saiph 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 94fa9d2587e5b09e6b37300f5be444effbbed9c97945be0f64e9f5ae89a6cb11
+  data.tar.gz: 3a486c04f59ad325635bd3c160b44eb5563d13c9daa1457ada03864368c3537b
+SHA512:
+  metadata.gz: 14e0a18f41563078f57ca175496d1a7c2a63024bcba1437d782ec641092f19ff68e11fcdaf66e38de9fac50cb7c63cc127412767d4e3a2adaf8e737a7bb8ea70
+  data.tar.gz: 7ace16f008e4a5b08cba397870ad1d8e46dc8efc6af2b9a960bb7660cd58cf123d31112ec00586dfaa4dfbefa786f92efa0e210ae3282d8c8b60c13772ae7705

data/CHANGELOG.md

@@ -0,0 +1,5 @@
+# Changelog
+
+## 0.1.0 - 2026-09-16
+
+- Initial release

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Yudai Takada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,114 @@
+# Saiph
+
+Saiph applies native operating-system restrictions to child processes. It is a
+small, Pure Ruby boundary for running untrusted plugins without depending on an
+editor or plugin API.
+
+Saiph fails closed. `available?` is true only after the native backend passes a
+local capability probe, and a child exits with status 126 if setup fails. Saiph
+never substitutes an ordinary unsandboxed process.
+
+## Installation
+
+```bash
+bundle add saiph
+```
+
+Saiph supports Ruby 3.1 and later.
+
+## Usage
+
+```ruby
+require "saiph"
+
+unless Saiph.available?
+  warn "OS sandbox unavailable"
+  return
+end
+
+policy = Saiph::Policy.new(
+  read_paths: [File.expand_path("plugin.rb", __dir__)],
+  write_paths: [File.expand_path("tmp", __dir__)],
+  network: false,
+  exec: false,
+  env: ["LANG"]
+)
+
+pid = Saiph.spawn(
+  [RbConfig.ruby, File.expand_path("plugin.rb", __dir__)],
+  policy: policy,
+  env: {"LANG" => "en_US.UTF-8"},
+  out: $stdout,
+  err: $stderr
+)
+status = Process.waitpid2(pid).last
+raise "sandbox setup failed" if status.exitstatus == 126
+```
+
+`spawn` returns a process ID and accepts normal `Process.spawn` redirections
+and options. Pass the command as an argument array. A string is treated as one
+executable name; Saiph never invokes a shell.
+
+`Policy` fields have these meanings:
+
+- `read_paths`: existing absolute files or directory trees the child may read.
+- `write_paths`: existing absolute files or directory trees the child may read
+  and modify.
+- `network`: whether network access is allowed.
+- `exec`: whether the child may create descendant processes.
+- `env`: names of environment variables visible to the child. Values may be
+  overridden with `spawn(..., env: {...})`; undeclared names are rejected.
+
+The launcher and system dynamic libraries need a small implicit read-only
+runtime allowance. On Unix this covers the selected executable, the active
+Ruby installation, and system library directories. It does not include the
+home directory or temporary directories.
+
+`Saiph.apply!(policy)` restricts the current process and is irreversible. Use
+`spawn` unless the current process was created solely to become a sandbox.
+
+## Backends
+
+| Platform | `backend` | Enforcement |
+| --- | --- | --- |
+| macOS | `:seatbelt` | `sandbox_init` profile with deny-by-default file, network, and process rules |
+| Linux | `:seccomp` | user/mount/network namespaces, Landlock filesystem rules, and seccomp-BPF |
+| Windows | `:appcontainer` | ephemeral AppContainer plus a Job Object process limit |
+
+Linux reports unavailable unless namespaces, Landlock, and seccomp all work in
+the current environment. This is common in restricted CI containers and is an
+expected reason to skip integration tests.
+
+Windows 0.1 supports a no-filesystem-grant, no-network policy. Non-empty path
+grants and `network: true` raise `Saiph::Unsupported` because safely changing
+host ACLs requires application-owned provisioning. `apply!` is also unsupported
+on Windows; AppContainer tokens must be selected at process creation.
+
+## Security and cleanup
+
+- Paths are resolved before launch, so a symlink cannot retarget an allowance.
+- The child environment is rebuilt from its allowlist.
+- Policy transfer uses a private inherited pipe, not a temporary file.
+- Backend probes run in disposable children because Unix restrictions cannot be
+  relaxed.
+- Linux blocks signal delivery to host processes in addition to ptrace and
+  cross-process memory access.
+- AppContainer profiles, native handles, pipes, and Landlock descriptors are
+  closed on both success and failure.
+
+Saiph reduces OS capabilities; it does not validate plugin code or replace
+application-level authentication and authorization.
+
+## Development
+
+```bash
+bundle install
+bundle exec rake test
+bundle exec rbs -I sig validate
+BUDGET=1 bundle exec rake bench
+gem build --strict saiph.gemspec
+```
+
+## License
+
+MIT.

data/docs/adr/000-template.md

@@ -0,0 +1,17 @@
+# ADR NNN: Implementation decision title
+
+- Status: Proposed
+- Date: YYYY-MM-DD
+
+## Context
+
+Describe the concrete implementation question and its compatibility, runtime,
+or security constraints.
+
+## Decision
+
+Describe the durable boundary or architecture choice.
+
+## Consequences
+
+Describe the important trade-offs and when to revisit the decision.

