mxc 0.3.0 → 0.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 988895e92e027354db083acc4b7fefd8b48d6ac8a5e4bfed22a734f4c020dd3d
-  data.tar.gz: 4d014ede1e4b3c35551304d1b92fdf49889587b009bb0fb0df39c96fb8718926
+  metadata.gz: 3b22a8e3054e56f63421b06b11d5db03c5a4d2a78302759b069207b6f57e0881
+  data.tar.gz: 2425c817778256ec3bb937d9587f8d7513d8aa4106cd3727c9163806893b8d26
 SHA512:
-  metadata.gz: f9330fd9f89ad26e9ce2494969b6734afb4fdb3f6e4a8f3712421e1d5f28d0e4efbc40965520a6ed3c0211b7ccf2c915fd74b05daed107ef02168e9b4b5f18f1
-  data.tar.gz: 44a17cc95d03e7a24b2fe2cc71fb32137c2983f01c155dbd2a9e1fb0051bd9193e3c22754acdbe050881ec0a3f64f0fcb4b2e131d09c13e4ea02038fc2fa4ed0
+  metadata.gz: ad1387eafb7076d2a18e954e94cc5641a4a7bb9be532ffbba8ad3e496ca0021f7693e41d3fd4301108454d2863c469e415f6f8c6b9a1045cbd1c0ce4e1305544
+  data.tar.gz: 200a97933411bf815af791fb136f94c53d3270ff409318e0364a78fe9a7007fcf709d7eadfcae5a59054e53a088ce9af80fc563585b07b4f58f185135b2bed23

data/Cargo.lock

@@ -593,7 +593,7 @@ dependencies = [
 
 [[package]]
 name = "mxc"
-version = "0.3.0"
+version = "0.4.1"
 dependencies = [
  "magnus",
  "mxc-sdk",
@@ -605,7 +605,7 @@ dependencies = [
 [[package]]
 name = "mxc-sdk"
 version = "1.0.0"
-source = "git+https://github.com/crmne/microsoft-mxc?rev=d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d#d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d"
+source = "git+https://github.com/crmne/microsoft-mxc?rev=d7ba62b299fbcd7bdd4d7876cefcd68ada9a469b#d7ba62b299fbcd7bdd4d7876cefcd68ada9a469b"
 dependencies = [
  "anyhow",
  "base64",

data/README.md

@@ -128,6 +128,8 @@ MXC.backends                   # => [#<MXC::Backend name=:bubblewrap ...>]
 
 On Windows, a single String runs through `cmd.exe` instead of `sh`. See [Running Commands](https://crmne.github.io/mxc/running-commands/#windows) and [Policies](https://crmne.github.io/mxc/policies/#windows) for what else differs.
 
+A sandbox controls files, network, and resources. It does not always hide other processes: on some backends a command can read their command lines, and on macOS the environment your application started with. [Policies](https://crmne.github.io/mxc/policies/#what-the-command-can-see-of-other-processes) lists what each backend shows.
+
 Docker blocks the namespaces Bubblewrap needs by default, so a default container runs sandboxes on Landlock. [Running in Docker](https://crmne.github.io/mxc/running-in-docker/) shows what that gives up, and the smallest set of changes that makes Bubblewrap work, with a seccomp profile and a Kamal configuration for a job role.
 
 ## Documentation

data/ext/mxc/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "mxc"
-version = "0.3.0"
+version = "0.4.1"
 edition = "2021"
 authors = ["Carmine Paolino <carmine@paolino.me>"]
 license = "MIT"
@@ -13,7 +13,7 @@ crate-type = ["cdylib"]
 magnus = "0.8.2"
 # A fork of mxc-sdk 1.0.0 that adds resource limits (microsoft/mxc#1498) and
 # a Landlock backend (microsoft/mxc#1494), until MXC releases them.
-mxc-sdk = { git = "https://github.com/crmne/microsoft-mxc", rev = "d57b0d1aa3a2d552001fa54ef4ac4baaa733c26d" }
+mxc-sdk = { git = "https://github.com/crmne/microsoft-mxc", rev = "d7ba62b299fbcd7bdd4d7876cefcd68ada9a469b" }
 rb-sys = { version = "0.9.130", features = ["stable-api-compiled-fallback"] }
 serde_json = "1"
 

