@sysid/sandbox-runtime-improved 0.0.45-sysid.2 → 0.0.49-sysid.2

package/dist/vendor/seccomp-src/apply-seccomp.c

@@ -1,9 +1,9 @@
 /*
  * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
  *
- * Usage: apply-seccomp <filter.bpf> <command> [args...]
+ * Usage: apply-seccomp <command> [args...]
  *
- * This program reads a pre-compiled BPF filter from a file, isolates the
+ * This program applies a baked-in seccomp BPF filter, isolates the
  * target command in a nested user+PID+mount namespace so it cannot see or
  * ptrace any process that lacks the filter, applies the filter with
  * prctl(PR_SET_SECCOMP), and execs the command.
@@ -45,6 +45,8 @@
 #include <linux/seccomp.h>
 #include <linux/filter.h>
 
+#include "unix-block-bpf.h"
+
 #ifndef PR_SET_NO_NEW_PRIVS
 #define PR_SET_NO_NEW_PRIVS 38
 #endif
@@ -58,8 +60,6 @@
 #define SECCOMP_MODE_FILTER 2
 #endif
 
-#define MAX_FILTER_SIZE 4096
-
 static void die(const char *msg) {
     perror(msg);
     _exit(1);
@@ -144,29 +144,18 @@ static int reap_until(pid_t main_child) {
 }
 
 int main(int argc, char *argv[]) {
-    if (argc < 3) {
-        fprintf(stderr, "Usage: %s <filter.bpf> <command> [args...]\n", argv[0]);
+    if (argc < 2) {
+        fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
         return 1;
     }
 
-    const char *filter_path = argv[1];
-    char **command_argv = &argv[2];
+    char **command_argv = &argv[1];
 
-    /* ---- Load the BPF filter up front so we fail before any namespace work. ---- */
-    int fd = open(filter_path, O_RDONLY);
-    if (fd < 0) {
-        die("apply-seccomp: open(filter)");
-    }
-    static unsigned char filter_bytes[MAX_FILTER_SIZE];
-    ssize_t filter_size = read(fd, filter_bytes, MAX_FILTER_SIZE);
-    close(fd);
-    if (filter_size <= 0 || filter_size % 8 != 0) {
-        fprintf(stderr, "apply-seccomp: invalid BPF filter (size=%zd)\n", filter_size);
-        return 1;
-    }
+    _Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
+                   "BPF filter size must be a multiple of sock_filter");
     struct sock_fprog prog = {
-        .len = (unsigned short)(filter_size / 8),
-        .filter = (struct sock_filter *)filter_bytes,
+        .len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
+        .filter = (struct sock_filter *)unix_block_bpf,
     };
 
     /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
@@ -246,7 +235,13 @@ int main(int argc, char *argv[]) {
     if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
         die("apply-seccomp: mount(MS_PRIVATE)");
     }
-    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0) {
+    /* EPERM here means a masked /proc is underneath (unprivileged Docker)
+     * and the kernel domination check refused the overmount. The nested
+     * userns above is the isolation boundary; this remount only hides
+     * outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
+     * exactly this environment. */
+    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
+        && errno != EPERM) {
         die("apply-seccomp: mount(/proc)");
     }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sysid/sandbox-runtime-improved",
-  "version": "0.0.45-sysid.2",
+  "version": "0.0.49-sysid.2",
   "description": "Improved Anthropic Sandbox Runtime (ASRT) - A general-purpose tool for wrapping security boundaries around arbitrary processes (sysid fork with several improvements and bug fixes)",
   "type": "module",
   "main": "./dist/index.js",
@@ -13,24 +13,19 @@
   },
   "scripts": {
     "build": "tsc",
-    "postbuild": "[ -d vendor ] && cp -r vendor dist/ || true",
-    "build:seccomp": "scripts/build-seccomp-binaries.sh",
+    "build:seccomp": "bun vendor/seccomp/build.ts",
     "clean": "rm -rf dist",
     "test": "bun test",
-    "test:unit": "bun test test/config-validation.test.ts test/sandbox/seccomp-filter.test.ts",
-    "test:integration": "bun test test/sandbox/integration.test.ts test/sandbox/allow-read.test.ts test/sandbox/wrap-with-sandbox.test.ts",
     "typecheck": "tsc --noEmit",
     "lint": "eslint 'src/**/*.ts' --fix --cache --cache-location=node_modules/.cache/.eslintcache",
     "lint:check": "eslint 'src/**/*.ts' --cache --cache-location=node_modules/.cache/.eslintcache",
     "format": "prettier --write 'src/**/*.ts' --cache --log-level warn",
-    "prepublishOnly": "npm run clean && npm run build",
+    "prepublishOnly": "npm run clean && npm run build && cp -r vendor dist/ && node -e \"['x64','arm64'].forEach(a=>{if(!require('fs').existsSync('dist/vendor/seccomp/'+a+'/apply-seccomp')){console.error('Missing seccomp binary: '+a);process.exit(1)}})\"",
     "prepare": "husky"
   },
   "dependencies": {
     "@pondwader/socks5-server": "^1.0.10",
-    "@types/lodash-es": "^4.17.12",
     "commander": "^12.1.0",
-    "lodash-es": "^4.17.23",
     "shell-quote": "^1.8.3",
     "zod": "^3.24.1"
   },

