@sysid/sandbox-runtime-improved 0.0.43-sysid.5 → 0.0.45-sysid.2

package/dist/vendor/seccomp-src/apply-seccomp.c

@@ -1,39 +1,149 @@
 /*
- * apply-seccomp.c - Apply seccomp BPF filter and exec command
+ * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
  *
  * Usage: apply-seccomp <filter.bpf> <command> [args...]
  *
- * This program reads a pre-compiled BPF filter from a file, applies it
- * using prctl(PR_SET_SECCOMP), and then execs the specified command.
+ * This program reads a pre-compiled BPF filter from a file, isolates the
+ * target command in a nested user+PID+mount namespace so it cannot see or
+ * ptrace any process that lacks the filter, applies the filter with
+ * prctl(PR_SET_SECCOMP), and execs the command.
  *
- * The BPF filter must be in the format expected by SECCOMP_MODE_FILTER:
- * - struct sock_fprog { unsigned short len; struct sock_filter *filter; }
- * - Each filter instruction is 8 bytes (BPF instruction format)
+ * Process layout inside the outer bwrap sandbox:
+ *
+ *   bwrap init (PID 1)          <- outer PID ns, no seccomp
+ *   \_ bash / socat ...         <- outer PID ns, no seccomp
+ *      \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
+ *         ================================================= PID ns boundary
+ *         \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
+ *            \_ user command            <- inner PID 2, seccomp applied
+ *
+ * From the user command's point of view /proc contains only its own process
+ * tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
+ * so they cannot be ptraced or patched via /proc/N/mem even on systems with
+ * kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
+ * so it cannot be ptraced either.
+ *
+ * Any failure to set up the nested namespaces aborts with a non-zero exit
+ * status; we never fall back to running the command without isolation.
  *
  * Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
  */
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdarg.h>
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <errno.h>
+#include <sched.h>
+#include <signal.h>
 #include <sys/prctl.h>
+#include <sys/wait.h>
+#include <sys/mount.h>
 #include <linux/seccomp.h>
 #include <linux/filter.h>
-#include <errno.h>
 
 #ifndef PR_SET_NO_NEW_PRIVS
 #define PR_SET_NO_NEW_PRIVS 38
 #endif
 
+#ifndef PR_CAP_AMBIENT
+#define PR_CAP_AMBIENT 47
+#define PR_CAP_AMBIENT_CLEAR_ALL 4
+#endif
+
 #ifndef SECCOMP_MODE_FILTER
 #define SECCOMP_MODE_FILTER 2
 #endif
 
-#define MAX_FILTER_SIZE 4096  // Maximum BPF filter size in bytes
+#define MAX_FILTER_SIZE 4096
+
+static void die(const char *msg) {
+    perror(msg);
+    _exit(1);
+}
+
+static int write_file(const char *path, const char *fmt, ...) {
+    char buf[256];
+    va_list ap;
+    va_start(ap, fmt);
+    int len = vsnprintf(buf, sizeof(buf), fmt, ap);
+    va_end(ap);
+    if (len < 0 || (size_t)len >= sizeof(buf)) {
+        errno = EOVERFLOW;
+        return -1;
+    }
+
+    int fd = open(path, O_WRONLY);
+    if (fd < 0) {
+        return -1;
+    }
+    ssize_t r = write(fd, buf, (size_t)len);
+    int saved = errno;
+    close(fd);
+    if (r != len) {
+        errno = (r < 0) ? saved : EIO;
+        return -1;
+    }
+    return 0;
+}
+
+/* PID the current process forwards signals to. Used by both the outer stub
+ * (forwards to inner init) and the inner init (forwards to the worker).
+ * PID 1 ignores signals it has no handler for, so the inner init MUST install
+ * these or SIGTERM from the outside is silently dropped. */
+static volatile pid_t forward_target = -1;
+
+static void forward_signal(int sig) {
+    if (forward_target > 0) {
+        kill(forward_target, sig);
+    }
+}
+
+static void install_forwarders(pid_t target) {
+    forward_target = target;
+    struct sigaction sa = { .sa_handler = forward_signal };
+    sigemptyset(&sa.sa_mask);
+    sigaction(SIGTERM, &sa, NULL);
+    sigaction(SIGINT,  &sa, NULL);
+    sigaction(SIGHUP,  &sa, NULL);
+    sigaction(SIGQUIT, &sa, NULL);
+    sigaction(SIGUSR1, &sa, NULL);
+    sigaction(SIGUSR2, &sa, NULL);
+}
+
+/*
+ * Wait for `main_child`, reaping any other children that exit first.
+ * Returns as soon as `main_child` terminates — the caller then _exit()s,
+ * which as PID 1 tears down the namespace and SIGKILLs any stragglers.
+ * Returns an exit(3)-style status: exit code, or 128+signal.
+ */
+static int reap_until(pid_t main_child) {
+    int status = 0;
+    for (;;) {
+        pid_t r = waitpid(-1, &status, 0);
+        if (r < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return 1;  /* ECHILD without seeing main_child — shouldn't happen. */
+        }
+        if (r == main_child) {
+            if (WIFEXITED(status)) {
+                return WEXITSTATUS(status);
+            }
+            if (WIFSIGNALED(status)) {
+                return 128 + WTERMSIG(status);
+            }
+            return 1;
+        }
+        /* Reaped an orphan that died before main_child; keep waiting. */
+    }
+}
 