data/lib/mxc/libraries.rb

@@ -0,0 +1,138 @@
+# frozen_string_literal: true
+
+require 'open3'
+require 'shellwords'
+
+module MXC
+  # Finds the shared library files programs load, directly or through
+  # other libraries, so a sandbox can read them and nothing beside them. Only macOS needs this: Seatbelt
+  # sandboxes read the system's libraries but not those a package manager
+  # installs, such as Homebrew's, which a program like Ruby may link. The
+  # libraries come from the programs' load commands, read with otool from
+  # the Command Line Tools. Without them nothing is found, because
+  # /usr/bin/otool would offer to install them instead.
+  module Libraries # :nodoc:
+    OTOOL = '/usr/bin/otool'
+    XCODE_SELECT = '/usr/bin/xcode-select'
+    SYSTEM = %w[/usr/lib/ /System/ /Library/].freeze
+    TOKEN = %r{\A@(loader_path|executable_path|rpath)/}
+
+    @links = {}
+    @lock = Mutex.new
+
+    class << self
+      # Returns the real paths of the library files +binaries+ load outside
+      # the system's own, empty where none are needed or otool is missing.
+      # +executable+ is the program that loads them, for libraries named
+      # relative to it.
+      def files(binaries, executable: nil)
+        return [] if binaries.empty? || !available?
+
+        libraries(binaries, executable)
+      end
+
+      # Returns the path of the program +arguments+ start: the first argument, or the first
+      # word of a command for the shell, found on +path+ or under +directory+. Returns nil
+      # when there is none.
+      def program(arguments, path:, directory:)
+        name = program_name(arguments)
+        return if name.nil?
+        return File.expand_path(name, directory || '/') if name.include?('/')
+
+        path.to_s.split(File::PATH_SEPARATOR).map { |entry| File.join(entry, name) }
+            .find { |candidate| File.file?(candidate) && File.executable?(candidate) }
+      end
+
+      # Returns true when this host can list a program's libraries.
+      def available?
+        return @available if defined?(@available)
+
+        @available = RUBY_PLATFORM.include?('darwin') && File.executable?(OTOOL) && developer_tools?
+      end
+
+      private
+
+      def program_name(arguments)
+        arguments.one? ? Shellwords.split(arguments.first).first : arguments.first
+      rescue ArgumentError
+        nil
+      end
+
+      def libraries(binaries, executable)
+        roots = binaries.filter_map { |binary| real_path(binary) }
+        links_of(roots)
+        found = {}
+        roots.each { |root| visit(root, executable || root, [], found) }
+        found.keys
+      end
+
+      def visit(path, executable, inherited, found)
+        dependencies(path, links_of([path]).fetch(path), executable, inherited).each do |library, rpaths|
+          next if found.key?(library)
+
+          found[library] = true
+          visit(library, executable, rpaths, found)
+        end
+      end
+
+      def developer_tools?
+        system(XCODE_SELECT, '-p', out: File::NULL, err: File::NULL) == true
+      end
+
+      def dependencies(path, links, executable, inherited)
+        rpaths = links[:rpaths].filter_map { |rpath| expand(rpath, path, executable) } + inherited
+        links[:libraries].filter_map do |name|
+          next if system?(name)
+
+          library = locate(name, path, executable, rpaths)
+          [library, rpaths] if library && !system?(library)
+        end
+      end
+
+      def locate(name, loader, executable, rpaths)
+        relative = name.delete_prefix('@rpath/')
+        candidates = if relative == name
+                       [expand(name, loader, executable)]
+                     else
+                       rpaths.map { |rpath| File.join(rpath, relative) }
+                     end
+        candidates.compact.lazy.filter_map { |candidate| real_path(candidate) }.first
+      end
+
+      def expand(name, loader, executable)
+        token = name[TOKEN, 1]
+        return name unless token
+        return if token == 'rpath'
+
+        base = token == 'loader_path' ? loader : executable
+        File.expand_path(name.sub(TOKEN, ''), File.dirname(base))
+      end
+
+      def system?(path)
+        path.start_with?(*SYSTEM)
+      end
+
+      def real_path(path)
+        path = File.realpath(path)
+        path if File.file?(path)
+      rescue SystemCallError
+        nil
+      end
+
+      def links_of(paths)
+        @lock.synchronize do
+          missing = paths.reject { |path| @links.key?(path) }
+          @links.merge!(LoadCommands.parse(otool(missing), missing)) if missing.any?
+          @links.slice(*paths)
+        end
+      end
+
+      def otool(paths)
+        output, = Open3.capture2(OTOOL, '-l', *paths, err: File::NULL)
+        output
+      rescue SystemCallError
+        ''
+      end
+    end
+  end
+end

