@dsh-enhanced/assistant-isolation 0.1.65 → 0.1.67

package/runtime/linux-seccomp.py

@@ -0,0 +1,106 @@
+"""Compile the fixed, reviewed syscall policy for bubblewrap; never load it here.
+
+The policy is the existing vendored Moby-derived source builder allowlist, with
+its three explicit namespace extensions removed for ordinary jobs. libseccomp
+is a system dependency, not a Docker dependency. Its public C ABI is documented
+at https://github.com/seccomp/libseccomp/blob/main/include/seccomp.h.in .
+"""
+import ctypes
+import hashlib
+import json
+import os
+import platform
+import sys
+
+POLICY_SHA256 = "b1e4b5b709578785bd2aff4a3a344301997571ad0e8ae5747aec176571ddc342"
+ALLOW = 0x7fff0000
+ERRNO = 0x00050000
+ARCHES = {"x86_64": "amd64", "aarch64": "arm64"}
+OPS = {"SCMP_CMP_NE": 1, "SCMP_CMP_EQ": 4, "SCMP_CMP_MASKED_EQ": 7}
+
+
+class Arg(ctypes.Structure):
+    _fields_ = [("arg", ctypes.c_uint), ("op", ctypes.c_int),
+                ("datum_a", ctypes.c_uint64), ("datum_b", ctypes.c_uint64)]
+
+
+def fail(message):
+    raise RuntimeError("Linux seccomp: " + message)
+
+
+def selected(rule, architecture, kernel):
+    include = rule.get("includes", {})
+    exclude = rule.get("excludes", {})
+    # No host capability is granted by this policy. In particular, namespace-
+    # local CAP_SYS_ADMIN must not activate the broad host-capability allowlist.
+    if include.get("caps"):
+        return False
+    if "arches" in include and architecture not in include["arches"]:
+        return False
+    if architecture in exclude.get("arches", []):
+        return False
+    if "minKernel" in include and kernel < tuple(map(int, include["minKernel"].split("."))):
+        return False
+    return True
+
+
+def main():
+    if len(sys.argv) != 2 or sys.argv[1] not in ("ordinary", "repository"):
+        fail("expected ordinary or repository profile")
+    architecture = ARCHES.get(platform.machine())
+    if sys.platform != "linux" or architecture is None:
+        fail("unsupported platform")
+    kernel = tuple(map(int, platform.release().split(".")[:2]))
+    if kernel < (5, 4):
+        fail("Linux 5.4 or later is required")
+    with open(os.path.join(os.path.dirname(__file__), "linux-seccomp-policy.json"), "rb") as source:
+        content = source.read(65537)
+    if hashlib.sha256(content).hexdigest() != POLICY_SHA256:
+        fail("fixed syscall policy changed")
+    policy = json.loads(content)
+    if policy["defaultAction"] != "SCMP_ACT_ERRNO" or policy.get("defaultErrnoRet", 1) != 1:
+        fail("unexpected default action")
+    rules = policy["syscalls"]
+    if [rule["names"] for rule in rules[-3:]] != [["unshare"], ["clone"], ["mount", "umount2", "pivot_root"]]:
+        fail("namespace extension inventory changed")
+    if sys.argv[1] == "ordinary":
+        rules = rules[:-3]
+    lib = ctypes.CDLL("libseccomp.so.2")
+    lib.seccomp_init.argtypes = [ctypes.c_uint32]
+    lib.seccomp_init.restype = ctypes.c_void_p
+    lib.seccomp_release.argtypes = [ctypes.c_void_p]
+    lib.seccomp_syscall_resolve_name.argtypes = [ctypes.c_char_p]
+    lib.seccomp_syscall_resolve_name.restype = ctypes.c_int
+    lib.seccomp_rule_add_array.argtypes = [ctypes.c_void_p, ctypes.c_uint32, ctypes.c_int,
+                                          ctypes.c_uint, ctypes.POINTER(Arg)]
+    lib.seccomp_rule_add_array.restype = ctypes.c_int
+    lib.seccomp_export_bpf.argtypes = [ctypes.c_void_p, ctypes.c_int]
+    lib.seccomp_export_bpf.restype = ctypes.c_int
+    context = lib.seccomp_init(ERRNO | 1)
+    if not context:
+        fail("could not create filter")
+    try:
+        for rule in rules:
+            if not selected(rule, architecture, kernel):
+                continue
+            action = ALLOW if rule["action"] == "SCMP_ACT_ALLOW" else ERRNO | rule.get("errnoRet", 1)
+            args = rule.get("args", [])
+            comparisons = (Arg * len(args))(*(Arg(arg["index"], OPS[arg["op"]],
+                                                arg["value"], arg.get("valueTwo", 0)) for arg in args))
+            for name in rule["names"]:
+                number = lib.seccomp_syscall_resolve_name(name.encode("ascii"))
+                if number == -1:
+                    # Names for other architectures and future syscalls remain
+                    # denied by default; they never become unrestricted.
