@sigrun/sigrun 0.1.6 → 0.2.0

package/dist/sandbox/os-account.js

@@ -0,0 +1,49 @@
+/** Resolve local OS accounts from text files, without native account modules. */
+import { readFileSync } from "node:fs";
+function fields(line) {
+    if (line === "" || line.startsWith("#"))
+        return undefined;
+    return line.split(":");
+}
+function id(value) {
+    if (value === undefined || !/^\d+$/.test(value))
+        return undefined;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : undefined;
+}
+/**
+ * Find one login in passwd and collect its primary plus supplementary gids.
+ * Missing, malformed, and root-linked records fail closed as `undefined`.
+ */
+export function lookupOsAccount(login, read = (path) => readFileSync(path, "utf8")) {
+    const passwd = read("/etc/passwd");
+    let account;
+    for (const line of passwd.split(/\r?\n/)) {
+        const parts = fields(line);
+        if (parts === undefined || parts[0] !== login || parts.length < 7)
+            continue;
+        const uid = id(parts[2]);
+        const gid = id(parts[3]);
+        const home = parts[5];
+        if (uid === undefined || gid === undefined || uid === 0 || gid === 0 || home === "") {
+            return undefined;
+        }
+        account = { uid, gid, home };
+        break;
+    }
+    if (account === undefined)
+        return undefined;
+    const groups = new Set([account.gid]);
+    for (const line of read("/etc/group").split(/\r?\n/)) {
+        const parts = fields(line);
+        if (parts === undefined || parts.length < 4)
+            continue;
+        const gid = id(parts[2]);
+        if (gid === undefined || gid === 0)
+            continue;
+        const members = parts[3].split(",").map((member) => member.trim());
+        if (members.includes(login))
+            groups.add(gid);
+    }
+    return { ...account, groups: [...groups] };
+}

package/dist/sandbox/policy.js

@@ -0,0 +1,253 @@
+/** Build the complete, deterministic Landlock policy for one directory user. */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { agentEnv } from "../harness/agent-env.js";
+import { revalidate, validateGrantPath } from "./grants.js";
+function canonical(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return undefined;
+    }
+}
+function sortedUnique(paths) {
+    return [...new Set(paths)].sort((left, right) => left.localeCompare(right));
+}
+function sortedUniqueCanonical(paths) {
+    return sortedUnique(paths.flatMap((path) => {
+        const real = canonical(path);
+        return real === undefined ? [] : [real];
+    }));
+}
+function inside(path, root) {
+    return path === root || path.startsWith(root.endsWith(sep) ? root : root + sep);
+}
+function protectedRuntimePath(path, managed) {
+    const protectedPaths = [
+        ...Object.values(managed.roots),
+        managed.storagePath,
+        managed.coreRoot,
+    ];
+    return protectedPaths.some((protectedPath) => {
+        const real = canonical(protectedPath) ?? resolve(protectedPath);
+        return inside(path, real) || inside(real, path);
+    });
+}
+function filteredRuntimePaths(paths, managed) {
+    return paths.filter((path) => !inside("/dev/shm", path) &&
+        (managed === undefined || !protectedRuntimePath(path, managed)));
+}
+/**
+ * The node binary directory plus every existing shared-library directory
+ * reported by a trusted absolute ldd (/usr/bin/ldd, then /bin/ldd). Static
+ * builds and loader failures fall back to the binary directory alone. Only
+ * absolute ldd targets are read; virtual entries have no such target. All
+ * candidates are realpath-canonicalized before deduplication and sorting.
+ * The raw cache is keyed by execPath; protected-root filtering is per call,
+ * so one managed layout can never reuse another layout's filtered result.
+ */
+export function nodeRuntimePaths(execPath = process.execPath, managed, readLdd) {
+    const binaryDirectory = canonical(dirname(resolve(execPath)));
+    // Injected loader output is a test seam, never a production cache identity.
