@sigrun/sigrun 0.1.6 → 0.2.1

package/dist/sandbox/isolation.js

@@ -0,0 +1,29 @@
+/** The process-lifetime isolation decision, including auto's irreversible latch. */
+export class IsolationState {
+    opts;
+    current;
+    latched = false;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    active() {
+        if (this.opts.mode === "auto" && this.opts.availability.available && this.opts.userCount() > 1) {
+            this.latched = true;
+        }
+        const active = this.opts.mode === "off"
+            ? false
+            : this.opts.mode === "always"
+                ? this.opts.availability.available
+                : this.latched;
+        if (active !== this.current) {
+            this.current = active;
+            this.opts.log(`sandbox isolation: ${active ? "active" : "inactive"} (mode ${this.opts.mode}${this.opts.availability.available ? "" : `, unavailable: ${this.reason() ?? "unknown reason"}`})`);
+        }
+        return active;
+    }
+    reason() {
+        if (this.opts.mode === "off")
+            return "isolation mode is off";
+        return this.opts.availability.reason;
+    }
+}

package/dist/sandbox/launch.js

@@ -0,0 +1,31 @@
+/** The shared helper launch shape for worker and per-user service processes. */
+/** Apply a complete policy in the helper, then exec the requested sibling process. */
+export function launchInJail(helper, policy, command, args, env) {
+    return {
+        command: helper,
+        args: ["run", "--", command, ...args],
+        env: {
+            ...env,
+            // Node compiled with --openssl-shared-config auto-loads
+            // $OPENSSLDIR/openssl.cnf at startup. On a package-managed
+            // Node (Homebrew) that directory lives OUTSIDE every policy
+            // prefix, and an unreadable config is a FATAL startup error —
+            // the jailed worker cannot start node at all. The worker
+            // policy grants tmp rw, so point the loader there; node does
+            // not require the file to exist. This deliberately overrides
+            // any operator-supplied OPENSSL_CONF: an operator config path
+            // is not granted inside the jail, so honoring it would be the
+            // same fatal startup error.
+            OPENSSL_CONF: `${policy.tmp}/openssl.cnf`,
+            SIGRUN_SANDBOX_POLICY: JSON.stringify({
+                ro: policy.ro,
+                rw: policy.rw,
+                ensureDirs: policy.ensureDirs,
+                minAbi: 6,
+                ...(policy.uid === undefined ? {} : { uid: policy.uid }),
+                ...(policy.gid === undefined ? {} : { gid: policy.gid }),
+                ...(policy.groups === undefined ? {} : { groups: policy.groups }),
+            }),
+        },
+    };
+}

package/dist/sandbox/os-account.js

@@ -0,0 +1,49 @@
+/** Resolve local OS accounts from text files, without native account modules. */
+import { readFileSync } from "node:fs";
+function fields(line) {
+    if (line === "" || line.startsWith("#"))
+        return undefined;
+    return line.split(":");
+}
+function id(value) {
+    if (value === undefined || !/^\d+$/.test(value))
+        return undefined;
+    const parsed = Number(value);
+    return Number.isSafeInteger(parsed) ? parsed : undefined;
+}
+/**
+ * Find one login in passwd and collect its primary plus supplementary gids.
+ * Missing, malformed, and root-linked records fail closed as `undefined`.
+ */
+export function lookupOsAccount(login, read = (path) => readFileSync(path, "utf8")) {
+    const passwd = read("/etc/passwd");
+    let account;
+    for (const line of passwd.split(/\r?\n/)) {
+        const parts = fields(line);
+        if (parts === undefined || parts[0] !== login || parts.length < 7)
+            continue;
+        const uid = id(parts[2]);
+        const gid = id(parts[3]);
+        const home = parts[5];
+        if (uid === undefined || gid === undefined || uid === 0 || gid === 0 || home === "") {
+            return undefined;
+        }
+        account = { uid, gid, home };
+        break;
+    }
+    if (account === undefined)
+        return undefined;
+    const groups = new Set([account.gid]);
+    for (const line of read("/etc/group").split(/\r?\n/)) {
+        const parts = fields(line);
+        if (parts === undefined || parts.length < 4)
+            continue;
+        const gid = id(parts[2]);
+        if (gid === undefined || gid === 0)
+            continue;
+        const members = parts[3].split(",").map((member) => member.trim());
+        if (members.includes(login))
+            groups.add(gid);
+    }
+    return { ...account, groups: [...groups] };
+}

