@sysid/sandbox-runtime-improved 0.0.56-sysid.1 → 0.0.61-sysid.1

package/dist/vendor/seccomp-src/seccomp-unix-block.c

@@ -1,148 +0,0 @@
-/*
- * Seccomp BPF filter generator to block Unix domain socket creation
- *
- * This program generates a seccomp-bpf filter that blocks the socket() syscall
- * when called with AF_UNIX as the domain argument. This prevents creation of
- * Unix domain sockets while allowing all other socket types (AF_INET, AF_INET6, etc.)
- * and all other syscalls.
- *
- * The filter is exported in a format compatible with bubblewrap's --seccomp flag.
- *
- * SECURITY LIMITATION - 32-bit x86 (ia32):
- * TODO: This filter does NOT block socketcall() syscall, which is a security issue
- * on 32-bit x86 systems. On ia32, the socket() syscall doesn't exist - instead,
- * all socket operations are multiplexed through socketcall():
- *   - socketcall(SYS_SOCKET, [AF_UNIX, ...]) - can bypass this filter
- *   - socketcall(SYS_SOCKETPAIR, [AF_UNIX, ...]) - can bypass this filter
- *
- * To fix this, we need to add conditional rules that:
- * 1. Check if socketcall() exists on the current architecture (32-bit x86 only)
- * 2. Block socketcall(SYS_SOCKET, ...) when first arg of sub-call is AF_UNIX
- * 3. Block socketcall(SYS_SOCKETPAIR, ...) when first arg of sub-call is AF_UNIX
- *
- * This requires inspecting the arguments passed to socketcall, which is more
- * complex BPF logic. For now, 32-bit x86 is not supported.
- *
- * Compilation:
- *   gcc -o seccomp-unix-block seccomp-unix-block.c -lseccomp
- *
- * Usage:
- *   ./seccomp-unix-block <output-file> [arch]
- *
- * If arch is given (x86_64 or aarch64), the filter is generated for that
- * architecture instead of the native one. Lets a single-arch builder emit
- * filters for both x64 and arm64.
- *
- * Dependencies:
- *   - libseccomp (libseccomp-dev package on Debian/Ubuntu)
- */
-
-#include <errno.h>
-#include <fcntl.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <unistd.h>
-#include <seccomp.h>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-
-int main(int argc, char *argv[]) {
-    scmp_filter_ctx ctx;
-    int rc;
-
-    if (argc < 2 || argc > 3) {
-        fprintf(stderr, "Usage: %s <output-file> [x86_64|aarch64]\n", argv[0]);
-        return 1;
-    }
-
-    const char *output_file = argv[1];
-    const char *arch_name = (argc == 3) ? argv[2] : NULL;
-
-    /* Create seccomp context with default action ALLOW */
-    ctx = seccomp_init(SCMP_ACT_ALLOW);
-    if (ctx == NULL) {
-        fprintf(stderr, "Error: Failed to initialize seccomp context\n");
-        return 1;
-    }
-
-    if (arch_name != NULL) {
-        uint32_t target;
-        if (strcmp(arch_name, "x86_64") == 0) {
-            target = SCMP_ARCH_X86_64;
-        } else if (strcmp(arch_name, "aarch64") == 0) {
-            target = SCMP_ARCH_AARCH64;
-        } else {
-            fprintf(stderr, "Error: Unsupported arch '%s'\n", arch_name);
-            seccomp_release(ctx);
-            return 1;
-        }
-        if (target != seccomp_arch_native()) {
-            rc = seccomp_arch_remove(ctx, SCMP_ARCH_NATIVE);
-            if (rc == 0) rc = seccomp_arch_add(ctx, target);
-            if (rc < 0) {
-                fprintf(stderr, "Error: Failed to set target arch: %s\n", strerror(-rc));
-                seccomp_release(ctx);
-                return 1;
-            }
-        }
-    }
-
-    /* Add rule to block socket(AF_UNIX, ...) */
-    /* socket() syscall signature: int socket(int domain, int type, int protocol) */
-    /* arg0 = domain (AF_UNIX = 1) */
-    /* Use SCMP_CMP_MASKED_EQ with a 32-bit mask: the domain argument is a 32-bit
-     * int, so the kernel ignores the upper 32 bits of the register. A plain