-int main(int argc, char *argv[], char *envp[]) {
+int main(int argc, char *argv[]) {
     if (argc < 3) {
         fprintf(stderr, "Usage: %s <filter.bpf> <command> [args...]\n", argv[0]);
         return 1;
@@ -42,57 +152,134 @@ int main(int argc, char *argv[], char *envp[]) {
     const char *filter_path = argv[1];
     char **command_argv = &argv[2];
 
-    // Open and read BPF filter file
+    /* ---- Load the BPF filter up front so we fail before any namespace work. ---- */
     int fd = open(filter_path, O_RDONLY);
     if (fd < 0) {
-        perror("Failed to open BPF filter file");
-        return 1;
+        die("apply-seccomp: open(filter)");
     }
-
-    // Read filter into memory
-    unsigned char filter_bytes[MAX_FILTER_SIZE];
+    static unsigned char filter_bytes[MAX_FILTER_SIZE];
     ssize_t filter_size = read(fd, filter_bytes, MAX_FILTER_SIZE);
     close(fd);
-
-    if (filter_size < 0) {
-        perror("Failed to read BPF filter");
+    if (filter_size <= 0 || filter_size % 8 != 0) {
+        fprintf(stderr, "apply-seccomp: invalid BPF filter (size=%zd)\n", filter_size);
         return 1;
     }
-    if (filter_size == 0) {
-        fprintf(stderr, "BPF filter file is empty\n");
-        return 1;
+    struct sock_fprog prog = {
+        .len = (unsigned short)(filter_size / 8),
+        .filter = (struct sock_filter *)filter_bytes,
+    };
+
+    /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
+     *
+     * Two paths to get CAP_SYS_ADMIN for the unshare:
+     *   (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
+     *       --cap-add. Just unshare directly.
+     *   (b) We don't have the cap. Create a nested user namespace to get it,
+     *       map uid/gid, then unshare. This also works when apply-seccomp is
+     *       run standalone outside bwrap.
+     *
+     * Path (a) is tried first. If the caller didn't give us the cap, the
+     * kernel returns EPERM and we fall through to (b). Path (b) can itself
+     * fail on hosts where unprivileged user namespaces are gated by an LSM
+     * (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
+     * succeeds but the new namespace grants no capabilities, so the setgroups
+     * write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
+     */
+    if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
+        if (errno != EPERM) {
+            die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
+        }
+
+        uid_t uid = geteuid();
+        gid_t gid = getegid();
+
+        if (unshare(CLONE_NEWUSER) < 0) {
+            die("apply-seccomp: unshare(CLONE_NEWUSER)");
+        }
+        if (write_file("/proc/self/setgroups", "deny") < 0) {
+            die("apply-seccomp: write /proc/self/setgroups "
+                "(nested userns is capability-restricted; "
+                "caller must provide CAP_SYS_ADMIN)");
+        }
+        if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
+            die("apply-seccomp: write /proc/self/uid_map");
+        }
+        if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
+            die("apply-seccomp: write /proc/self/gid_map");
+        }
+        if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
+            die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
+        }
     }
-    if (filter_size % 8 != 0) {
-        fprintf(stderr, "Invalid BPF filter size: %zd (must be multiple of 8)\n", filter_size);
-        return 1;
+
+    pid_t child = fork();
+    if (child < 0) {
+        die("apply-seccomp: fork");
     }
 