data/docs/adr/001-require-complete-native-enforcement.md

@@ -0,0 +1,34 @@
+# ADR 001: Require complete native enforcement
+
+- Status: Accepted
+- Date: 2026-09-15
+
+## Context
+
+A platform may expose only part of the mechanisms needed for a process sandbox.
+For example, seccomp reduces Linux system calls but does not restrict pathnames,
+and a namespace may be disabled inside a container. Treating one partial
+mechanism as a sandbox would give callers a false security guarantee.
+
+## Decision
+
+Saiph reports a backend as available only after its required native mechanisms
+can be activated in a disposable process. Linux requires namespaces, Landlock,
+and seccomp together. macOS requires a compiled deny-by-default Seatbelt
+profile. Windows requires successful creation and launch of an AppContainer.
+
+Policy setup happens before user code. Any setup error terminates the launcher
+with status 126. No backend falls back to `Process.spawn` without restrictions.
+The implementation uses Ruby's standard library and native OS APIs through
+Fiddle; it does not add a privileged helper or native extension.
+
+## Consequences
+
+Saiph can be unavailable in otherwise supported operating systems, especially
+inside CI containers. Callers must surface that state or choose their own
+explicit fallback. Supporting more Linux hosts may later justify an audited
+external helper, but it must preserve the same fail-closed contract.
+
+Windows filesystem grants remain unsupported until the embedding application
+can provision and restore ACLs it owns. Saiph rejects those policies instead of
+silently broadening access.

data/docs/adr/README.md

@@ -0,0 +1,5 @@
+# Architecture decision records
+
+These records document Saiph's durable security boundaries.
+
+- [ADR 001: Require complete native enforcement](001-require-complete-native-enforcement.md)

data/lib/saiph/backend.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Saiph
+  module Backends
+    module Spawn
+      module_function
+
+      def call(backend, command, policy:, **options)
+        overrides = options.delete(:env) || {}
+        raise ArgumentError, "env must be a hash" unless overrides.is_a?(Hash)
+
+        overrides = overrides.to_h { |key, value| [String(key), value.nil? ? nil : String(value)] }
+        denied = overrides.keys - policy.env
+        raise ArgumentError, "environment variable is not allowed: #{denied.first}" unless denied.empty?
+
+        environment = policy.env.to_h { |name| [name, overrides.fetch(name, ENV[name])] }
+        reader, writer = IO.pipe
+        fd = 3
+        environment["SAIPH_PAYLOAD_FD"] = fd.to_s
+        environment["SAIPH_BACKEND"] = backend.name.to_s
+        payload = JSON.generate(
+          "command" => command,
+          "policy" => {
+            "read_paths" => policy.read_paths,
+            "write_paths" => policy.write_paths,
+            "network" => policy.network,
+            "exec" => policy.exec,
+            "env" => policy.env
+          }
+        )
+        redirects = options.merge(fd => reader, close_others: true, unsetenv_others: true)
+        pid = Process.spawn(environment, RbConfig.ruby, "-I", File.expand_path("..", __dir__), "-rsaiph/runner", "-e", "Saiph::Runner.run", redirects)
+        reader.close
+        writer.write(payload)
+        writer.close
+        pid
+      rescue Exception
+        if pid
+          begin
+            Process.kill("TERM", pid)
+          rescue Errno::ESRCH
+            nil
+          end
+          begin
+            Process.wait(pid)
+          rescue Errno::ECHILD
+            nil
+          end
+        end
+        reader&.close unless reader&.closed?
+        writer&.close unless writer&.closed?
+        raise
+      end
+    end
+  end
+end

