@sysid/sandbox-runtime-improved 0.0.43-sysid.6 → 0.0.49-sysid.1

package/vendor/seccomp/build.ts

@@ -0,0 +1,91 @@
+import { spawnSync } from 'node:child_process'
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+if (process.platform !== 'linux') {
+  console.error('seccomp build: Linux only')
+  process.exit(1)
+}
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const SRC = join(HERE, '..', 'seccomp-src')
+
+const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
+const arch = nodeArchToDir[process.arch]
+if (!arch) {
+  console.error('seccomp build: unsupported arch ' + process.arch)
+  process.exit(1)
+}
+const OUT = join(HERE, arch)
+
+function run(argv: string[]): void {
+  const [cmd, ...args] = argv
+  const r = spawnSync(cmd, args, { stdio: 'inherit' })
+  if (r.status !== 0) {
+    console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
+    process.exit(1)
+  }
+}
+
+function toCArray(bytes: Buffer): string {
+  const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
+  const lines: string[] = []
+  for (let i = 0; i < hex.length; i += 8) {
+    lines.push('    ' + hex.slice(i, i + 8).join(', ') + ',')
+  }
+  return lines.join('\n')
+}
+
+mkdirSync(OUT, { recursive: true })
+
+const cflags = ['-static', '-O2', '-Wall', '-Wextra']
+
+const gen = join(OUT, 'seccomp-unix-block')
+run([
+  'gcc',
+  ...cflags,
+  '-o',
+  gen,
+  join(SRC, 'seccomp-unix-block.c'),
+  '-lseccomp',
+])
+
+const bpf: Record<string, Buffer> = {}
+for (const target of ['x86_64', 'aarch64']) {
+  const tmp = join(OUT, target + '.bpf')
+  run([gen, tmp, target])
+  bpf[target] = readFileSync(tmp)
+  rmSync(tmp)
+}
+rmSync(gen)
+
+const header = join(OUT, 'unix-block-bpf.h')
+writeFileSync(
+  header,
+  '#if defined(__x86_64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.x86_64) +
+    '\n};\n' +
+    '#elif defined(__aarch64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.aarch64) +
+    '\n};\n' +
+    '#else\n' +
+    '#error "unsupported architecture for unix-block BPF filter"\n' +
+    '#endif\n',
+)
+
+run([
+  'gcc',
+  ...cflags,
+  '-I',
+  OUT,
+  '-o',
+  join(OUT, 'apply-seccomp'),
+  join(SRC, 'apply-seccomp.c'),
+])
+run(['strip', join(OUT, 'apply-seccomp')])
+rmSync(header)
+
+console.log('built ' + join(OUT, 'apply-seccomp'))

package/vendor/seccomp-src/apply-seccomp.c

@@ -1,98 +1,280 @@
 /*
- * apply-seccomp.c - Apply seccomp BPF filter and exec command
+ * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
  *
- * Usage: apply-seccomp <filter.bpf> <command> [args...]
+ * Usage: apply-seccomp <command> [args...]
  *
- * This program reads a pre-compiled BPF filter from a file, applies it
- * using prctl(PR_SET_SECCOMP), and then execs the specified command.
+ * This program applies a baked-in seccomp BPF filter, isolates the
+ * target command in a nested user+PID+mount namespace so it cannot see or
+ * ptrace any process that lacks the filter, applies the filter with
+ * prctl(PR_SET_SECCOMP), and execs the command.
  *
- * The BPF filter must be in the format expected by SECCOMP_MODE_FILTER:
- * - struct sock_fprog { unsigned short len; struct sock_filter *filter; }
- * - Each filter instruction is 8 bytes (BPF instruction format)
+ * Process layout inside the outer bwrap sandbox:
+ *
+ *   bwrap init (PID 1)          <- outer PID ns, no seccomp
+ *   \_ bash / socat ...         <- outer PID ns, no seccomp
+ *      \_ apply-seccomp [outer] <- outer PID ns, waits for inner init
+ *         ================================================= PID ns boundary
+ *         \_ apply-seccomp [inner init] <- inner PID 1, PR_SET_DUMPABLE=0
+ *            \_ user command            <- inner PID 2, seccomp applied
+ *
+ * From the user command's point of view /proc contains only its own process
+ * tree. The bwrap init, bash wrapper, and socat helpers are not addressable,
+ * so they cannot be ptraced or patched via /proc/N/mem even on systems with
+ * kernel.yama.ptrace_scope=0. The inner init (PID 1) sets PR_SET_DUMPABLE=0
+ * so it cannot be ptraced either.
+ *
+ * Any failure to set up the nested namespaces aborts with a non-zero exit
+ * status; we never fall back to running the command without isolation.
  *
  * Compile: gcc -static -O2 -o apply-seccomp apply-seccomp.c
  */
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
+#include <stdarg.h>
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <errno.h>
+#include <sched.h>
+#include <signal.h>
 #include <sys/prctl.h>
+#include <sys/wait.h>
+#include <sys/mount.h>
 #include <linux/seccomp.h>
 #include <linux/filter.h>
-#include <errno.h>
+
+#include "unix-block-bpf.h"
 