+                    continue
+                result = lib.seccomp_rule_add_array(context, action, number, len(args), comparisons)
+                if result != 0:
+                    fail("cannot encode rule for %s (%d)" % (name, result))
+        if lib.seccomp_export_bpf(context, sys.stdout.fileno()) != 0:
+            fail("cannot export filter")
+    finally:
+        lib.seccomp_release(context)
+
+
+if __name__ == "__main__":
+    main()

package/runtime/linux-userns-launcher.py

@@ -0,0 +1,149 @@
+"""Fixed repository keeper launcher. No candidate command executes here."""
+import ctypes
+import hashlib
+import json
+import os
+import select
+import signal
+import stat
+import subprocess
+import sys
+import time
+
+
+def main():
+    if len(sys.argv) != 5:
+        raise RuntimeError("invalid user namespace launcher arguments")
+    mapping = json.loads(sys.argv[1])
+    deadline = int(sys.argv[2])
+    node, worker = sys.argv[3:]
+    owner, group = os.getuid(), os.getgid()
+    if (owner == 0 or mapping["schemaVersion"] != 1
+            or mapping["ownerUid"] != owner or mapping["ownerGid"] != group
+            or mapping["candidateUid"] in (0, owner)
+            or mapping["candidateGid"] in (0, group)):
+        raise RuntimeError("invalid keeper mapping")
+    current = os.stat("/proc/self/ns/user")
+    if mapping["hostNamespace"] != {"dev": current.st_dev, "ino": current.st_ino}:
+        raise RuntimeError("host user namespace changed")
+    for kind, path in (("uid", "/usr/bin/newuidmap"), ("gid", "/usr/bin/newgidmap")):
+        helper = mapping["helpers"][kind]
+        info = os.lstat(path)
+        if (helper["path"] != path or not stat.S_ISREG(info.st_mode)
+                or info.st_uid != 0 or info.st_nlink != 1
+                or info.st_mode & 0o022 or not info.st_mode & stat.S_ISUID
+                or info.st_size > 1048576):
+            raise RuntimeError("unsafe mapping helper")
+        fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW)
+        try:
+            content = os.read(fd, 1048577)
+            stable = lambda value: (value.st_dev, value.st_ino, value.st_uid, value.st_mode,
+                                    value.st_size, value.st_mtime_ns, value.st_ctime_ns)
+            if (len(content) != info.st_size or stable(os.fstat(fd)) != stable(info)
+                    or hashlib.sha256(content).hexdigest() != helper["sha256"]):
+                raise RuntimeError("mapping helper changed")
+        finally:
+            os.close(fd)
+
+    libc = ctypes.CDLL(None, use_errno=True)
+    def checked(result, operation):
+        if result != 0:
+            raise OSError(ctypes.get_errno(), operation)
+    def remaining():
+        value = (deadline - time.time() * 1000) / 1000
+        if value <= 0:
+            raise TimeoutError("namespace deadline ended")
+        return value
+    # If the Host disappears, neither this monitor nor the mapped keeper may
+    # survive it. The mapping handshake also fails closed on either pipe EOF.