+    const cached = readLdd === undefined ? runtimePaths.get(execPath) : undefined;
+    if (cached !== undefined) {
+        return filteredRuntimePaths(cached, managed);
+    }
+    const paths = binaryDirectory === undefined ? [] : [binaryDirectory];
+    const loader = ["/usr/bin/ldd", "/bin/ldd"].find((path) => existsSync(path));
+    if (loader !== undefined) {
+        try {
+            const output = readLdd === undefined
+                ? execFileSync(loader, [execPath], {
+                    encoding: "utf8",
+                    stdio: ["ignore", "pipe", "ignore"],
+                })
+                : readLdd(loader, execPath);
+            for (const match of output.matchAll(/=>\s+(\/[^\s]+)/g)) {
+                const target = match[1];
+                if (target !== undefined && isAbsolute(target)) {
+                    paths.push(dirname(target));
+                }
+            }
+        }
+        catch {
+            // A static executable, a missing executable, or ldd failure adds nothing.
+        }
+    }
+    const result = sortedUniqueCanonical(paths);
+    if (readLdd === undefined)
+        runtimePaths.set(execPath, result);
+    return filteredRuntimePaths(result, managed);
+}
+const runtimePaths = new Map();
+/** Only the core module trees, never the core installation root itself. */
+export function defaultModuleTrees(coreRoot) {
+    const code = existsSync(join(coreRoot, "dist"))
+        ? join(coreRoot, "dist")
+        : join(coreRoot, "src");
+    return [code, join(coreRoot, "shared"), join(coreRoot, "node_modules")];
+}
+function validateUserPath(path, record, managed, inheritedFrom) {
+    const candidate = canonical(path) ?? resolve(path);
+    if (inside(candidate, "/dev/shm") || inside("/dev/shm", candidate)) {
+        return { ok: false, reason: "path is or contains /dev/shm" };
+    }
+    return validateGrantPath(path, {
+        managed,
+        user: record.user,
+        ...(inheritedFrom === undefined ? {} : { inheritedFrom }),
+    });
+}
+function failedStoredPath(record, managed) {
+    if (record.workspace !== undefined &&
+        !validateUserPath(record.workspace, record, managed).ok) {
+        return record.workspace;
+    }
+    return record.grants?.find((grant) => !validateUserPath(grant.path, record, managed, grant.inheritedFrom).ok)?.path;
+}
+function invalidReason(path, reason) {
+    return { ok: false, reason: `${path}: ${reason}` };
+}
+function canonicalModuleTrees(trees, managed) {
+    const coreRoot = canonical(managed.coreRoot);
+    if (coreRoot === undefined) {
+        return invalidReason(managed.coreRoot, "core root cannot be resolved");
+    }
+    const paths = [];
+    for (const tree of trees) {
+        // Every path source is canonicalized, then checked by its KIND:
+        // module trees are STRICT core descendants (never coreRoot itself);
+        // runtime libraries exclude protected roots; user paths use the full
+        // validator. A tree may neither sit inside nor contain a store root or
+        // /dev/shm (defence in depth if coreRoot ever overlaps one); an ancestor
+        // such as / is already excluded by the strict-descendant rule.
+        const candidate = canonical(tree);
+        if (candidate === undefined) {
+            return invalidReason(tree, "module tree does not exist or cannot be resolved");
+        }
+        if (candidate === coreRoot || !inside(candidate, coreRoot)) {
+            return invalidReason(tree, "module tree must be a strict descendant of coreRoot");
+        }
+        if (inside(candidate, "/dev/shm") ||
+            inside("/dev/shm", candidate) ||
+            Object.values(managed.roots).some((root) => {
+                const protectedRoot = canonical(root) ?? resolve(root);
+                return inside(candidate, protectedRoot) || inside(protectedRoot, candidate);
+            })) {
+            return invalidReason(tree, "module tree is inside a protected root or /dev/shm");
+        }
+        paths.push(candidate);
+    }
+    return { ok: true, paths };
+}
+/** Build a user's grants and environment, or fail closed with the bad path. */
+export function buildUserPolicy(record, ctx) {
+    const validation = revalidate(record, ctx.managed);
+    if (!validation.ok) {
+        const path = failedStoredPath(record, ctx.managed);
+        return {
+            ok: false,
+            reason: `${path ?? "stored workspace or grant"}: ${validation.reason}`,
+        };
+    }
+    // EVERY per-user path passes the same validator before entering policy:
+    // stored workspace/grants via revalidate, and workspace/home again below.
