории через него. Ничего стороннего не исполняется: только синтетические fixtures подsandboy/tests/feasibility/.Попутно закрыт реальный пробел, найденный при проектировании canary-теста:
sandboy runраньше пробрасывал весь launcher-окружение в обёрнутую команду без изменений. Добавленenv_clear()+env_allow-allowlist (по умолчанию — deny-all).Итоговый результат: PASS (25/25 протестированных контролей)
Реальный прогон на
ubuntu-24.04(GitHub-hosted): workflow run 29350379408, commite925058.env_clear()+allowlist.Принятый коммит для N2:
e925058ddea405b5821fc0aed4882c76650dcbe9— уже использован как pinned Sandboy commit в N2-A miner-canary (007#50), где реальныйdotnet buildпод этим Sandboy успешно и воспроизводимо прошёл.Тип изменения
sandboy run)Как проверено
cargo test --release(sandboy) — 4 unit-теста (env_allow default/parse, seccomp_deny default/hard-error)cargo fmt --check,cargo clippy --all-targets --release— чисто (одно pre-existing warning не в новом коде)ubuntu-24.04GitHub-hosted runner — 25/25 контролей PASS (см. выше)Связанные issue
Нет — часть Scope N2 sourcing addendum (Sandboy S0 feasibility gate), без отдельного issue.
Чеклист
sandboy/README.md,sandboy/policy.example.toml)Generated by Claude Code