+    checked(libc.prctl(1, signal.SIGKILL, 0, 0, 0), "launcher parent-death signal")
+    parent_pid = os.getppid()
+    if parent_pid == 1:
+        raise RuntimeError("Host already exited")
+    ready_r, ready_w = os.pipe()
+    start_r, start_w = os.pipe()
+    child = os.fork()
+    if child == 0:
+        try:
+            os.close(ready_r)
+            os.close(start_w)
+            checked(libc.prctl(1, signal.SIGKILL, 0, 0, 0), "keeper parent-death signal")
+            if os.getppid() == 1:
+                raise RuntimeError("launcher exited")
+            checked(libc.unshare(0x10000000), "unshare user namespace")
+            os.write(ready_w, b"R")
+            os.close(ready_w)
+            if not select.select([start_r], [], [], remaining())[0] or os.read(start_r, 1) != b"S":
+                raise RuntimeError("mapping was not authorized")
+            os.close(start_r)
+            os.setgroups([])
+            os.setresgid(0, 0, 0)
+            os.setresuid(0, 0, 0)
+            checked(libc.unshare(0x00020000 | 0x40000000 | 0x08000000 | 0x04000000), "keeper namespaces")
+            checked(libc.mount(None, b"/", None, 0x4000 | 0x40000, None), "private mounts")
+            checked(libc.prctl(1, signal.SIGKILL, 0, 0, 0), "mapped keeper parent-death signal")
+            # fd 4/5 are the bounded archive and binary channels. Python makes
+            # its own pipes non-inheritable; only these Host channels survive.
+            for fd in (0, 1, 2, 4, 5):
+                os.set_inheritable(fd, True)
+            os.execve(node, [node, worker], {"PATH": "/usr/bin:/bin", "LANG": "C", "LC_ALL": "C"})
+        except BaseException as error:
+            os.write(2, ("linux user namespace child: " + str(error) + "\n").encode())
+            os._exit(125)
+    os.close(ready_w)
+    os.close(start_r)
+    pidfd = os.pidfd_open(child)
+    try:
+        if not select.select([ready_r], [], [], min(5, remaining()))[0] or os.read(ready_r, 1) != b"R":
+            raise RuntimeError("keeper did not reach mapping gate")
+        for kind, outside in (("uid", mapping["candidateUid"]), ("gid", mapping["candidateGid"])):
+            helper = mapping["helpers"][kind]
+            subprocess.run([helper["path"], str(child), "0", str(owner if kind == "uid" else group),
+                            "1", "65534", str(outside), "1"], check=True,
+                           stdin=subprocess.DEVNULL, stdout=subprocess.DEVNULL,
+                           stderr=subprocess.PIPE, close_fds=True,
+                           env={"PATH": "/usr/bin:/bin", "LANG": "C", "LC_ALL": "C"},
+                           timeout=min(5, remaining()))
+        os.write(start_w, b"S")
+        os.close(start_w)
+        start_w = None
+        # Close monitor copies: EOF on Host disconnect belongs to the keeper,
+        # and EOF on fd 5 must not wait for an unrelated monitor descriptor.
+        for fd in (0, 4, 5):
+            os.close(fd)
+        while True:
+            waited, status = os.waitpid(child, os.WNOHANG)
+            if waited:
+                return os.waitstatus_to_exitcode(status)
+            if os.getppid() != parent_pid:
+                raise RuntimeError("Host disconnected")
+            time.sleep(min(0.02, remaining()))
+    finally:
+        os.close(ready_r)
+        if start_w is not None:
+            os.close(start_w)
+        try:
+            signal.pidfd_send_signal(pidfd, signal.SIGKILL)
+        except ProcessLookupError:
+            pass
+        os.close(pidfd)
+        # SIGKILL cannot be ignored. This bounded monitor never waits for
+        # candidate stdout or an inherited control descriptor during cleanup.