package/dist/sandbox/policy.js

@@ -0,0 +1,274 @@
+/** Build the complete, deterministic Landlock policy for one directory user. */
+import { execFileSync } from "node:child_process";
+import { existsSync, mkdirSync, realpathSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve, sep } from "node:path";
+import { agentEnv } from "../harness/agent-env.js";
+import { revalidate, validateGrantPath } from "./grants.js";
+function canonical(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return undefined;
+    }
+}
+function sortedUnique(paths) {
+    return [...new Set(paths)].sort((left, right) => left.localeCompare(right));
+}
+function sortedUniqueCanonical(paths) {
+    return sortedUnique(paths.flatMap((path) => {
+        const real = canonical(path);
+        return real === undefined ? [] : [real];
+    }));
+}
+function inside(path, root) {
+    return path === root || path.startsWith(root.endsWith(sep) ? root : root + sep);
+}
+function protectedRuntimePath(path, managed) {
+    const protectedPaths = [
+        ...Object.values(managed.roots),
+        managed.storagePath,
+        managed.coreRoot,
+    ];
+    return protectedPaths.some((protectedPath) => {
+        const real = canonical(protectedPath) ?? resolve(protectedPath);
+        return inside(path, real) || inside(real, path);
+    });
+}
+function filteredRuntimePaths(paths, managed) {
+    return paths.filter((path) => !inside("/dev/shm", path) &&
+        (managed === undefined || !protectedRuntimePath(path, managed)));
+}
+/**
+ * The node binary directory plus every existing shared-library directory
+ * reported by a trusted absolute ldd (/usr/bin/ldd, then /bin/ldd). Static
+ * builds and loader failures fall back to the binary directory alone. Only
+ * absolute ldd targets are read; virtual entries have no such target. All
+ * candidates are realpath-canonicalized before deduplication and sorting.
+ * The raw cache is keyed by execPath; protected-root filtering is per call,
+ * so one managed layout can never reuse another layout's filtered result.
+ */
+export function nodeRuntimePaths(execPath = process.execPath, managed, readLdd) {
+    const binaryDirectory = canonical(dirname(resolve(execPath)));
+    // Injected loader output is a test seam, never a production cache identity.
+    const cached = readLdd === undefined ? runtimePaths.get(execPath) : undefined;
+    if (cached !== undefined) {
+        return filteredRuntimePaths(cached, managed);
+    }
+    const paths = binaryDirectory === undefined ? [] : [binaryDirectory];
+    const loader = ["/usr/bin/ldd", "/bin/ldd"].find((path) => existsSync(path));
+    if (loader !== undefined) {
+        try {
+            const output = readLdd === undefined
+                ? execFileSync(loader, [execPath], {
+                    encoding: "utf8",
+                    stdio: ["ignore", "pipe", "ignore"],
+                })
+                : readLdd(loader, execPath);
+            for (const match of output.matchAll(/=>\s+(\/[^\s]+)/g)) {
+                const target = match[1];
+                if (target !== undefined && isAbsolute(target)) {
+                    paths.push(dirname(target));
+                }
+            }
+        }
+        catch {
+            // A static executable, a missing executable, or ldd failure adds nothing.
+        }
+    }
+    const result = sortedUniqueCanonical(paths);
+    if (readLdd === undefined)
+        runtimePaths.set(execPath, result);
+    return filteredRuntimePaths(result, managed);
+}
+const runtimePaths = new Map();
+/** Only the core module trees, never the core installation root itself. */
+export function defaultModuleTrees(coreRoot) {
+    const code = existsSync(join(coreRoot, "dist"))
+        ? join(coreRoot, "dist")
+        : join(coreRoot, "src");
+    return [code, join(coreRoot, "shared"), join(coreRoot, "node_modules")];
+}
+/**
