@fungi.computer/spore-native-linux-x64 0.2.0 → 0.3.0

package/README.md

@@ -7,12 +7,12 @@ Requires glibc 2.35 or newer.
 The engine uses pinned Codex sources with Fungi's rooted invocation wrapper.
 Upstream terms are in `LICENSE.codex` and `THIRD_PARTY_NOTICES`.
 
-Linux also carries the pinned bubblewrap engine and seccomp filter, their SHA-256 sidecars and build
-provenance. Its unmodified upstream source is in `SOURCE.bubblewrap.tar.xz`;
+Linux also carries the pinned bubblewrap engine, both permission-mode seccomp filters and build
+provenance. The runtime verifies them against the digests embedded in Fungi's
+built JS, never writable sidecars. Its unmodified upstream source is in `SOURCE.bubblewrap.tar.xz`;
 the recipe is in `bwrap-build-source`. Terms are in `LICENSE.bubblewrap`
 and `LICENSE.libcap`; the maintained filter generator's terms are in
 `LICENSE.sandbox-runtime`.
 
-Limits what the agent's commands can change to your project folder and blocks their network access. They can still read other files on this computer, and this is not a security boundary against a hostile program.
-Pathname Unix sockets and datagram socketpair remain known v1 limits.
+Workspace permits host networking and bounded writable package caches; Read-only blocks direct command networking and restricts writes to Agent temp. Commands can still read other files on this computer, and this is not a security boundary against a hostile program.
 

package/bwrap-build-source/Dockerfile

@@ -12,7 +12,7 @@ RUN if [ "$TARGET" = linux-arm64 ]; then \
     fi && apt-get update && apt-get install -y --no-install-recommends \
       build-essential ca-certificates curl xz-utils python3-pip ninja-build \
       pkg-config patchelf libcap-dev libseccomp-dev \
-      $(if [ "$TARGET" = linux-arm64 ]; then printf 'gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libcap-dev:arm64'; fi) \
+      $(if [ "$TARGET" = linux-arm64 ]; then printf 'gcc-aarch64-linux-gnu binutils-aarch64-linux-gnu libc6-dev-arm64-cross libcap-dev:arm64'; fi) \
     && rm -rf /var/lib/apt/lists/*
 # prefer_static is a maintained Meson option newer than Jammy's Meson.
 RUN pip3 install --no-cache-dir meson==1.10.2
@@ -37,6 +37,8 @@ RUN test "$(getconf GNU_LIBC_VERSION)" = "glibc 2.35" \
     && cc -O2 -Wall -Wextra -Werror /source/vendor/seccomp-unix-block.c -lseccomp -o /compiled/seccomp-generator \
     && /compiled/seccomp-generator /out/fungi-seccomp.bpf \
       $(if [ "$TARGET" = linux-arm64 ]; then printf aarch64; else printf x86_64; fi) unix \
+    && /compiled/seccomp-generator /out/fungi-seccomp-workspace.bpf \
+      $(if [ "$TARGET" = linux-arm64 ]; then printf aarch64; else printf x86_64; fi) workspace \
     && chmod 0755 /out/fungi-bwrap \
     && patchelf --print-needed /out/fungi-bwrap > /needed \
     && while read -r lib; do \

package/bwrap-build-source/README.md

@@ -73,17 +73,17 @@ directory. Only controlled TCP/Unix listeners are created, and they close in
 mutated.
 
 The prepared probe checks confined writes, outside-write refusal, `.fungi` and
-Git config/hooks protection, a real allowed Git add/commit, private `/run` and
+Git administration write refusal (including add/commit), private `/run` and
 external XDG runtime directory, absent session locators, and refusal to reach
 the controlled host TCP/Unix listeners. Namespace denial must fail the proof,
 not trigger bare execution or a skipped success.
 
 This is a **direct backend proof fixture**, not foreground/background lifecycle
-or Files acceptance. Linked-worktree Git protection, immovable Git directories,
-shell/direct command owners, process-group cleanup, hidden-run detachment,
-installed-package resolution and all affected gates still require qualification.
-The argv/digest unit tests do not establish any of these kernel properties. Even
-a passing backend probe alone does not authorize changing readiness.
+or Files acceptance. Linked-worktree Git protection, shell/direct command
+owners, process-group cleanup, hidden-run detachment, installed-package
+resolution and all affected gates still require qualification. The argv/digest
+unit tests do not establish any of these kernel properties. Even a passing
+backend probe alone does not authorize changing readiness.
 