 #ifndef PR_SET_NO_NEW_PRIVS
 #define PR_SET_NO_NEW_PRIVS 38
 #endif
 
+#ifndef PR_CAP_AMBIENT
+#define PR_CAP_AMBIENT 47
+#define PR_CAP_AMBIENT_CLEAR_ALL 4
+#endif
+
 #ifndef SECCOMP_MODE_FILTER
 #define SECCOMP_MODE_FILTER 2
 #endif
 
-#define MAX_FILTER_SIZE 4096  // Maximum BPF filter size in bytes
+static void die(const char *msg) {
+    perror(msg);
+    _exit(1);
+}
 
-int main(int argc, char *argv[], char *envp[]) {
-    if (argc < 3) {
-        fprintf(stderr, "Usage: %s <filter.bpf> <command> [args...]\n", argv[0]);
-        return 1;
+static int write_file(const char *path, const char *fmt, ...) {
+    char buf[256];
+    va_list ap;
+    va_start(ap, fmt);
+    int len = vsnprintf(buf, sizeof(buf), fmt, ap);
+    va_end(ap);
+    if (len < 0 || (size_t)len >= sizeof(buf)) {
+        errno = EOVERFLOW;
+        return -1;
     }
 
-    const char *filter_path = argv[1];
-    char **command_argv = &argv[2];
-
-    // Open and read BPF filter file
-    int fd = open(filter_path, O_RDONLY);
+    int fd = open(path, O_WRONLY);
     if (fd < 0) {
-        perror("Failed to open BPF filter file");
-        return 1;
+        return -1;
     }
-
-    // Read filter into memory
-    unsigned char filter_bytes[MAX_FILTER_SIZE];
-    ssize_t filter_size = read(fd, filter_bytes, MAX_FILTER_SIZE);
+    ssize_t r = write(fd, buf, (size_t)len);
+    int saved = errno;
     close(fd);
+    if (r != len) {
+        errno = (r < 0) ? saved : EIO;
+        return -1;
+    }
+    return 0;
+}
 
-    if (filter_size < 0) {
-        perror("Failed to read BPF filter");
-        return 1;
+/* PID the current process forwards signals to. Used by both the outer stub
+ * (forwards to inner init) and the inner init (forwards to the worker).
+ * PID 1 ignores signals it has no handler for, so the inner init MUST install
+ * these or SIGTERM from the outside is silently dropped. */
+static volatile pid_t forward_target = -1;
+
+static void forward_signal(int sig) {
+    if (forward_target > 0) {
+        kill(forward_target, sig);
     }
-    if (filter_size == 0) {
-        fprintf(stderr, "BPF filter file is empty\n");
-        return 1;
+}
+
+static void install_forwarders(pid_t target) {
+    forward_target = target;
+    struct sigaction sa = { .sa_handler = forward_signal };
+    sigemptyset(&sa.sa_mask);
+    sigaction(SIGTERM, &sa, NULL);
+    sigaction(SIGINT,  &sa, NULL);
+    sigaction(SIGHUP,  &sa, NULL);
+    sigaction(SIGQUIT, &sa, NULL);
+    sigaction(SIGUSR1, &sa, NULL);
+    sigaction(SIGUSR2, &sa, NULL);
+}
+
+/*
+ * Wait for `main_child`, reaping any other children that exit first.
+ * Returns as soon as `main_child` terminates — the caller then _exit()s,
+ * which as PID 1 tears down the namespace and SIGKILLs any stragglers.
+ * Returns an exit(3)-style status: exit code, or 128+signal.
+ */
+static int reap_until(pid_t main_child) {
+    int status = 0;
+    for (;;) {
+        pid_t r = waitpid(-1, &status, 0);
+        if (r < 0) {
+            if (errno == EINTR) {
+                continue;
+            }
+            return 1;  /* ECHILD without seeing main_child — shouldn't happen. */
+        }
+        if (r == main_child) {
+            if (WIFEXITED(status)) {
+                return WEXITSTATUS(status);
+            }
+            if (WIFSIGNALED(status)) {
+                return 128 + WTERMSIG(status);
+            }
+            return 1;
+        }
+        /* Reaped an orphan that died before main_child; keep waiting. */
     }
-    if (filter_size % 8 != 0) {
-        fprintf(stderr, "Invalid BPF filter size: %zd (must be multiple of 8)\n", filter_size);
+}
+
+int main(int argc, char *argv[]) {
+    if (argc < 2) {
+        fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
         return 1;
     }
 