+        until = time.monotonic() + 2
+        while time.monotonic() < until:
+            try:
+                if os.waitpid(child, os.WNOHANG)[0]:
+                    break
+            except ChildProcessError:
+                break
+            time.sleep(0.01)
+
+
+try:
+    code = main()
+    sys.exit(code if code >= 0 else 128 - code)
+except BaseException as error:
+    if isinstance(error, SystemExit):
+        raise
+    print("linux user namespace launcher: " + str(error), file=sys.stderr)
+    sys.exit(125)

package/runtime/linux-userns-proof.py

@@ -0,0 +1,299 @@
+"""Fixed Host-side kernel witnesses and pidfd cleanup for repository identities.
+
+No candidate code is evaluated. Namespace FDs remain open across observation
+and signaling; pidfds and start ticks prevent numeric PID reuse from granting
+authority. The caller additionally owns the frozen cgroup and durable intent.
+"""
+import array
+import fcntl
+import json
+import os
+import select
+import signal
+import sys
+
+NS_GET_PARENT = 0xB702
+NS_GET_OWNER_UID = 0xB704
+
+
+def fail(message):
+    raise RuntimeError("repository user namespace: " + message)
+
+
+def identity(fd):
+    item = os.fstat(fd)
+    return {"dev": item.st_dev, "ino": item.st_ino}
+
+
+def read(path, maximum=65536):
+    with open(path, encoding="ascii") as source:
+        value = source.read(maximum + 1)
+    if len(value) > maximum:
+        fail("kernel observation exceeds bound")
+    return value
+
+
+def boot():
+    return read("/proc/sys/kernel/random/boot_id").strip().lower()
+
+
+def owner(fd):
+    value = array.array("I", [0])
+    fcntl.ioctl(fd, NS_GET_OWNER_UID, value, True)
+    return value[0]
+
+
+def parent(fd):
+    return fcntl.ioctl(fd, NS_GET_PARENT)
+
+
+def mapping_rows(pid, kind):
+    return [[int(item) for item in line.split()]
+            for line in read("/proc/%d/%s_map" % (pid, kind)).splitlines()]
+
+
+def exact_maps(pid, mapping):
+    for kind in ("uid", "gid"):
+        suffix = "Uid" if kind == "uid" else "Gid"
+        expected = [[0, mapping["owner" + suffix], 1],
+                    [65534, mapping["candidate" + suffix], 1]]
+        if mapping_rows(pid, kind) != expected:
+            fail("kernel mapping differs")
+
+
+def status(pid):
+    values = {}
+    for line in read("/proc/%d/status" % pid).splitlines():
+        key, separator, value = line.partition(":")
+        if separator:
+            values[key] = value.strip()
+    return values
+
+
+def ticks(pid):
+    value = read("/proc/%d/stat" % pid)
+    fields = value[value.rfind(") ") + 2:].split()
+    if len(fields) < 20 or not fields[19].isdigit():
+        fail("process start identity unavailable")
+    return fields[19]
+
+
+def alive(fd):
+    poll = select.poll()
+    poll.register(fd, select.POLLIN)
+    return not poll.poll(0)
+
+
+def checked_process(pid, expected_ticks, pidfd):
+    if not alive(pidfd) or ticks(pid) != expected_ticks:
+        fail("process identity changed")
+    return status(pid)
+
+
+def same_current_namespace(pid, fd):
+    current = os.open("/proc/%d/ns/user" % pid, os.O_RDONLY)
+    try:
+        if identity(current) != identity(fd):
+            fail("process user namespace changed")
+    finally:
+        os.close(current)
+
+
+def ids(values, kind):
+    result = [int(item) for item in values[kind].split()]
+    if len(result) != 4:
+        fail("incomplete process identity")
+    return result
+
+
+def check_host(mapping):
+    if os.getuid() != mapping["ownerUid"] or os.getgid() != mapping["ownerGid"]:
+        fail("Host owner differs")
+    fd = os.open("/proc/self/ns/user", os.O_RDONLY)
+    try:
+        if identity(fd) != mapping["hostNamespace"]:
+            fail("Host namespace differs")
+    finally:
+        os.close(fd)
+
+
+def check_anchor_fd(fd, witness):
+    if identity(fd) != witness["namespace"] or owner(fd) != witness["ownerUid"]:
+        fail("namespace anchor differs")