+ * The worker's ESM scope resolution reads coreRoot/package.json even when
+ * the entry lives in a granted module tree; an unreadable package config
+ * is a fatal startup error, so the worker policy grants this one file.
+ */
+export function defaultPackageConfig(coreRoot) {
+    return join(coreRoot, "package.json");
+}
+function validateUserPath(path, record, managed, inheritedFrom) {
+    const candidate = canonical(path) ?? resolve(path);
+    if (inside(candidate, "/dev/shm") || inside("/dev/shm", candidate)) {
+        return { ok: false, reason: "path is or contains /dev/shm" };
+    }
+    return validateGrantPath(path, {
+        managed,
+        user: record.user,
+        ...(inheritedFrom === undefined ? {} : { inheritedFrom }),
+    });
+}
+function failedStoredPath(record, managed) {
+    if (record.workspace !== undefined &&
+        !validateUserPath(record.workspace, record, managed).ok) {
+        return record.workspace;
+    }
+    return record.grants?.find((grant) => !validateUserPath(grant.path, record, managed, grant.inheritedFrom).ok)?.path;
+}
+function invalidReason(path, reason) {
+    return { ok: false, reason: `${path}: ${reason}` };
+}
+function canonicalModuleTrees(trees, managed) {
+    const coreRoot = canonical(managed.coreRoot);
+    if (coreRoot === undefined) {
+        return invalidReason(managed.coreRoot, "core root cannot be resolved");
+    }
+    const paths = [];
+    for (const tree of trees) {
+        // Every path source is canonicalized, then checked by its KIND:
+        // module trees are STRICT core descendants (never coreRoot itself);
+        // runtime libraries exclude protected roots; user paths use the full
+        // validator. A tree may neither sit inside nor contain a store root or
+        // /dev/shm (defence in depth if coreRoot ever overlaps one); an ancestor
+        // such as / is already excluded by the strict-descendant rule.
+        const candidate = canonical(tree);
+        if (candidate === undefined) {
+            return invalidReason(tree, "module tree does not exist or cannot be resolved");
+        }
+        if (candidate === coreRoot || !inside(candidate, coreRoot)) {
+            return invalidReason(tree, "module tree must be a strict descendant of coreRoot");
+        }
+        if (inside(candidate, "/dev/shm") ||
+            inside("/dev/shm", candidate) ||
+            Object.values(managed.roots).some((root) => {
+                const protectedRoot = canonical(root) ?? resolve(root);
+                return inside(candidate, protectedRoot) || inside(protectedRoot, candidate);
+            })) {
+            return invalidReason(tree, "module tree is inside a protected root or /dev/shm");
+        }
+        paths.push(candidate);
+    }
+    return { ok: true, paths };
+}
+/** Build a user's grants and environment, or fail closed with the bad path. */
+export function buildUserPolicy(record, ctx) {
+    const validation = revalidate(record, ctx.managed);
+    if (!validation.ok) {
+        const path = failedStoredPath(record, ctx.managed);
+        return {
+            ok: false,
+            reason: `${path ?? "stored workspace or grant"}: ${validation.reason}`,
+        };
+    }
+    // EVERY per-user path passes the same validator before entering policy:
+    // stored workspace/grants via revalidate, and workspace/home again below.
+    // An osAccount home must validate BEFORE any directory is created.
+    // tmp is the ONE sanctioned stateDir exception: it is derived only from
+    // stateDir/sandbox/<user>/tmp and never silently routed around validation.
+    const userArea = ctx.managed.userAreas(record.user);
+    const requestedWorkspace = record.workspace ?? ctx.osAccount?.home ?? join(userArea, "workspace");
+    const requestedHome = ctx.osAccount?.home ?? join(userArea, "home");
+    if (ctx.osAccount !== undefined) {