package/vendor/seccomp/Dockerfile.build

@@ -0,0 +1,6 @@
+FROM ubuntu:24.04
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    gcc libc6-dev libseccomp-dev curl unzip ca-certificates && \
+    rm -rf /var/lib/apt/lists/*
+RUN curl -fsSL https://bun.sh/install | BUN_INSTALL=/usr/local bash
+WORKDIR /build

package/vendor/seccomp/build.ts

@@ -0,0 +1,91 @@
+import { spawnSync } from 'node:child_process'
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+if (process.platform !== 'linux') {
+  console.error('seccomp build: Linux only')
+  process.exit(1)
+}
+
+const HERE = dirname(fileURLToPath(import.meta.url))
+const SRC = join(HERE, '..', 'seccomp-src')
+
+const nodeArchToDir: Record<string, string> = { x64: 'x64', arm64: 'arm64' }
+const arch = nodeArchToDir[process.arch]
+if (!arch) {
+  console.error('seccomp build: unsupported arch ' + process.arch)
+  process.exit(1)
+}
+const OUT = join(HERE, arch)
+
+function run(argv: string[]): void {
+  const [cmd, ...args] = argv
+  const r = spawnSync(cmd, args, { stdio: 'inherit' })
+  if (r.status !== 0) {
+    console.error(argv.join(' ') + ' exited ' + (r.status ?? r.signal))
+    process.exit(1)
+  }
+}
+
+function toCArray(bytes: Buffer): string {
+  const hex = Array.from(bytes, b => '0x' + b.toString(16).padStart(2, '0'))
+  const lines: string[] = []
+  for (let i = 0; i < hex.length; i += 8) {
+    lines.push('    ' + hex.slice(i, i + 8).join(', ') + ',')
+  }
+  return lines.join('\n')
+}
+
+mkdirSync(OUT, { recursive: true })
+
+const cflags = ['-static', '-O2', '-Wall', '-Wextra']
+
+const gen = join(OUT, 'seccomp-unix-block')
+run([
+  'gcc',
+  ...cflags,
+  '-o',
+  gen,
+  join(SRC, 'seccomp-unix-block.c'),
+  '-lseccomp',
+])
+
+const bpf: Record<string, Buffer> = {}
+for (const target of ['x86_64', 'aarch64']) {
+  const tmp = join(OUT, target + '.bpf')
+  run([gen, tmp, target])
+  bpf[target] = readFileSync(tmp)
+  rmSync(tmp)
+}
+rmSync(gen)
+
+const header = join(OUT, 'unix-block-bpf.h')
+writeFileSync(
+  header,
+  '#if defined(__x86_64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.x86_64) +
+    '\n};\n' +
+    '#elif defined(__aarch64__)\n' +
+    'static const unsigned char unix_block_bpf[] = {\n' +
+    toCArray(bpf.aarch64) +
+    '\n};\n' +
+    '#else\n' +
+    '#error "unsupported architecture for unix-block BPF filter"\n' +
+    '#endif\n',
+)
+
+run([
+  'gcc',
+  ...cflags,
+  '-I',
+  OUT,
+  '-o',
+  join(OUT, 'apply-seccomp'),
+  join(SRC, 'apply-seccomp.c'),
+])
+run(['strip', join(OUT, 'apply-seccomp')])
+rmSync(header)
+
+console.log('built ' + join(OUT, 'apply-seccomp'))