data/lib/saiph/backends/linux.rb

@@ -0,0 +1,239 @@
+# frozen_string_literal: true
+
+require "fiddle"
+
+require_relative "../backend"
+
+module Saiph
+  module Backends
+    module Linux
+      module_function
+
+      CLONE_NEWNS = 0x00020000
+      CLONE_NEWUSER = 0x10000000
+      CLONE_NEWNET = 0x40000000
+      MS_REC = 0x4000
+      MS_PRIVATE = 1 << 18
+      PR_SET_SECCOMP = 22
+      PR_SET_NO_NEW_PRIVS = 38
+      SECCOMP_MODE_FILTER = 2
+      LANDLOCK_CREATE_RULESET_VERSION = 1
+      LANDLOCK_RULE_PATH_BENEATH = 1
+      O_PATH = 0x200000
+      O_CLOEXEC = 0x80000
+
+      FS_EXECUTE = 1 << 0
+      FS_WRITE_FILE = 1 << 1
+      FS_READ_FILE = 1 << 2
+      FS_READ_DIR = 1 << 3
+      FS_REMOVE_DIR = 1 << 4
+      FS_REMOVE_FILE = 1 << 5
+      FS_MAKE_CHAR = 1 << 6
+      FS_MAKE_DIR = 1 << 7
+      FS_MAKE_REG = 1 << 8
+      FS_MAKE_SOCK = 1 << 9
+      FS_MAKE_FIFO = 1 << 10
+      FS_MAKE_BLOCK = 1 << 11
+      FS_MAKE_SYM = 1 << 12
+      FS_REFER = 1 << 13
+      FS_TRUNCATE = 1 << 14
+      FS_IOCTL_DEV = 1 << 15
+      FS_BASE = (1 << 13) - 1
+      FS_WRITE = FS_WRITE_FILE | FS_REMOVE_DIR | FS_REMOVE_FILE | FS_MAKE_DIR |
+        FS_MAKE_REG | FS_MAKE_SOCK | FS_MAKE_FIFO | FS_MAKE_SYM
+
+      BPF_LD_W_ABS = 0x20
+      BPF_JMP_JEQ_K = 0x15
+      BPF_JMP_JSET_K = 0x45
+      BPF_RET_K = 0x06
+      SECCOMP_RET_KILL_PROCESS = 0x80000000
+      SECCOMP_RET_ERRNO = 0x00050000
+      SECCOMP_RET_ALLOW = 0x7fff0000
+      EPERM = 1
+      CLONE_THREAD = 0x00010000
+
+      SYSTEM_READ_PATHS = ["/lib", "/lib64", "/usr/lib", "/etc/ld.so.cache", RbConfig::CONFIG["prefix"]].freeze
+      AUDIT_ARCH = {"x86_64" => 0xc000003e, "aarch64" => 0xc00000b7, "arm64" => 0xc00000b7}.freeze
+      SYSCALLS = {
+        "x86_64" => {
+          clone: 56, fork: 57, vfork: 58, clone3: 435, ptrace: 101, bpf: 321, perf_event_open: 298,
+          userfaultfd: 323, kexec_load: 246, finit_module: 313, init_module: 175, delete_module: 176,
+          reboot: 169, swapon: 167, swapoff: 168, mount: 165, umount2: 166, pivot_root: 155,
+          setns: 308, unshare: 272, keyctl: 250, add_key: 248, request_key: 249,
+          process_vm_readv: 310, process_vm_writev: 311, open_by_handle_at: 304, kill: 62, tkill: 200,
+          tgkill: 234, rt_sigqueueinfo: 129, rt_tgsigqueueinfo: 297, pidfd_send_signal: 424,
+          socket: 41, connect: 42, accept: 43, sendto: 44, recvfrom: 45, sendmsg: 46, recvmsg: 47,
+          bind: 49, listen: 50, socketpair: 53, accept4: 288, recvmmsg: 299, sendmmsg: 307
+        },
+        "aarch64" => {
+          clone: 220, clone3: 435, ptrace: 117, bpf: 280, perf_event_open: 241, userfaultfd: 282,
+          kexec_load: 104, finit_module: 273, init_module: 105, delete_module: 106, reboot: 142,
+          swapon: 224, swapoff: 225, mount: 40, umount2: 39, pivot_root: 41, setns: 268,
+          unshare: 97, keyctl: 219, add_key: 217, request_key: 218, process_vm_readv: 270,
+          process_vm_writev: 271, open_by_handle_at: 265, kill: 129, tkill: 130, tgkill: 131,
+          rt_sigqueueinfo: 138, rt_tgsigqueueinfo: 240, pidfd_send_signal: 424, socket: 198,
+          socketpair: 199, bind: 200, listen: 201, accept: 202, connect: 203, sendto: 206,
+          recvfrom: 207, sendmsg: 211, recvmsg: 212, accept4: 242, recvmmsg: 243, sendmmsg: 269
+        }
+      }.freeze
+
+      def name = :seccomp
+
+      def available?
+        return @available if defined?(@available_pid) && @available_pid == Process.pid
+
+        @available_pid = Process.pid
+        @available = supported_architecture? && landlock_abi.positive? && probe
+      rescue StandardError, LoadError
+        @available = false
+      end
+
+      def spawn(command, policy:, **options) = Spawn.call(self, command, policy: policy, **options)
+
+      def apply!(policy, command: nil)
+        raise Unsupported, "Linux sandbox requires x86-64 or AArch64" unless supported_architecture?
+
+        setup_namespaces(network: policy.network)
+        apply_landlock(policy, command)
+        apply_seccomp(policy)
+        true
+      end
+
+      def setup_namespaces(network:)
+        flags = CLONE_NEWNS | (network ? 0 : CLONE_NEWNET)
+        original_uid, original_gid = Process.uid, Process.gid
+        if unshare.call(flags | CLONE_NEWUSER).zero?
+          File.write("/proc/self/setgroups", "deny") if File.exist?("/proc/self/setgroups")
+          File.write("/proc/self/uid_map", "0 #{original_uid} 1")
+          File.write("/proc/self/gid_map", "0 #{original_gid} 1")
+        elsif unshare.call(flags) != 0
+          system_error("unshare")
+        end
+        system_error("mount private namespace") unless mount.call(0, "/", 0, MS_REC | MS_PRIVATE, 0).zero?
+      end
+
+      def apply_landlock(policy, command)
+        abi = landlock_abi
+        handled = FS_BASE
+        handled |= FS_REFER if abi >= 2
+        handled |= FS_TRUNCATE if abi >= 3
+        handled |= FS_IOCTL_DEV if abi >= 5
+        ruleset = landlock_create(Fiddle::Pointer[[handled].pack("Q<")], 8, 0)
+        system_error("landlock_create_ruleset") if ruleset.negative?
+
+        begin
+          rules = {}
+          SYSTEM_READ_PATHS.each { |path| merge_rule(rules, path, read_rights(path) | FS_EXECUTE) }
+          policy.read_paths.each { |path| merge_rule(rules, path, read_rights(path)) }
+          policy.write_paths.each { |path| merge_rule(rules, path, read_rights(path) | write_rights(path, abi)) }