-    // Convert bytes to sock_filter instructions
-    unsigned short filter_len = filter_size / 8;
-    struct sock_filter *filter = (struct sock_filter *)filter_bytes;
+    char **command_argv = &argv[1];
 
-    // Set up sock_fprog structure
+    _Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
+                   "BPF filter size must be a multiple of sock_filter");
     struct sock_fprog prog = {
-        .len = filter_len,
-        .filter = filter,
+        .len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
+        .filter = (struct sock_filter *)unix_block_bpf,
     };
 
-    // Set NO_NEW_PRIVS to allow seccomp without CAP_SYS_ADMIN
-    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0) {
-        perror("prctl(PR_SET_NO_NEW_PRIVS) failed");
-        return 1;
+    /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
+     *
+     * Two paths to get CAP_SYS_ADMIN for the unshare:
+     *   (a) The caller (bwrap) kept CAP_SYS_ADMIN in this user namespace via
+     *       --cap-add. Just unshare directly.
+     *   (b) We don't have the cap. Create a nested user namespace to get it,
+     *       map uid/gid, then unshare. This also works when apply-seccomp is
+     *       run standalone outside bwrap.
+     *
+     * Path (a) is tried first. If the caller didn't give us the cap, the
+     * kernel returns EPERM and we fall through to (b). Path (b) can itself
+     * fail on hosts where unprivileged user namespaces are gated by an LSM
+     * (Ubuntu 24.04's AppArmor restriction, for example) — the unshare
+     * succeeds but the new namespace grants no capabilities, so the setgroups
+     * write fails. In that case we abort: the caller must supply CAP_SYS_ADMIN.
+     */
+    if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
+        if (errno != EPERM) {
+            die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS)");
+        }
+
+        uid_t uid = geteuid();
+        gid_t gid = getegid();
+
+        if (unshare(CLONE_NEWUSER) < 0) {
+            die("apply-seccomp: unshare(CLONE_NEWUSER)");
+        }
+        if (write_file("/proc/self/setgroups", "deny") < 0) {
+            die("apply-seccomp: write /proc/self/setgroups "
+                "(nested userns is capability-restricted; "
+                "caller must provide CAP_SYS_ADMIN)");
+        }
+        if (write_file("/proc/self/uid_map", "%u %u 1\n", uid, uid) < 0) {
+            die("apply-seccomp: write /proc/self/uid_map");
+        }
+        if (write_file("/proc/self/gid_map", "%u %u 1\n", gid, gid) < 0) {
+            die("apply-seccomp: write /proc/self/gid_map");
+        }
+        if (unshare(CLONE_NEWPID | CLONE_NEWNS) < 0) {
+            die("apply-seccomp: unshare(CLONE_NEWPID|CLONE_NEWNS) after userns");
+        }
     }
 
-    // Apply seccomp filter
-    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) != 0) {
-        perror("prctl(PR_SET_SECCOMP) failed");
-        return 1;
+    pid_t child = fork();
+    if (child < 0) {
+        die("apply-seccomp: fork");
     }
 
-    // Exec the command with seccomp filter active
-    execvp(command_argv[0], command_argv);
+    if (child > 0) {
+        /* Outer stub: still in bwrap's PID namespace. Forward signals and
+         * wait so the caller sees the real exit status. */
+        install_forwarders(child);
+
+        int status;
+        for (;;) {
+            pid_t r = waitpid(child, &status, 0);
+            if (r < 0 && errno == EINTR) continue;
+            if (r < 0) die("apply-seccomp: waitpid");
+            break;
+        }
+        if (WIFSIGNALED(status)) return 128 + WTERMSIG(status);
+        return WIFEXITED(status) ? WEXITSTATUS(status) : 1;
+    }
+
+    /* ================================================================
+     * Inner init — PID 1 in the nested PID namespace.
+     * ================================================================ */
+
+    /* Block ptrace and /proc/1/mem writes against this process. */
+    if (prctl(PR_SET_DUMPABLE, 0) < 0) {
+        die("apply-seccomp: prctl(PR_SET_DUMPABLE)");
+    }
+
+    /* Don't let our /proc mount propagate anywhere. */
+    if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
+        die("apply-seccomp: mount(MS_PRIVATE)");
+    }
+    /* EPERM here means a masked /proc is underneath (unprivileged Docker)
+     * and the kernel domination check refused the overmount. The nested
+     * userns above is the isolation boundary; this remount only hides
+     * outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
+     * exactly this environment. */
+    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
+        && errno != EPERM) {
+        die("apply-seccomp: mount(/proc)");
+    }
+
+    /* bwrap --cap-add places CAP_SYS_ADMIN in the ambient set so it survives
+     * exec. Clear it now that the mount is done; combined with
+     * PR_SET_NO_NEW_PRIVS, the worker's execve drops to zero capabilities. */
+    if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0) < 0) {
+        die("apply-seccomp: prctl(PR_CAP_AMBIENT_CLEAR_ALL)");
+    }
+
+    /* Fork the real workload so PID 1 can stay as a non-dumpable reaper. */
+    pid_t worker = fork();
+    if (worker < 0) {
+        die("apply-seccomp: fork(worker)");
+    }
 