package/vendor/seccomp-src/apply-seccomp.c

@@ -1,9 +1,9 @@
 /*
  * apply-seccomp.c - Apply seccomp BPF filter in an isolated PID namespace
  *
- * Usage: apply-seccomp <filter.bpf> <command> [args...]
+ * Usage: apply-seccomp <command> [args...]
  *
- * This program reads a pre-compiled BPF filter from a file, isolates the
+ * This program applies a baked-in seccomp BPF filter, isolates the
  * target command in a nested user+PID+mount namespace so it cannot see or
  * ptrace any process that lacks the filter, applies the filter with
  * prctl(PR_SET_SECCOMP), and execs the command.
@@ -45,6 +45,8 @@
 #include <linux/seccomp.h>
 #include <linux/filter.h>
 
+#include "unix-block-bpf.h"
+
 #ifndef PR_SET_NO_NEW_PRIVS
 #define PR_SET_NO_NEW_PRIVS 38
 #endif
@@ -58,8 +60,6 @@
 #define SECCOMP_MODE_FILTER 2
 #endif
 
-#define MAX_FILTER_SIZE 4096
-
 static void die(const char *msg) {
     perror(msg);
     _exit(1);
@@ -144,29 +144,18 @@ static int reap_until(pid_t main_child) {
 }
 
 int main(int argc, char *argv[]) {
-    if (argc < 3) {
-        fprintf(stderr, "Usage: %s <filter.bpf> <command> [args...]\n", argv[0]);
+    if (argc < 2) {
+        fprintf(stderr, "Usage: %s <command> [args...]\n", argv[0]);
         return 1;
     }
 
-    const char *filter_path = argv[1];
-    char **command_argv = &argv[2];
+    char **command_argv = &argv[1];
 
-    /* ---- Load the BPF filter up front so we fail before any namespace work. ---- */
-    int fd = open(filter_path, O_RDONLY);
-    if (fd < 0) {
-        die("apply-seccomp: open(filter)");
-    }
-    static unsigned char filter_bytes[MAX_FILTER_SIZE];
-    ssize_t filter_size = read(fd, filter_bytes, MAX_FILTER_SIZE);
-    close(fd);
-    if (filter_size <= 0 || filter_size % 8 != 0) {
-        fprintf(stderr, "apply-seccomp: invalid BPF filter (size=%zd)\n", filter_size);
-        return 1;
-    }
+    _Static_assert(sizeof(unix_block_bpf) % sizeof(struct sock_filter) == 0,
+                   "BPF filter size must be a multiple of sock_filter");
     struct sock_fprog prog = {
-        .len = (unsigned short)(filter_size / 8),
-        .filter = (struct sock_filter *)filter_bytes,
+        .len = (unsigned short)(sizeof(unix_block_bpf) / sizeof(struct sock_filter)),
+        .filter = (struct sock_filter *)unix_block_bpf,
     };
 
     /* ---- New PID + mount namespaces. Children (not us) enter the PID ns. ----
@@ -246,7 +235,13 @@ int main(int argc, char *argv[]) {
     if (mount(NULL, "/", NULL, MS_REC | MS_PRIVATE, NULL) < 0) {
         die("apply-seccomp: mount(MS_PRIVATE)");
     }
-    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0) {
+    /* EPERM here means a masked /proc is underneath (unprivileged Docker)
+     * and the kernel domination check refused the overmount. The nested
+     * userns above is the isolation boundary; this remount only hides
+     * outer PIDs from `ls /proc`. enableWeakerNestedSandbox targets
+     * exactly this environment. */
+    if (mount("proc", "/proc", "proc", MS_NOSUID | MS_NODEV | MS_NOEXEC, NULL) < 0
+        && errno != EPERM) {
         die("apply-seccomp: mount(/proc)");
     }