+          policy.read_paths.each { |path| merge_rule(rules, path, FS_EXECUTE) } if policy.exec
+          merge_rule(rules, command.first, FS_EXECUTE | FS_READ_FILE) if command
+          rules.each { |path, rights| add_landlock_rule(ruleset, path, rights & handled) }
+
+          system_error("prctl(PR_SET_NO_NEW_PRIVS)") unless prctl.call(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0).zero?
+          system_error("landlock_restrict_self") unless landlock_restrict(ruleset, 0).zero?
+        ensure
+          IO.new(ruleset).close
+        end
+      end
+
+      def merge_rule(rules, path, rights)
+        return unless path && File.exist?(path)
+
+        canonical = File.realpath(path)
+        rules[canonical] = rules.fetch(canonical, 0) | rights
+      end
+
+      def read_rights(path) = FS_READ_FILE | (File.directory?(path) ? FS_READ_DIR : 0)
+
+      def write_rights(path, abi)
+        rights = FS_WRITE
+        rights |= FS_REFER if abi >= 2
+        rights |= FS_TRUNCATE if abi >= 3
+        File.directory?(path) ? rights : (FS_WRITE_FILE | (abi >= 3 ? FS_TRUNCATE : 0))
+      end
+
+      def add_landlock_rule(ruleset, path, rights)
+        descriptor = IO.sysopen(path, O_PATH | O_CLOEXEC)
+        attribute = [rights, descriptor].pack("Q<l<x4")
+        system_error("landlock_add_rule") unless landlock_add(ruleset, LANDLOCK_RULE_PATH_BENEATH, Fiddle::Pointer[attribute], 0).zero?
+      ensure
+        IO.new(descriptor).close if descriptor
+      end
+
+      def apply_seccomp(policy)
+        calls = syscall_table
+        denied = %i[ptrace bpf perf_event_open userfaultfd kexec_load finit_module init_module delete_module reboot
+          swapon swapoff mount umount2 pivot_root setns unshare keyctl add_key request_key process_vm_readv
+          process_vm_writev open_by_handle_at kill tkill tgkill rt_sigqueueinfo rt_tgsigqueueinfo pidfd_send_signal]
+        denied.concat(%i[socket socketpair bind listen accept accept4 connect sendto recvfrom sendmsg recvmsg recvmmsg sendmmsg]) unless policy.network
+        filters = [[BPF_LD_W_ABS, 0, 0, 4], [BPF_JMP_JEQ_K, 1, 0, audit_arch], [BPF_RET_K, 0, 0, SECCOMP_RET_KILL_PROCESS], [BPF_LD_W_ABS, 0, 0, 0]]
+        unless policy.exec
+          if calls[:clone]
+            filters.concat([[BPF_JMP_JEQ_K, 0, 4, calls[:clone]], [BPF_LD_W_ABS, 0, 0, 16],
+              [BPF_JMP_JSET_K, 1, 0, CLONE_THREAD], [BPF_RET_K, 0, 0, SECCOMP_RET_ERRNO | EPERM], [BPF_LD_W_ABS, 0, 0, 0]])
+          end
+          denied.concat(%i[fork vfork clone3])
+        end
+        denied.filter_map { |name| calls[name] }.uniq.each do |number|
+          filters << [BPF_JMP_JEQ_K, 0, 1, number]
+          filters << [BPF_RET_K, 0, 0, SECCOMP_RET_ERRNO | EPERM]
+        end
+        filters << [BPF_RET_K, 0, 0, SECCOMP_RET_ALLOW]
+        install_filter(filters)
+      end
+
+      def install_filter(filters)
+        bytes = filters.map { |filter| filter.pack("S<CCL<") }.join
+        pointer = Fiddle::Pointer[bytes]
+        program = [filters.length].pack("S<") + "\0" * 6 + [pointer.to_i].pack("Q<")
+        system_error("prctl(PR_SET_SECCOMP)") unless prctl.call(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, Fiddle::Pointer[program], 0, 0).zero?
+      end
+
+      def probe
+        pid = Process.fork do
+          command = [File.realpath(RbConfig.ruby), "-e", "exit!(0)"]
+          apply!(Policy.new([], [], false, false, []), command: command)
+          exec({}, *command, unsetenv_others: true)
+        rescue Exception
+          exit!(1)
+        end
+        Process.waitpid2(pid).last.success?
+      end
+
+      def host_cpu = RbConfig::CONFIG["host_cpu"]
+      def supported_architecture? = Fiddle::SIZEOF_VOIDP == 8 && AUDIT_ARCH.key?(host_cpu)
+      def audit_arch = AUDIT_ARCH.fetch(host_cpu)
+      def syscall_table = SYSCALLS.fetch(host_cpu == "arm64" ? "aarch64" : host_cpu)
+
+      def landlock_abi
+        @landlock_abi ||= landlock_create(0, 0, LANDLOCK_CREATE_RULESET_VERSION)
+      end
+
+      def function(name, arguments, result = Fiddle::TYPE_INT)
+        Fiddle::Function.new(Fiddle::Handle::DEFAULT[name], arguments, result)
+      end
+
+      def unshare = (@unshare ||= function("unshare", [Fiddle::TYPE_INT]))
+      def mount = (@mount ||= function("mount", [Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_VOIDP, Fiddle::TYPE_LONG, Fiddle::TYPE_VOIDP]))
+      def prctl = (@prctl ||= function("prctl", [Fiddle::TYPE_INT, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG, Fiddle::TYPE_LONG]))
+
+      def landlock_create(pointer, size, flags)
+        fn = (@landlock_create ||= function("syscall", [Fiddle::TYPE_LONG, Fiddle::TYPE_VOIDP, Fiddle::TYPE_SIZE_T, Fiddle::TYPE_INT], Fiddle::TYPE_LONG))
+        fn.call(444, pointer, size, flags)
+      end
+
+      def landlock_add(ruleset, type, pointer, flags)
+        fn = (@landlock_add ||= function("syscall", [Fiddle::TYPE_LONG, Fiddle::TYPE_INT, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_LONG))
+        fn.call(445, ruleset, type, pointer, flags)
+      end
+
+      def landlock_restrict(ruleset, flags)
+        fn = (@landlock_restrict ||= function("syscall", [Fiddle::TYPE_LONG, Fiddle::TYPE_INT, Fiddle::TYPE_INT], Fiddle::TYPE_LONG))
+        fn.call(446, ruleset, flags)
+      end
+
+      def system_error(operation) = raise(SystemCallError.new(operation, Fiddle.last_error))
+    end
+  end
+end