-    // Convert bytes to sock_filter instructions
-    unsigned short filter_len = filter_size / 8;
-    struct sock_filter *filter = (struct sock_filter *)filter_bytes;
+    if (child > 0) {
+        /* Outer stub: still in bwrap's PID namespace. Forward signals and
+         * wait so the caller sees the real exit status. */
+        install_forwarders(child);
 
-    // Set up sock_fprog structure
-    struct sock_fprog prog = {
-        .len = filter_len,
-        .filter = filter,
-    };
+        int status;
+        for (;;) {
+            pid_t r = waitpid(child, &status, 0);
+            if (r < 0 && errno == EINTR) continue;
+            if (r < 0) die("apply-seccomp: waitpid");
+            break;
+        }
+        if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
+        return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
+    }
 
-    // Set NO_NEW_PRIVS to allow seccomp without CAP_SYS_ADMIN
-    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
-        perror("prctl(PR_SET_NO_NEW_PRIVS) failed");
-        return 1;
+    /* ================================================================
+     * Inner init — PID 1 in the nested PID namespace.
+     * ================================================================ */
+
+    /* Block ptrace and /proc/1/mem writes against this process. */
+    if (prctl(PR_SET_DUMPABLE, 0) < 0) {
+        die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
     }
 
-    // Apply seccomp filter
-    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) != 0) {
-        perror("prctl(PR_SET_SECCOMP) failed");
-        return 1;
+    /* Don't let our /proc mount propagate anywhere. */
+    if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
+        die("apply-seccomp: mount(MS_PRIVATE)");
+    }
+    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0) {
+        die("apply-seccomp: mount(/proc)");
     }
 
-    // Exec the command with seccomp filter active
-    execvp(command_argv[0], command_argv);
+    /* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
+     * exec. Clear it now that the mount is done; combined with
+     * PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
+    if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
+        die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
+    }
+
+    /* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
+    pid_t worker = fork();
+    if (worker < 0) {
+        die("apply-seccomp: fork(worker)");
+    }
+
+    if (worker > 0) {
+        /* Inner init: reap everything, exit with the worker's status.
+         * When PID 1 exits the kernel tears down the whole namespace.
+         * PID 1 drops signals without handlers, so install forwarders. */
+        install_forwarders(worker);
+        _exit(reap_until(worker));
+    }
 
-    // If we get here, exec failed
-    perror("execvp failed");
+    /* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
+    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+        die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
+    }
+    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
+        die("apply-seccomp: prctl(PR_SET_SECCOMP)");
+    }
+
+    execvp(command_argv[0], command_argv);
+    die("apply-seccomp: execvp");
     return 1;
 }

package/dist/vendor/seccomp-src/seccomp-unix-block.c

@@ -27,7 +27,11 @@
  *   gcc -o seccomp-unix-block seccomp-unix-block.c -lseccomp
  *
  * Usage:
- *   ./seccomp-unix-block <output-file>
+ *   ./seccomp-unix-block <output-file> [arch]
+ *
+ * If arch is given (x86_64 or aarch64), the filter is generated for that
+ * architecture instead of the native one. Lets a single-arch builder emit
+ * filters for both x64 and arm64.
  *
  * Dependencies:
  *   - libseccomp (libseccomp-dev package on Debian/Ubuntu)
@@ -48,12 +52,13 @@ int main(int argc, char *argv[]) {
     scmp_filter_ctx ctx;
     int rc;
 