data/lib/mxc/load_commands.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+module MXC
+  # Reads the libraries and run paths of Mach-O files from the load
+  # commands <tt>otool -l</tt> lists, with every architecture of a
+  # universal file together.
+  module LoadCommands # :nodoc:
+    LOAD = /\A\s*cmd LC_(?:LOAD_DYLIB|LOAD_WEAK_DYLIB|REEXPORT_DYLIB|LAZY_LOAD_DYLIB|LOAD_UPWARD_DYLIB)\z/
+    RPATH = /\A\s*cmd LC_RPATH\z/
+    COMMAND = /\A\s*cmd /
+    VALUE = /\A\s*(?:name|path) (.+) \(offset \d+\)\z/
+    ARCHITECTURE = / \(architecture [^)]+\)\z/
+
+    class << self
+      # Returns, for each of +paths+, the install names of the libraries it
+      # loads and its run paths, as <tt>{ libraries: [...], rpaths: [...] }</tt>.
+      def parse(output, paths)
+        links = paths.to_h { |path| [path, { libraries: [], rpaths: [] }] }
+        current = kind = nil
+        output.each_line(chomp: true) do |line|
+          if links.key?(header = header_path(line))
+            current = links[header]
+            kind = nil
+          elsif current
+            kind = record(current, kind, line)
+          end
+        end
+        links
+      end
+
+      private
+
+      def record(links, kind, line)
+        return :libraries if line.match?(LOAD)
+        return :rpaths if line.match?(RPATH)
+        return if line.match?(COMMAND)
+
+        value = line[VALUE, 1] if kind
+        return kind unless value
+
+        links[kind] << value
+        nil
+      end
+
+      def header_path(line)
+        line.delete_suffix(':').sub(ARCHITECTURE, '') if line.end_with?(':') && !line.start_with?(' ', "\t")
+      end
+    end
+  end
+end

data/lib/mxc/sandbox.rb

@@ -30,7 +30,8 @@ module MXC
   class Sandbox
     BACKENDS = %i[auto bubblewrap landlock seatbelt process_container].freeze # :nodoc:
     LANDLOCK_FALLBACK = /runs on Landlock instead/ # :nodoc:
-    OPTIONS = %i[readable writable denied network env directory timeout backend limits priority].freeze # :nodoc:
+    OPTIONS = %i[readable writable denied libraries libraries_of network env directory timeout backend limits
+                 priority].freeze # :nodoc:
     HOST_RESOLVER_SOCKETS = %w[/run/systemd/resolve].freeze # :nodoc:
     WINDOWS_ENV = %w[SYSTEMROOT WINDIR SYSTEMDRIVE COMSPEC PATHEXT PATH LOCALAPPDATA TEMP TMP
                      PROCESSOR_ARCHITECTURE NUMBER_OF_PROCESSORS OS].freeze # :nodoc:
@@ -40,8 +41,8 @@ module MXC
     PRIORITIES = { normal: nil, low: 'low', lowest: 'idle' }.freeze # :nodoc:
     MEGABYTE = 1024 * 1024 # :nodoc:
     DEFAULTS = {
-      readable: [], writable: [], denied: [], env: {}, network: false, directory: nil, timeout: nil, backend: nil,
-      limits: {}, priority: nil
+      readable: [], writable: [], denied: [], libraries: true, libraries_of: [], env: {}, network: false,
+      directory: nil, timeout: nil, backend: nil, limits: {}, priority: nil
     }.freeze # :nodoc:
 
     class << self
@@ -54,6 +55,13 @@ module MXC
       # Adds paths every instance hides, even inside readable or writable paths.
       def denied(*paths) = configure { |sandbox| sandbox.with_denied(*paths) }
 