data/lib/saiph/backends/macos.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "fiddle"
+
+require_relative "../backend"
+
+module Saiph
+  module Backends
+    module MacOS
+      module_function
+
+      LIBRARIES = ["/usr/lib/libsandbox.1.dylib", "/usr/lib/libSystem.B.dylib"].freeze
+      BASE_READ_PATHS = ["/System", "/usr/lib", "/private/var/db/dyld", RbConfig::CONFIG["prefix"]].compact.freeze
+
+      def name = :seatbelt
+
+      def available?
+        return @available if defined?(@available_pid) && @available_pid == Process.pid
+
+        @available_pid = Process.pid
+        @available = probe
+      rescue StandardError, LoadError
+        @available = false
+      end
+
+      def spawn(command, policy:, **options) = Spawn.call(self, command, policy: policy, **options)
+
+      def apply!(policy, command: nil)
+        profile = build_profile(policy, command)
+        error = [0].pack("J")
+        result = sandbox_init.call(Fiddle::Pointer[profile], 0, Fiddle::Pointer[error])
+        return true if result.zero?
+
+        pointer = error.unpack1("J")
+        message = pointer.zero? ? "sandbox_init failed" : Fiddle::Pointer.new(pointer).to_s
+        sandbox_free_error.call(pointer) unless pointer.zero?
+        raise Error, message
+      end
+
+      def build_profile(policy, command = nil)
+        reads = (BASE_READ_PATHS + policy.read_paths + policy.write_paths + Array(command&.first)).uniq
+        lines = ["(version 1)", "(deny default)", "(allow sysctl-read)", "(allow process-info*)"]
+        lines << rule("file-read*", reads)
+        lines << rule("file-write*", policy.write_paths) unless policy.write_paths.empty?
+        lines << "(allow network*)" if policy.network
+        if command
+          lines << "(allow process-exec (literal #{quote(command.first)}))"
+          lines << "(allow process-fork)" if policy.exec
+        elsif policy.exec
+          lines << rule("process-exec", policy.read_paths)
+          lines << "(allow process-fork)"
+        end
+        lines.join("\n")
+      end
+
+      def rule(operation, paths)
+        filters = paths.filter_map do |path|
+          next unless File.exist?(path)
+
+          "(#{File.directory?(path) ? 'subpath' : 'literal'} #{quote(path)})"
+        end
+        "(allow #{operation} #{filters.join(' ')})"
+      end
+
+      def quote(value) = JSON.generate(value)
+
+      def probe
+        pid = Process.fork do
+          STDERR.reopen(File::NULL, "w")
+          command = [File.realpath(RbConfig.ruby), "-e", "exit!(0)"]
+          apply!(Policy.new([], [], false, false, []), command: command)
+          exec({}, *command, unsetenv_others: true)
+        rescue Exception
+          exit!(1)
+        end
+        Process.waitpid2(pid).last.success?
+      end
+
+      def library
+        @library ||= LIBRARIES.lazy.filter_map do |path|
+          Fiddle.dlopen(path)
+        rescue Fiddle::DLError
+          nil
+        end.first or raise LoadError, "sandbox library not found"
+      end
+
+      def sandbox_init
+        @sandbox_init ||= Fiddle::Function.new(
+          library["sandbox_init"],
+          [Fiddle::TYPE_VOIDP, Fiddle::TYPE_LONG_LONG, Fiddle::TYPE_VOIDP],
+          Fiddle::TYPE_INT
+        )
+      end
+
+      def sandbox_free_error
+        @sandbox_free_error ||= Fiddle::Function.new(library["sandbox_free_error"], [Fiddle::TYPE_VOIDP], Fiddle::TYPE_VOID)
+      end
+    end
+  end
+end