-    // If we get here, exec failed
-    perror("execvp failed");
+    if (worker > 0) {
+        /* Inner init: reap everything, exit with the worker's status.
+         * When PID 1 exits the kernel tears down the whole namespace.
+         * PID 1 drops signals without handlers, so install forwarders. */
+        install_forwarders(worker);
+        _exit(reap_until(worker));
+    }
+
+    /* ---- Worker (inner PID 2): apply seccomp and exec. ---- */
+    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
+        die("apply-seccomp: prctl(PR_SET_NO_NEW_PRIVS)");
+    }
+    if (prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, &prog) < 0) {
+        die("apply-seccomp: prctl(PR_SET_SECCOMP)");
+    }
+
+    execvp(command_argv[0], command_argv);
+    die("apply-seccomp: execvp");
     return 1;
 }

package/vendor/seccomp-src/seccomp-unix-block.c

@@ -27,7 +27,11 @@
  *   gcc -o seccomp-unix-block seccomp-unix-block.c -lseccomp
  *
  * Usage:
- *   ./seccomp-unix-block <output-file>
+ *   ./seccomp-unix-block <output-file> [arch]
+ *
+ * If arch is given (x86_64 or aarch64), the filter is generated for that
+ * architecture instead of the native one. Lets a single-arch builder emit
+ * filters for both x64 and arm64.
  *
  * Dependencies:
  *   - libseccomp (libseccomp-dev package on Debian/Ubuntu)
@@ -48,12 +52,13 @@ int main(int argc, char *argv[]) {
     scmp_filter_ctx ctx;
     int rc;
 
-    if (argc != 2) {
-        fprintf(stderr, "Usage: %s <output-file>\n", argv[0]);
+    if (argc < 2 || argc > 3) {
+        fprintf(stderr, "Usage: %s <output-file> [x86_64|aarch64]\n", argv[0]);
         return 1;
     }
 
     const char *output_file = argv[1];
+    const char *arch_name = (argc == 3) ? argv[2] : NULL;
 
     /* Create seccomp context with default action ALLOW */
     ctx = seccomp_init(SCMP_ACT_ALLOW);
@@ -62,6 +67,28 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    if (arch_name != NULL) {
+        uint32_t target;
+        if (strcmp(arch_name, "x86_64") == 0) {
+            target = SCMP_ARCH_X86_64;
+        } else if (strcmp(arch_name, "aarch64") == 0) {
+            target = SCMP_ARCH_AARCH64;
+        } else {
+            fprintf(stderr, "Error: Unsupported arch '%s'\n", arch_name);
+            seccomp_release(ctx);
+            return 1;
+        }
+        if (target != seccomp_arch_native()) {
+            rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
+            if (rc == 0) rc = seccomp_arch_add(ctx, target);
+            if (rc < 0) {
+                fprintf(stderr, "Error: Failed to set target arch: %s\n", strerror(-rc));
+                seccomp_release(ctx);
+                return 1;
+            }
+        }
+    }
+
     /* Add rule to block socket(AF_UNIX, ...) */
     /* socket() syscall signature: int socket(int domain, int type, int protocol) */
     /* arg0 = domain (AF_UNIX = 1) */
@@ -77,6 +104,26 @@ int main(int argc, char *argv[]) {
         return 1;
     }
 
+    /* Block io_uring entirely. IORING_OP_SOCKET (Linux 5.19+) creates sockets
+     * in kernel context without going through the socket() syscall, bypassing
+     * the rule above. seccomp cannot inspect io_uring SQEs (they live in a
+     * shared-memory ring), so the only safe option is to deny ring creation
+     * and use. Blocking all three syscalls also covers the case of an
+     * inherited ring fd. */
+    int io_uring_calls[] = {
+        SCMP_SYS(io_uring_setup),
+        SCMP_SYS(io_uring_enter),
+        SCMP_SYS(io_uring_register),
+    };
+    for (size_t i = 0; i < sizeof(io_uring_calls) / sizeof(io_uring_calls[0]); i++) {
+        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), io_uring_calls[i], 0);
+        if (rc < 0) {
+            fprintf(stderr, "Error: Failed to add io_uring rule: %s\n", strerror(-rc));
+            seccomp_release(ctx);
+            return 1;
+        }
+    }
+
     /* Export the filter to a file */
     int fd = open(output_file, O_CREAT | O_WRONLY | O_TRUNC, 0600);
     if (fd < 0) {