-     * SCMP_CMP_EQ would compare all 64 bits and miss calls where the upper bits
-     * are set. */
-    rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), SCMP_SYS(socket), 1,
-                          SCMP_A0(SCMP_CMP_MASKED_EQ, 0xffffffff, AF_UNIX));
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to add seccomp rule: %s\n", strerror(-rc));
-        seccomp_release(ctx);
-        return 1;
-    }
-
-    /* Block io_uring entirely. IORING_OP_SOCKET (Linux 5.19+) creates sockets
-     * in kernel context without going through the socket() syscall, bypassing
-     * the rule above. seccomp cannot inspect io_uring SQEs (they live in a
-     * shared-memory ring), so the only safe option is to deny ring creation
-     * and use. Blocking all three syscalls also covers the case of an
-     * inherited ring fd. */
-    int io_uring_calls[] = {
-        SCMP_SYS(io_uring_setup),
-        SCMP_SYS(io_uring_enter),
-        SCMP_SYS(io_uring_register),
-    };
-    for (size_t i = 0; i < sizeof(io_uring_calls) / sizeof(io_uring_calls[0]); i++) {
-        rc = seccomp_rule_add(ctx, SCMP_ACT_ERRNO(EPERM), io_uring_calls[i], 0);
-        if (rc < 0) {
-            fprintf(stderr, "Error: Failed to add io_uring rule: %s\n", strerror(-rc));
-            seccomp_release(ctx);
-            return 1;
-        }
-    }
-
-    /* Export the filter to a file */
-    int fd = open(output_file, O_CREAT | O_WRONLY | O_TRUNC, 0600);
-    if (fd < 0) {
-        fprintf(stderr, "Error: Failed to open output file: %s\n", strerror(errno));
-        seccomp_release(ctx);
-        return 1;
-    }
-
-    rc = seccomp_export_bpf(ctx, fd);
-    if (rc < 0) {
-        fprintf(stderr, "Error: Failed to export seccomp filter: %s\n", strerror(-rc));
-        close(fd);
-        seccomp_release(ctx);
-        return 1;
-    }
-
-    /* Clean up */
-    close(fd);
-    seccomp_release(ctx);
-
-    return 0;
-}

package/dist/vendor/srt-win/Cargo.lock

@@ -1,361 +0,0 @@
-# This file is automatically @generated by Cargo.
-# It is not intended for manual editing.
-version = 4
-
-[[package]]
-name = "anstream"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "824a212faf96e9acacdbd09febd34438f8f711fb84e09a8916013cd7815ca28d"
-dependencies = [
- "anstyle",
- "anstyle-parse",
- "anstyle-query",
- "anstyle-wincon",
- "colorchoice",
- "is_terminal_polyfill",
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle"
-version = "1.0.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "940b3a0ca603d1eade50a4846a2afffd5ef57a9feac2c0e2ec2e14f9ead76000"
-
-[[package]]
-name = "anstyle-parse"
-version = "1.0.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52ce7f38b242319f7cabaa6813055467063ecdc9d355bbb4ce0c68908cd8130e"
-dependencies = [
- "utf8parse",
-]
-
-[[package]]
-name = "anstyle-query"
-version = "1.1.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"
-dependencies = [
- "windows-sys",
-]
-
-[[package]]
-name = "anstyle-wincon"
-version = "3.0.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"
-dependencies = [
- "anstyle",
- "once_cell_polyfill",
- "windows-sys",
-]
-
-[[package]]
-name = "anyhow"
-version = "1.0.102"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
-
-[[package]]
-name = "clap"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1ddb117e43bbf7dacf0a4190fef4d345b9bad68dfc649cb349e7d17d28428e51"
-dependencies = [
- "clap_builder",
- "clap_derive",
-]
-
-[[package]]
-name = "clap_builder"
-version = "4.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "714a53001bf66416adb0e2ef5ac857140e7dc3a0c48fb28b2f10762fc4b5069f"
-dependencies = [
- "anstream",
- "anstyle",
- "clap_lex",
- "strsim",
-]
-
-[[package]]
-name = "clap_derive"