data/lib/saiph/backends/windows.rb

@@ -0,0 +1,176 @@
+# frozen_string_literal: true
+
+require "fiddle"
+require "securerandom"
+
+require_relative "../backend"
+
+module Saiph
+  module Backends
+    module Windows
+      module_function
+
+      P = Fiddle::TYPE_VOIDP
+      I = Fiddle::TYPE_INT
+      U = Fiddle::TYPE_INT
+      N = Fiddle::TYPE_SIZE_T
+      L = Fiddle::TYPE_LONG
+      V = Fiddle::TYPE_VOID
+      PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES = 0x00020009
+      EXTENDED_STARTUPINFO_PRESENT = 0x00080000
+      CREATE_UNICODE_ENVIRONMENT = 0x00000400
+      CREATE_SUSPENDED = 0x00000004
+      STARTF_USESTDHANDLES = 0x00000100
+      JOB_OBJECT_LIMIT_ACTIVE_PROCESS = 0x00000008
+      JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE = 0x00002000
+      JOB_OBJECT_EXTENDED_LIMIT_INFORMATION = 9
+      INFINITE = 0xffffffff
+
+      def name = :appcontainer
+
+      def available?
+        return false unless Fiddle::SIZEOF_VOIDP == 8
+        return @available if defined?(@available_pid) && @available_pid == Process.pid
+
+        @available_pid = Process.pid
+        profile, sid = create_profile("Probe")
+        @available = create_and_wait([RbConfig.ruby, "-e", "exit!(0)"], sid, allow_children: false).zero?
+      rescue StandardError, LoadError, Fiddle::DLError
+        @available = false
+      ensure
+        free_sid.call(sid) if sid && !sid.zero?
+        delete_profile.call(wide(profile)) if profile
+      end
+
+      def spawn(command, policy:, **options)
+        validate_policy!(policy)
+        Spawn.call(self, command, policy: policy, **options)
+      end
+
+      def apply!(_policy, command: nil)
+        raise Unsupported, "AppContainer can only be applied while creating a child process"
+      end
+
+      def launch(command, policy:)
+        validate_policy!(policy)
+        profile, sid = create_profile("Process")
+        create_and_wait(command, sid, allow_children: policy.exec)
+      ensure
+        free_sid.call(sid) if sid && !sid.zero?
+        delete_profile.call(wide(profile)) if profile
+      end
+
+      def validate_policy!(policy)
+        unless policy.read_paths.empty? && policy.write_paths.empty?
+          raise Unsupported, "AppContainer path grants require explicit Windows ACL provisioning"
+        end
+        raise Unsupported, "AppContainer network capabilities are not available" if policy.network
+      end
+
+      def create_and_wait(command, sid, allow_children:)
+        attributes = initialize_attributes
+        security = [sid, 0, 0, 0].pack("JJL<L<")
+        check(update_attributes.call(attributes, 0, PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES,
+          Fiddle::Pointer[security], security.bytesize, 0, 0), "UpdateProcThreadAttribute")
+        startup = startup_info(attributes)
+        information = "\0".b * 24
+        line = wide(command.map { |argument| quote_argument(argument) }.join(" "))
+        flags = EXTENDED_STARTUPINFO_PRESENT | CREATE_UNICODE_ENVIRONMENT | CREATE_SUSPENDED
+        check(create_process.call(wide(command.first), line, 0, 0, 1, flags, 0, 0, Fiddle::Pointer[startup], Fiddle::Pointer[information]), "CreateProcessW")
+        process, thread = information.unpack("JJ")
+        job = create_job.call(0, 0)
+        check(job, "CreateJobObjectW")
+        configure_job(job, allow_children: allow_children)
+        check(assign_job.call(job, process), "AssignProcessToJobObject")
+        resumed = resume_thread.call(thread)
+        raise SystemCallError.new("ResumeThread", Fiddle.last_error) if resumed == 0xffffffff
+
+        check(wait.call(process, INFINITE) != 0xffffffff ? 1 : 0, "WaitForSingleObject")
+        status = [0].pack("L<")
+        check(exit_code.call(process, Fiddle::Pointer[status]), "GetExitCodeProcess")
+        status.unpack1("L<")
+      rescue Exception
+        terminate.call(process, 126) if process && !process.zero?
+        raise
+      ensure
+        delete_attributes.call(attributes) if attributes
+        [thread, process, job].compact.each { |handle| close_handle.call(handle) unless handle.zero? }