+      # Adds programs and libraries whose shared libraries every instance can load.
+      # Takes the same arguments as #with_libraries_of.
+      def libraries_of(*paths) = configure { |sandbox| sandbox.with_libraries_of(*paths) }
+
+      # Sets whether every instance can read the libraries its programs load. See #with_libraries.
+      def libraries(enabled) = configure { |sandbox| sandbox.with_libraries(enabled) }
+
       # Sets every instance's network access. Takes the same arguments as #with_network.
       def network(...) = configure { |sandbox| sandbox.with_network(...) }
 
@@ -135,6 +143,12 @@ module MXC
     # Returns the paths hidden from the command, as given.
     def denied = @settings[:denied].dup.freeze
 
+    # Returns the programs and libraries whose shared libraries the command can load, as given.
+    def libraries_of = @settings[:libraries_of].dup.freeze
+
+    # Returns true when the command can read the libraries its program loads, the default.
+    def libraries = @settings[:libraries]
+
     # Returns the environment variables set for the command.
     def env = @settings[:env].dup.freeze
 
@@ -163,7 +177,8 @@ module MXC
       add_paths(:readable, paths)
     end
 
-    # Adds paths the command can read and write.
+    # Adds paths the command can read and write. A path that is also #readable is writable,
+    # whichever was added first. A readable path inside a writable one stays read-only.
     def with_writable(*paths)
       add_paths(:writable, paths)
     end
@@ -173,6 +188,32 @@ module MXC
       add_paths(:denied, paths)
     end
 
+    # Adds programs and libraries whose shared libraries the command loads, such as the
+    # extensions an interpreter opens. On macOS, the command can read those library files,
+    # and the libraries they load in turn, when they are not the system's own. The program
+    # the command runs needs no entry: #run grants its libraries already. Elsewhere, on a
+    # Mac without the Command Line Tools, and with <tt>with_libraries(false)</tt>, this
+    # grants nothing.
+    #
+    #   sandbox.with_libraries_of(*Dir[File.join(RbConfig::CONFIG["archdir"], "**", "*.bundle")])
+    def with_libraries_of(*paths)
+      add_paths(:libraries_of, paths)
+    end
+
+    # Sets whether the command can read the shared libraries its program and #libraries_of
+    # load, on macOS. +true+ is the default; +false+ grants no library, so the command reads
+    # only the system's and those under #readable. +nil+ resets it to +true+.
+    #
+    #   sandbox.with_libraries(false)
+    def with_libraries(enabled)
+      unless [true, false, nil].include?(enabled)
+        raise ArgumentError, "libraries must be true, false or nil, got #{enabled.inspect}"
+      end
+
+      @settings[:libraries] = enabled != false
+      self
+    end
+
     # Sets network access. The default, +false+, gives the command no network at all.
     # +true+ allows any destination. <tt>allow:</tt> takes a list of hosts the command
     # may reach over HTTP and HTTPS: <tt>"pypi.org"</tt>, <tt>"*.pythonhosted.org"</tt>
@@ -273,6 +314,12 @@ module MXC
     #
     # With a block, yields each Chunk of output as it arrives.
     #
+    # On macOS, the command can read the shared library files its program links outside
+    # the system's own, such as Homebrew's, so programs built against them start. The
+    # program is the first argument, or the first word of a command for the shell, found
+    # on the +PATH+ of #env. See #with_libraries_of for libraries the program opens later,
+    # and #with_libraries to turn this off.
+    #
     #   sandbox.run("python3 build.py && ls dist")
     #   sandbox.run("python3", "convert.py", params[:filename])
     #   sandbox.run("python3", "build.py") { |chunk| print chunk.content }
@@ -283,7 +330,8 @@ module MXC
     def run(*command, &)
       return stream(*command, &) if block_given?
 