+        const validation = validateUserPath(requestedHome, record, ctx.managed);
+        if (!validation.ok)
+            return invalidReason(requestedHome, validation.reason);
+    }
+    const tmp = join(ctx.managed.roots.stateDir, "sandbox", record.user, "tmp");
+    for (const path of [requestedWorkspace, requestedHome, tmp]) {
+        if (ctx.osAccount !== undefined && path === tmp)
+            continue;
+        mkdirSync(path, { recursive: true, mode: 0o700 });
+    }
+    const workspaceValidation = validateUserPath(requestedWorkspace, record, ctx.managed);
+    if (!workspaceValidation.ok) {
+        return invalidReason(requestedWorkspace, workspaceValidation.reason);
+    }
+    const homeValidation = validateUserPath(requestedHome, record, ctx.managed);
+    if (!homeValidation.ok)
+        return invalidReason(requestedHome, homeValidation.reason);
+    const realTmp = canonical(tmp) ?? (ctx.osAccount === undefined
+        ? undefined
+        : resolve(tmp));
+    if (realTmp === undefined)
+        return invalidReason(tmp, "path cannot be resolved");
+    const realWorkspace = workspaceValidation.realpath;
+    const realHome = homeValidation.realpath;
+    // A source checkout that has ever been built has BOTH src/ and dist/;
+    // defaultModuleTrees picks one while the worker entry may use the other
+    // (dist worker.js when present, src worker.ts via tsx otherwise).
+    // Grant whichever sibling code tree exists so both shapes stay readable.
+    const siblingTree = join(ctx.managed.coreRoot, "src");
+    const extraTrees = existsSync(siblingTree) && !ctx.moduleTrees.includes(siblingTree)
+        ? [...ctx.moduleTrees, siblingTree]
+        : ctx.moduleTrees;
+    const moduleTrees = canonicalModuleTrees(extraTrees, ctx.managed);
+    if (!moduleTrees.ok)
+        return moduleTrees;
+    const grants = [];
+    for (const grant of record.grants ?? []) {
+        const result = validateUserPath(grant.path, record, ctx.managed, grant.inheritedFrom);
+        if (!result.ok)
+            return invalidReason(grant.path, result.reason);
+        grants.push({ ...grant, path: result.realpath });
+    }
+    const rw = sortedUnique([
+        realWorkspace,
+        ...grants.flatMap((grant) => (grant.access === "rw" ? [grant.path] : [])),
+        realHome,
+        realTmp,
+        // Device creation belongs to rw, but the selected devices' ordinary
+        // read/write I/O survives a read-only Landlock rule. rw stays empty
+        // except for workspace/home/tmp/grants so /dev/shm remains denied.
+    ]);
+    const ro = sortedUnique([
+        "/dev",
+        "/dev/null",
+        "/dev/zero",
+        "/dev/full",
+        "/dev/random",
+        "/dev/urandom",
+        "/dev/tty",
+        "/dev/pts",
+        "/usr",
+        "/bin",
+        "/sbin",
+        "/lib",
+        "/lib32",
+        "/lib64",
+        "/etc",
+        "/opt",
+        "/proc",
+        "/sys",
+        ...nodeRuntimePaths(process.execPath, ctx.managed),
+        ...moduleTrees.paths,
+        defaultPackageConfig(ctx.managed.coreRoot),
+        ...grants.flatMap((grant) => (grant.access === "ro" ? [grant.path] : [])),
+    ]);
+    const env = agentEnv();
+    delete env.SSH_AUTH_SOCK;
+    env.HOME = realHome;
+    env.TMPDIR = realTmp;
+    env.USER = record.user;
+    const policy = {
+        user: record.user,
+        workspace: realWorkspace,
+        home: realHome,
+        tmp: realTmp,
+        ro,
+        rw,
+        ensureDirs: ctx.osAccount === undefined ? [] : [realTmp],
+        env,
+    };
+    if (ctx.osAccount !== undefined) {
+        return {
+            ok: true,
+            policy: {
+                ...policy,
+                uid: ctx.osAccount.uid,
+                gid: ctx.osAccount.gid,
+                groups: ctx.osAccount.groups,
+            },
+        };
+    }
+    return { ok: true, policy };
+}