+      end
+
+      def configure_job(job, allow_children:)
+        information = "\0".b * 144
+        flags = JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE
+        unless allow_children
+          flags |= JOB_OBJECT_LIMIT_ACTIVE_PROCESS
+          information[40, 4] = [1].pack("L<")
+        end
+        information[16, 4] = [flags].pack("L<")
+        check(set_job.call(job, JOB_OBJECT_EXTENDED_LIMIT_INFORMATION, Fiddle::Pointer[information], information.bytesize),
+          "SetInformationJobObject")
+      end
+
+      def initialize_attributes
+        size = [0].pack("J")
+        initialize_attribute_list.call(0, 1, 0, Fiddle::Pointer[size])
+        attributes = Fiddle::Pointer.malloc(size.unpack1("J"), Fiddle::RUBY_FREE)
+        check(initialize_attribute_list.call(attributes, 1, 0, Fiddle::Pointer[size]), "InitializeProcThreadAttributeList")
+        attributes
+      end
+
+      def startup_info(attributes)
+        value = "\0".b * 112
+        value[0, 4] = [112].pack("L<")
+        value[60, 4] = [STARTF_USESTDHANDLES].pack("L<")
+        value[80, 24] = [-10, -11, -12].map { |number| get_std_handle.call(number) }.pack("J3")
+        value[104, 8] = [attributes.to_i].pack("J")
+        value
+      end
+
+      def create_profile(suffix)
+        name = "Noxdea.Saiph.#{suffix}.#{Process.pid}.#{SecureRandom.hex(8)}"
+        sid = [0].pack("J")
+        result = create_profile_fn.call(wide(name), wide("Saiph"), wide("Ephemeral Saiph sandbox"), 0, 0, Fiddle::Pointer[sid])
+        raise Error, "CreateAppContainerProfile failed (0x#{(result & 0xffffffff).to_s(16)})" if (result & 0x80000000) != 0
+
+        [name, sid.unpack1("J")]
+      end
+
+      def quote_argument(value)
+        return value unless value.empty? || value.match?(/[\s"]/)
+
+        '"' + value.gsub(/(\\*)"/) { Regexp.last_match(1) * 2 + '\\"' }
+          .sub(/(\\+)\z/) { Regexp.last_match(1) * 2 } + '"'
+      end
+
+      def wide(value) = value.encode("UTF-16LE").b + "\0\0"
+
+      def check(result, operation)
+        raise SystemCallError.new(operation, Fiddle.last_error) if result.to_i.zero?
+
+        result
+      end
+
+      def library(name) = Fiddle.dlopen(name)
+      def kernel = (@kernel ||= library("kernel32.dll"))
+      def userenv = (@userenv ||= library("userenv.dll"))
+      def advapi = (@advapi ||= library("advapi32.dll"))
+      def fn(handle, name, arguments, result) = Fiddle::Function.new(handle[name], arguments, result)
+      def create_profile_fn = (@create_profile_fn ||= fn(userenv, "CreateAppContainerProfile", [P, P, P, P, U, P], L))
+      def delete_profile = (@delete_profile ||= fn(userenv, "DeleteAppContainerProfile", [P], L))
+      def free_sid = (@free_sid ||= fn(advapi, "FreeSid", [P], P))
+      def initialize_attribute_list = (@initialize_attribute_list ||= fn(kernel, "InitializeProcThreadAttributeList", [P, U, U, P], I))
+      def update_attributes = (@update_attributes ||= fn(kernel, "UpdateProcThreadAttribute", [P, U, N, P, N, P, P], I))
+      def delete_attributes = (@delete_attributes ||= fn(kernel, "DeleteProcThreadAttributeList", [P], V))
+      def create_process = (@create_process ||= fn(kernel, "CreateProcessW", [P, P, P, P, I, U, P, P, P, P], I))
+      def get_std_handle = (@get_std_handle ||= fn(kernel, "GetStdHandle", [I], P))
+      def create_job = (@create_job ||= fn(kernel, "CreateJobObjectW", [P, P], P))
+      def set_job = (@set_job ||= fn(kernel, "SetInformationJobObject", [P, I, P, U], I))
+      def assign_job = (@assign_job ||= fn(kernel, "AssignProcessToJobObject", [P, P], I))
+      def resume_thread = (@resume_thread ||= fn(kernel, "ResumeThread", [P], U))
+      def wait = (@wait ||= fn(kernel, "WaitForSingleObject", [P, U], U))
+      def exit_code = (@exit_code ||= fn(kernel, "GetExitCodeProcess", [P, P], I))
+      def terminate = (@terminate ||= fn(kernel, "TerminateProcess", [P, U], I))
+      def close_handle = (@close_handle ||= fn(kernel, "CloseHandle", [P], I))
+    end
+  end
+end