 ## Exact remaining gap
 

package/bwrap-build-source/pin.mjs

@@ -9,13 +9,13 @@ export const bwrapPin = Object.freeze({
     "0e85c8702248b8dd64144f594147553650cdd0e4c951690345faace79c217c4d",
 });
 
-/** Unmodified maintained libseccomp generator; never locally assembled BPF. */
+/** Retained libseccomp generator with a Workspace rule-set selector. */
 export const seccompPin = Object.freeze({
   repository: "https://github.com/anthropic-experimental/sandbox-runtime",
   revision: "38d1aee29c72035f1dba1337ac89b03a2f655d26",
   source: "vendor/seccomp-src/seccomp-unix-block.c",
   sourceSha256:
-    "9dcde4aedc076fb44efc5cc8d843c7ba898f2a056b71931812d55ef99f1ed6b1",
+    "1599d24097d5e0bac5a22c6d38de98cae990eb18ee28d6be5faccf6db80dcf24",
   licenseSha256:
     "1210bc93eb85dd786c33192d5bcb7153a93922fa99fbc1512af6a7199cb41080",
 });

package/bwrap-build-source/record.mjs

@@ -19,6 +19,13 @@ await writeFile(
   resolve(output, "fungi-seccomp.bpf.sha256"),
   `${seccompSha256}\n`,
 );
+const workspaceSeccompSha256 = createHash("sha256")
+  .update(await readFile(resolve(output, "fungi-seccomp-workspace.bpf")))
+  .digest("hex");
+await writeFile(
+  resolve(output, "fungi-seccomp-workspace.bpf.sha256"),
+  `${workspaceSeccompSha256}\n`,
+);
 await copyFile(
   "/source/vendor/LICENSE.sandbox-runtime",
   resolve(output, "LICENSE.sandbox-runtime"),
@@ -47,7 +54,11 @@ await writeFile(
       platform,
       upstream: bwrapPin,
       sha256,
-      seccomp: { generator: seccompPin, sha256: seccompSha256 },
+      seccomp: {
+        generator: seccompPin,
+        readOnlySha256: seccompSha256,
+        workspaceSha256: workspaceSeccompSha256,
+      },
       packages: [
         {
           name: "sandbox-runtime-seccomp-generator",

package/bwrap-build-source/vendor/seccomp-unix-block.c

@@ -157,7 +157,8 @@ int main(int argc, char *argv[]) {
     const char *output_file = argv[1];
     const char *arch_name = (argc >= 3) ? argv[2] : NULL;
     const char *rule_set = (argc == 4) ? argv[3] : "unix";
-    if (strcmp(rule_set, "unix") != 0 && strcmp(rule_set, "namespaces") != 0) {
+    if (strcmp(rule_set, "unix") != 0 && strcmp(rule_set, "workspace") != 0 &&
+        strcmp(rule_set, "namespaces") != 0) {
         fprintf(stderr, "Error: Unknown rule set '%s'\n", rule_set);
         return 1;
     }
@@ -209,12 +210,14 @@ int main(int argc, char *argv[]) {
      * int, so the kernel ignores the upper 32 bits of the register. A plain
      * SCMP_CMP_EQ would compare all 64 bits and miss calls where the upper bits
      * are set. */
-    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
-                          SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
-        seccomp_release(ctx);
-        return 1;
+    if (strcmp(rule_set, "unix") == 0) {
+        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
+                              SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
+        if (rc < 0) {
+            fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
+            seccomp_release(ctx);
+            return 1;
+        }
     }
 
     /* Add rule to block socket(AF_VSOCK, ...) */

package/bwrap-build.json

@@ -13,10 +13,11 @@
       "repository": "https://github.com/anthropic-experimental/sandbox-runtime",
       "revision": "38d1aee29c72035f1dba1337ac89b03a2f655d26",
       "source": "vendor/seccomp-src/seccomp-unix-block.c",
-      "sourceSha256": "9dcde4aedc076fb44efc5cc8d843c7ba898f2a056b71931812d55ef99f1ed6b1",
+      "sourceSha256": "1599d24097d5e0bac5a22c6d38de98cae990eb18ee28d6be5faccf6db80dcf24",
       "licenseSha256": "1210bc93eb85dd786c33192d5bcb7153a93922fa99fbc1512af6a7199cb41080"
     },
-    "sha256": "38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11"
+    "readOnlySha256": "38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11",
+    "workspaceSha256": "e46f1045f85fcf14f91fae8654bba6a0c87f57e3b92f60bfc16008dbf7dc87c8"
   },
   "packages": [
     {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fungi.computer/spore-native-linux-x64",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Native engines for the Fungi CLI on linux-x64",
   "os": [
     "linux"
@@ -24,9 +24,8 @@
     "THIRD_PARTY_NOTICES",
     "README.md",
     "bin/fungi-bwrap",
-    "bin/fungi-bwrap.sha256",
     "bin/fungi-seccomp.bpf",
-    "bin/fungi-seccomp.bpf.sha256",
+    "bin/fungi-seccomp-workspace.bpf",
     "bwrap-build.json",
     "LICENSE.bubblewrap",
     "LICENSE.libcap",

package/bin/fungi-bwrap.sha256

@@ -1 +0,0 @@
-035ac5ddfc70dd7d4a9b575b351944d47aa9d0bbafeb433fb72b2afb02cef7f4

package/bin/fungi-seccomp.bpf.sha256

@@ -1 +0,0 @@
-38112f9cf994bed2ed962fae63e803c41874732ab032088b2c1ea3d713e51c11