-      outcome = StartupFailure.check!(Native.run(command_line(command), request))
+      arguments = command_arguments(command)
+      outcome = StartupFailure.check!(Native.run(command_line(arguments), request(arguments)))
       Result.new(**outcome, backend: resolved_backend(outcome[:warnings]))
     end
 
@@ -292,7 +340,8 @@ module MXC
     #
     #   sandbox.spawn("python3", "-i", "-q")
     def spawn(*command)
-      native = Native.spawn(command_line(command), request)
+      arguments = command_arguments(command)
+      native = Native.spawn(command_line(arguments), request(arguments))
       Process.new(native, backend: resolved_backend(native.warnings))
     end
 
@@ -315,7 +364,8 @@ module MXC
     def inspect # :nodoc:
       resources = " limits=#{limits.inspect} priority=#{priority.inspect}" if self.resources
       "#<#{self.class.name || 'MXC::Sandbox'} backend=#{backend.inspect} network=#{network.inspect} " \
-        "readable=#{readable.inspect} writable=#{writable.inspect} timeout=#{timeout.inspect}#{resources}>"
+        "readable=#{readable.inspect} writable=#{writable.inspect} timeout=#{timeout.inspect}#{resources}" \
+        "#{libraries_inspect}>"
     end
 
     protected
@@ -330,7 +380,7 @@ module MXC
 
     def apply(name, value)
       case name
-      when :readable, :writable, :denied then public_send(:"with_#{name}", *Array(value))
+      when :readable, :writable, :denied, :libraries_of then public_send(:"with_#{name}", *Array(value))
       when :network then value.is_a?(Hash) ? with_network(**value) : with_network(value)
       when :limits then value.nil? ? with_limits(nil) : with_limits(**value)
       else public_send(:"with_#{name}", value)
@@ -384,8 +434,7 @@ module MXC
       process&.kill unless finished
     end
 
-    def command_line(command)
-      arguments = command_arguments(command)
+    def command_line(arguments)
       return command_line_for_windows(arguments) if Preflight.windows?
 
       arguments.one? ? arguments.first : Shellwords.join(arguments)
@@ -420,11 +469,13 @@ module MXC
       warnings.any?(LANDLOCK_FALLBACK) ? :landlock : :bubblewrap
     end
 
-    def request
+    def request(arguments)
       Preflight.check!(network:, denied:, resources:, backend:)
+      readwrite = expand(writable)
       {
-        readonly: expand(readable),
-        readwrite: expand(writable),
+        # MXC resolves a path in both lists to read-only.
+        readonly: (expand(readable) | library_files(arguments)) - readwrite,
+        readwrite:,
         denied: expand(denied) | hidden_resolver_sockets,
         environment:,
         working_directory:,
@@ -474,6 +525,17 @@ module MXC
       system.reject { |name, _| env.keys.any? { |own| own.casecmp?(name) } }.merge(env)
     end
 
+    def libraries_inspect
+      libraries ? (" libraries_of=#{libraries_of.inspect}" if libraries_of.any?) : ' libraries=false'
+    end
+
+    def library_files(arguments)
+      return [] unless libraries && Libraries.available?
+
+      program = Libraries.program(arguments, path: env['PATH'], directory: working_directory)
+      Libraries.files([*program, *expand(libraries_of)], executable: program)
+    end
+
     def hidden_resolver_sockets
       return [] if network == true
 

data/lib/mxc/version.rb

@@ -2,5 +2,5 @@
 
 module MXC
   # The gem version.
-  VERSION = '0.3.0'
+  VERSION = '0.4.1'
 end

data/lib/mxc.rb

@@ -12,6 +12,8 @@ require 'mxc/backend'
 require 'mxc/availability'
 require 'mxc/process'
 require 'mxc/windows_arguments'
+require 'mxc/load_commands'
+require 'mxc/libraries'
 require 'mxc/sandbox'
 
 # Runs commands in sandboxes through Microsoft's MXC.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: mxc
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.1
 platform: ruby
 authors:
 - Carmine Paolino
@@ -49,6 +49,8 @@ files:
 - lib/mxc/chunk.rb
 - lib/mxc/configuration.rb
 - lib/mxc/error.rb
+- lib/mxc/libraries.rb
+- lib/mxc/load_commands.rb
 - lib/mxc/native.rb
 - lib/mxc/preflight.rb
 - lib/mxc/process.rb