+    // An osAccount home must validate BEFORE any directory is created.
+    // tmp is the ONE sanctioned stateDir exception: it is derived only from
+    // stateDir/sandbox/<user>/tmp and never silently routed around validation.
+    const userArea = ctx.managed.userAreas(record.user);
+    const requestedWorkspace = record.workspace ?? ctx.osAccount?.home ?? join(userArea, "workspace");
+    const requestedHome = ctx.osAccount?.home ?? join(userArea, "home");
+    if (ctx.osAccount !== undefined) {
+        const validation = validateUserPath(requestedHome, record, ctx.managed);
+        if (!validation.ok)
+            return invalidReason(requestedHome, validation.reason);
+    }
+    const tmp = join(ctx.managed.roots.stateDir, "sandbox", record.user, "tmp");
+    for (const path of [requestedWorkspace, requestedHome, tmp]) {
+        if (ctx.osAccount !== undefined && path === tmp)
+            continue;
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+    }
+    const workspaceValidation = validateUserPath(requestedWorkspace, record, ctx.managed);
+    if (!workspaceValidation.ok) {
+        return invalidReason(requestedWorkspace, workspaceValidation.reason);
+    }
+    const homeValidation = validateUserPath(requestedHome, record, ctx.managed);
+    if (!homeValidation.ok)
+        return invalidReason(requestedHome, homeValidation.reason);
+    const realTmp = canonical(tmp) ?? (ctx.osAccount === undefined
+        ? undefined
+        : resolve(tmp));
+    if (realTmp === undefined)
+        return invalidReason(tmp, "path cannot be resolved");
+    const realWorkspace = workspaceValidation.realpath;
+    const realHome = homeValidation.realpath;
+    const moduleTrees = canonicalModuleTrees(ctx.moduleTrees, ctx.managed);
+    if (!moduleTrees.ok)
+        return moduleTrees;
+    const grants = [];
+    for (const grant of record.grants ?? []) {
+        const result = validateUserPath(grant.path, record, ctx.managed, grant.inheritedFrom);
+        if (!result.ok)
+            return invalidReason(grant.path, result.reason);
+        grants.push({ ...grant, path: result.realpath });
+    }
+    const rw = sortedUnique([
+        realWorkspace,
+        ...grants.flatMap((grant) => (grant.access === "rw" ? [grant.path] : [])),
+        realHome,
+        realTmp,
+        "/dev/null",
+        "/dev/zero",
+        "/dev/full",
+        "/dev/random",
+        "/dev/urandom",
+        "/dev/tty",
+        "/dev/pts",
+    ]);
+    const ro = sortedUnique([
+        "/usr",
+        "/bin",
+        "/sbin",
+        "/lib",
+        "/lib32",
+        "/lib64",
+        "/etc",
+        "/opt",
+        "/proc",
+        "/sys",
+        ...nodeRuntimePaths(process.execPath, ctx.managed),
+        ...moduleTrees.paths,
+        ...grants.flatMap((grant) => (grant.access === "ro" ? [grant.path] : [])),
+    ]);
+    const env = agentEnv();
+    delete env.SSH_AUTH_SOCK;
+    env.HOME = realHome;
+    env.TMPDIR = realTmp;
+    env.USER = record.user;
+    const policy = {
+        user: record.user,
+        workspace: realWorkspace,
+        home: realHome,
+        tmp: realTmp,
+        ro,
+        rw,
+        ensureDirs: ctx.osAccount === undefined ? [] : [realTmp],
+        env,
+    };
+    if (ctx.osAccount !== undefined) {
+        return {
+            ok: true,
+            policy: {
+                ...policy,
+                uid: ctx.osAccount.uid,
+                gid: ctx.osAccount.gid,
+                groups: ctx.osAccount.groups,
+            },
+        };
+    }
+    return { ok: true, policy };
+}