data/lib/saiph/runner.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require_relative "../saiph" unless defined?(Saiph::Policy)
+
+module Saiph
+  module Runner
+    module_function
+
+    def run
+      fd = Integer(ENV.delete("SAIPH_PAYLOAD_FD"), 10)
+      requested = ENV.delete("SAIPH_BACKEND")
+      input = IO.for_fd(fd)
+      payload = JSON.parse(input.read)
+      input.close
+      values = payload.fetch("policy").values_at("read_paths", "write_paths", "network", "exec", "env")
+      policy = Policy.new(*values)
+      implementation = Saiph.send(:require_backend!)
+      raise Unsupported, "sandbox backend changed while starting" unless implementation.name.to_s == requested
+
+      if implementation.respond_to?(:launch)
+        exit!(implementation.launch(payload.fetch("command"), policy: policy))
+      end
+
+      implementation.apply!(policy, command: payload.fetch("command"))
+      exec(*payload.fetch("command"))
+    rescue Exception => error
+      warn("saiph: #{error.message}")
+      exit!(126)
+    end
+  end
+end

data/lib/saiph/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Saiph
+  VERSION = "0.1.0"
+end

data/lib/saiph.rb

@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+require "json"
+require "rbconfig"
+
+require_relative "saiph/version"
+
+module Saiph
+  class Error < StandardError; end
+  class Unsupported < Error; end
+
+  module Value
+    module_function
+
+    def define(*members)
+      return Data.define(*members) if defined?(Data)
+
+      Struct.new(*members) do
+        members.each { |member| undef_method("#{member}=") }
+
+        def initialize(*values, **keywords)
+          unless keywords.empty?
+            raise ArgumentError, "cannot mix positional and keyword arguments" unless values.empty?
+
+            missing = self.class.members - keywords.keys
+            unknown = keywords.keys - self.class.members
+            raise ArgumentError, "missing keyword: #{missing.first.inspect}" unless missing.empty?
+            raise ArgumentError, "unknown keyword: #{unknown.first.inspect}" unless unknown.empty?
+
+            values = self.class.members.map { |member| keywords.fetch(member) }
+          end
+          raise ArgumentError, "wrong number of arguments" unless values.length == self.class.members.length
+
+          super(*values)
+          freeze
+        end
+      end
+    end
+  end
+
+  Policy = Value.define(:read_paths, :write_paths, :network, :exec, :env)
+  private_constant :Value
+
+  class << self
+    def available? = !!(platform && platform.available?)
+    def backend = available? ? platform.name : nil
+
+    def spawn(command, policy:, **spawn_options)
+      normalized = normalize_policy(policy)
+      executable = resolve_command(command)
+      require_backend!.spawn(executable, policy: normalized, **spawn_options)
+    end
+
+    def apply!(policy)
+      normalized = normalize_policy(policy)
+      require_backend!.apply!(normalized)
+      ENV.keep_if { |name, _value| normalized.env.include?(name) }
+      true
+    end
+
+    private
+
+    def platform
+      @platform ||= case RUBY_PLATFORM
+      when /darwin/ then require_relative("saiph/backends/macos") && Backends::MacOS
+      when /linux/ then require_relative("saiph/backends/linux") && Backends::Linux
+      when /mswin|mingw/ then require_relative("saiph/backends/windows") && Backends::Windows
+      else false
+      end
+      @platform || nil
+    end
+
+    def require_backend!
+      candidate = platform
+      raise Unsupported, "no supported sandbox backend is available" unless candidate&.available?
+
+      candidate
+    end
+
+    def normalize_policy(policy)
+      raise ArgumentError, "policy must be a Saiph::Policy" unless policy.is_a?(Policy)
+
+      reads = normalize_paths(policy.read_paths, :read_paths)
+      writes = normalize_paths(policy.write_paths, :write_paths)
+      raise ArgumentError, "network must be true or false" unless [true, false].include?(policy.network)
+      raise ArgumentError, "exec must be true or false" unless [true, false].include?(policy.exec)
+
+      names = Array(policy.env).map do |name|
+        value = String(name)
+        raise ArgumentError, "invalid environment name" if value.empty? || value.include?("=") || value.include?("\0")
+
+        value.freeze
+      end.uniq.freeze
+      Policy.new(reads, writes, policy.network, policy.exec, names)
+    end
+
+    def normalize_paths(paths, field)
+      Array(paths).map do |path|
+        value = String(path)
+        raise ArgumentError, "#{field} must contain absolute paths" unless File.absolute_path(value) == value
+        raise ArgumentError, "#{field} path does not exist: #{value}" unless File.exist?(value)
+
+        File.realpath(value).freeze
+      end.uniq.freeze
+    end
+
+    def resolve_command(command)
+      parts = (command.is_a?(Array) ? command : [command]).map do |part|
+        value = String(part)
+        raise ArgumentError, "command contains a null byte" if value.include?("\0")
+
+        value
+      end
+      raise ArgumentError, "command must not be empty" if parts.empty? || parts.first.empty?
+
+      executable = parts.first
+      separators = [File::SEPARATOR, File::ALT_SEPARATOR].compact
+      unless separators.any? { |separator| executable.include?(separator) }
+        executable = ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).find do |directory|
+          path = File.expand_path(executable, directory)
+          break path if File.file?(path) && File.executable?(path)
+        end
+      else
+        executable = File.expand_path(executable)
+      end
+      raise ArgumentError, "command executable was not found" unless executable && File.file?(executable) && File.executable?(executable)
+
+      parts[0] = File.realpath(executable)
+      parts.freeze
+    end
+  end
+end
+
+require_relative "saiph/runner"

data/sig/saiph.rbs

@@ -0,0 +1,25 @@
+module Saiph
+  VERSION: String
+
+  class Error < StandardError
+  end
+
+  class Unsupported < Error
+  end
+
+  class Policy
+    attr_reader read_paths: Array[String]
+    attr_reader write_paths: Array[String]
+    attr_reader network: bool
+    attr_reader exec: bool
+    attr_reader env: Array[String]
+
+    def self.new: (Array[String] read_paths, Array[String] write_paths, bool network, bool exec, Array[String] env) -> Policy
+                | (read_paths: Array[String], write_paths: Array[String], network: bool, exec: bool, env: Array[String]) -> Policy
+  end
+
+  def self.available?: () -> bool
+  def self.backend: () -> (:seatbelt | :seccomp | :appcontainer)?
+  def self.spawn: (String | Array[String] command, policy: Policy, **untyped options) -> Integer
+  def self.apply!: (Policy policy) -> bool
+end

metadata

@@ -0,0 +1,71 @@
+--- !ruby/object:Gem::Specification
+name: saiph
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Yudai Takada
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: fiddle
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+email:
+- t.yudai92@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- docs/adr/000-template.md
+- docs/adr/001-require-complete-native-enforcement.md
+- docs/adr/README.md
+- lib/saiph.rb
+- lib/saiph/backend.rb
+- lib/saiph/backends/linux.rb
+- lib/saiph/backends/macos.rb
+- lib/saiph/backends/windows.rb
+- lib/saiph/runner.rb
+- lib/saiph/version.rb
+- sig/saiph.rbs
+homepage: https://github.com/noxdea/saiph
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/noxdea/saiph
+  changelog_uri: https://github.com/noxdea/saiph/blob/main/CHANGELOG.md
+  allowed_push_host: https://rubygems.org
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '3.1'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.16
+specification_version: 4
+summary: Fail-closed native process sandboxing for Ruby
+test_files: []