+    up = parent(fd)
+    try:
+        if identity(up) != witness["parent"] or witness["parent"] != witness["mapping"]["hostNamespace"]:
+            fail("namespace parent differs")
+    finally:
+        os.close(up)
+
+
+def anchor(mapping, process):
+    check_host(mapping)
+    current_boot = boot()
+    pid = process["pid"]
+    pidfd = os.pidfd_open(pid, 0)
+    nsfd = None
+    try:
+        values = checked_process(pid, process["startTicks"], pidfd)
+        if ids(values, "Uid") != [mapping["ownerUid"]] * 4 or ids(values, "Gid") != [mapping["ownerGid"]] * 4:
+            fail("keeper identity differs")
+        exact_maps(pid, mapping)
+        nsfd = os.open("/proc/%d/ns/user" % pid, os.O_RDONLY)
+        parentfd = parent(nsfd)
+        try:
+            result = {"schemaVersion": 1, "bootId": current_boot,
+                      "mapping": mapping, "namespace": identity(nsfd),
+                      "parent": identity(parentfd), "ownerUid": owner(nsfd),
+                      "leader": process}
+        finally:
+            os.close(parentfd)
+        if result["parent"] != mapping["hostNamespace"] or result["ownerUid"] != mapping["ownerUid"]:
+            fail("keeper namespace is not owned directly by Host")
+        if result["namespace"] == result["parent"]:
+            fail("keeper did not enter a new user namespace")
+        checked_process(pid, process["startTicks"], pidfd)
+        exact_maps(pid, mapping)
+        same_current_namespace(pid, nsfd)
+        checked_process(pid, process["startTicks"], pidfd)
+        if boot() != current_boot:
+            fail("boot changed")
+        return result
+    finally:
+        if nsfd is not None:
+            os.close(nsfd)
+        os.close(pidfd)
+
+
+def candidate(witness, process):
+    mapping = witness["mapping"]
+    check_host(mapping)
+    if boot() != witness["bootId"]:
+        fail("boot changed")
+    pid = process["pid"]
+    pidfd = os.pidfd_open(pid, 0)
+    nsfd = None
+    try:
+        values = checked_process(pid, process["startTicks"], pidfd)
+        if ids(values, "Uid") != [mapping["candidateUid"]] * 4 or ids(values, "Gid") != [mapping["candidateGid"]] * 4:
+            fail("candidate did not drop all identities")
+        if values.get("Groups") != "" or any(int(values[key], 16) != 0 for key in ("CapInh", "CapPrm", "CapEff", "CapBnd", "CapAmb")):
+            fail("candidate retained groups or capabilities")
+        if values.get("NoNewPrivs") != "1" or values.get("Seccomp") != "2" or int(values.get("Seccomp_filters", "0")) < 1:
+            fail("candidate privilege or syscall fence differs")
+        if len(values.get("NSpid", "").split()) < 2:
+            fail("candidate PID namespace missing")
+        exact_maps(pid, mapping)
+        nsfd = os.open("/proc/%d/ns/user" % pid, os.O_RDONLY)
+        check_anchor_fd(nsfd, witness)
+        result = {"schemaVersion": 1, "pid": pid, "startTicks": process["startTicks"],
+                  "bootId": witness["bootId"], "namespace": identity(nsfd),
+                  "uid": mapping["candidateUid"], "gid": mapping["candidateGid"],
+                  "groups": [], "capabilities": "0", "noNewPrivileges": True, "seccomp": 2}
+        after = checked_process(pid, process["startTicks"], pidfd)
+        for key in ("Uid", "Gid", "Groups", "CapInh", "CapPrm", "CapEff", "CapBnd", "CapAmb", "NoNewPrivs", "Seccomp", "Seccomp_filters", "NSpid"):
+            if after.get(key) != values.get(key):
+                fail("candidate security state changed")
+        exact_maps(pid, mapping)
+        same_current_namespace(pid, nsfd)
+        checked_process(pid, process["startTicks"], pidfd)
+        return result
+    finally:
+        if nsfd is not None:
+            os.close(nsfd)
+        os.close(pidfd)
+
+
+def descendant_anchor(fd, witness, held):
+    """Keep each FD while walking; missing/replaced ancestry never grants kill."""