-    if (argc != 2) {
-        fprintf(stderr, "Usage: %s <output-file>\n", argv[0]);
+    if (argc < 2 || argc > 3) {
+        fprintf(stderr, "Usage: %s <output-file> [x86_64|aarch64]\n", argv[0]);
         return 1;
     }
 
     const char *output_file = argv[1];
+    const char *arch_name = (argc == 3) ? argv[2] : NULL;
 
     /* Create seccomp context with default action ALLOW */
     ctx = seccomp_init(SCMP_ACT_ALLOW);
@@ -62,6 +67,28 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    if (arch_name != NULL) {
+        uint32_t target;
+        if (strcmp(arch_name, "x86_64") == 0) {
+            target = SCMP_ARCH_X86_64;
+        } else if (strcmp(arch_name, "aarch64") == 0) {
+            target = SCMP_ARCH_AARCH64;
+        } else {
+            fprintf(stderr, "Error: Unsupported arch '%s'\n", arch_name);
+            seccomp_release(ctx);
+            return 1;
+        }
+        if (target != seccomp_arch_native()) {
+            rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
+            if (rc == 0) rc = seccomp_arch_add(ctx, target);
+            if (rc < 0) {
+                fprintf(stderr, "Error: Failed to set target arch: %s\n", strerror(-rc));
+                seccomp_release(ctx);
+                return 1;
+            }
+        }
+    }
+
     /* Add rule to block socket(AF_UNIX, ...) */
     /* socket() syscall signature: int socket(int domain, int type, int protocol) */
     /* arg0 = domain (AF_UNIX = 1) */
@@ -77,6 +104,26 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    /* Block io_uring entirely. IORING_OP_SOCKET (Linux 5.19+) creates sockets
+     * in kernel context without going through the socket() syscall, bypassing
+     * the rule above. seccomp cannot inspect io_uring SQEs (they live in a
+     * shared-memory ring), so the only safe option is to deny ring creation
+     * and use. Blocking all three syscalls also covers the case of an
+     * inherited ring fd. */
+    int io_uring_calls[] = {
+        SCMP_SYS(io_uring_setup),
+        SCMP_SYS(io_uring_enter),
+        SCMP_SYS(io_uring_register),
+    };
+    for (size_t i = 0; i < sizeof(io_uring_calls) / sizeof(io_uring_calls[0]); i++) {
+        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), io_uring_calls[i], 0);
+        if (rc < 0) {
+            fprintf(stderr, "Error: Failed to add io_uring rule: %s\n", strerror(-rc));
+            seccomp_release(ctx);
+            return 1;
+        }
+    }
+
     /* Export the filter to a file */
     int fd = open(output_file, O_CREAT | O_WRONLY | O_TRUNC, 0600);
     if (fd < 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sysid/sandbox-runtime-improved",
-  "version": "0.0.43-sysid.5",
+  "version": "0.0.45-sysid.2",
   "description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
   "type": "module",
   "main": "./dist/index.js",
@@ -18,7 +18,7 @@
     "clean": "rm -rf dist",
     "test": "bun test",
     "test:unit": "bun test test/config-validation.test.ts test/sandbox/seccomp-filter.test.ts",
-    "test:integration": "bun test test/sandbox/integration.test.ts",
+    "test:integration": "bun test test/sandbox/integration.test.ts test/sandbox/allow-read.test.ts test/sandbox/wrap-with-sandbox.test.ts",
     "typecheck": "tsc --noEmit",
     "lint": "eslint 'src/**/*.ts' --fix --cache --cache-location=node_modules/.cache/.eslintcache",
     "lint:check": "eslint 'src/**/*.ts' --cache --cache-location=node_modules/.cache/.eslintcache",