+    current = fd
+    for _ in range(33):
+        if identity(current) == witness["namespace"]:
+            check_anchor_fd(current, witness)
+            return
+        current = parent(current)
+        held.append(current)
+    fail("namespace ancestry exceeds bound")
+
+
+def kill_members(request):
+    witness = request["witness"]
+    mapping = witness["mapping"]
+    check_host(mapping)
+    if boot() != witness["bootId"]:
+        fail("boot changed")
+    freezer = request["freezerPath"]
+    expected_suffix = request["cgroup"][1]
+    if request["cgroup"][0] != "freezer" or not freezer.startswith("/sys/fs/cgroup/") or not freezer.endswith(expected_suffix):
+        fail("freezer identity differs")
+    if read(freezer + "/freezer.state").strip() != "FROZEN":
+        fail("job group is not frozen")
+    held = []
+    namespaces = []
+    try:
+        for item in request["processes"]:
+            pid, expected_ticks = item
+            try:
+                pidfd = os.pidfd_open(pid, 0)
+            except ProcessLookupError:
+                continue
+            held.append(pidfd)
+            if not alive(pidfd):
+                continue
+            values = checked_process(pid, expected_ticks, pidfd)
+            memberships = [line.split(":", 2)[1:] for line in read("/proc/%d/cgroup" % pid).splitlines()]
+            if request["cgroup"] not in memberships:
+                fail("process escaped frozen group")
+            nsfd = os.open("/proc/%d/ns/user" % pid, os.O_RDONLY)
+            namespaces.append(nsfd)
+            outside = any(entry["pid"] == pid and entry["startTicks"] == expected_ticks for entry in request["outsideGates"])
+            if outside and identity(nsfd) == mapping["hostNamespace"]:
+                if ids(values, "Uid") != [mapping["ownerUid"]] * 4 or ids(values, "Gid") != [mapping["ownerGid"]] * 4:
+                    fail("original keeper gate changed identity")
+            else:
+                if any(value not in (mapping["ownerUid"], mapping["candidateUid"]) for value in ids(values, "Uid")):
+                    fail("foreign UID in job group")
+                if any(value not in (mapping["ownerGid"], mapping["candidateGid"]) for value in ids(values, "Gid")):
+                    fail("foreign GID in job group")
+                descendant_anchor(nsfd, witness, namespaces)
+                if identity(nsfd) == witness["namespace"]:
+                    exact_maps(pid, mapping)
+            same_current_namespace(pid, nsfd)
+            checked_process(pid, expected_ticks, pidfd)
+        # All members are independently checked before any signal is sent.
+        if read(freezer + "/freezer.state").strip() != "FROZEN":
+            fail("freezer barrier changed")
+        for fd in held:
+            try:
+                signal.pidfd_send_signal(fd, signal.SIGKILL, None, 0)
+            except ProcessLookupError:
+                pass
+        return {"signaled": len(held)}
+    finally:
+        for fd in namespaces:
+            os.close(fd)
+        for fd in held:
+            os.close(fd)
+
+
+def main():
+    raw = sys.stdin.buffer.read(1048577)
+    if len(raw) > 1048576:
+        fail("request exceeds bound")
+    request = json.loads(raw)
+    operation = request.get("operation")
+    if operation == "anchor":
+        result = anchor(request["mapping"], request["identity"])
+    elif operation == "candidate":
+        result = candidate(request["witness"], request["identity"])
+    elif operation == "kill":
+        if not isinstance(request["processes"], list) or len(request["processes"]) > 16384 or len(request["outsideGates"]) > 1:
+            fail("process inventory exceeds bound")
+        result = kill_members(request)
+    else:
+        fail("unsupported operation")
+    print(json.dumps(result, separators=(",", ":")))
+
+
+if __name__ == "__main__":
+    main()