-version = "4.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f2ce8604710f6733aa641a2b3731eaa1e8b3d9973d5e3565da11800813f997a9"
-dependencies = [
- "heck",
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "clap_lex"
-version = "1.1.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c8d4a3bb8b1e0c1050499d1815f5ab16d04f0959b233085fb31653fbfc9d98f9"
-
-[[package]]
-name = "colorchoice"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d07550c9036bf2ae0c684c4297d503f838287c83c53686d05370d0e139ae570"
-
-[[package]]
-name = "heck"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
-
-[[package]]
-name = "is_terminal_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a6cb138bb79a146c1bd460005623e142ef0181e3d0219cb493e02f7d08a35695"
-
-[[package]]
-name = "itoa"
-version = "1.0.18"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
-
-[[package]]
-name = "memchr"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
-
-[[package]]
-name = "once_cell_polyfill"
-version = "1.70.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "384b8ab6d37215f3c5301a95a4accb5d64aa607f1fcb26a11b5303878451b4fe"
-
-[[package]]
-name = "proc-macro2"
-version = "1.0.106"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
-dependencies = [
- "unicode-ident",
-]
-
-[[package]]
-name = "quote"
-version = "1.0.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924"
-dependencies = [
- "proc-macro2",
-]
-
-[[package]]
-name = "serde"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
-dependencies = [
- "serde_core",
- "serde_derive",
-]
-
-[[package]]
-name = "serde_core"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
-dependencies = [
- "serde_derive",
-]
-
-[[package]]
-name = "serde_derive"
-version = "1.0.228"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "serde_json"
-version = "1.0.150"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
-dependencies = [
- "itoa",
- "memchr",
- "serde",
- "serde_core",
- "zmij",
-]
-
-[[package]]
-name = "srt-win"
-version = "0.0.1"
-dependencies = [
- "anyhow",
- "clap",
- "serde",
- "serde_json",
- "windows",
-]
-
-[[package]]
-name = "strsim"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7da8b5736845d9f2fcb837ea5d9e2628564b3b043a70948a3f0b778838c5fb4f"
-
-[[package]]
-name = "syn"
-version = "2.0.117"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99"
-dependencies = [
- "proc-macro2",
- "quote",
- "unicode-ident",
-]
-
-[[package]]
-name = "unicode-ident"
-version = "1.0.24"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
-
-[[package]]
-name = "utf8parse"
-version = "0.2.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821"
-
-[[package]]
-name = "windows"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527fadee13e0c05939a6a05d5bd6eec6cd2e3dbd648b9f8e447c6518133d8580"
-dependencies = [
- "windows-collections",
- "windows-core",
- "windows-future",
- "windows-numerics",
-]
-
-[[package]]
-name = "windows-collections"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "23b2d95af1a8a14a3c7367e1ed4fc9c20e0a26e79551b1454d72583c97cc6610"
-dependencies = [
- "windows-core",
-]
-
-[[package]]
-name = "windows-core"
-version = "0.62.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8e83a14d34d0623b51dce9581199302a221863196a1dde71a7663a4c2be9deb"
-dependencies = [
- "windows-implement",
- "windows-interface",
- "windows-link",
- "windows-result",
- "windows-strings",
-]
-
-[[package]]
-name = "windows-future"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e1d6f90251fe18a279739e78025bd6ddc52a7e22f921070ccdc67dde84c605cb"
-dependencies = [
- "windows-core",
- "windows-link",
- "windows-threading",
-]
-
-[[package]]
-name = "windows-implement"
-version = "0.60.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "053e2e040ab57b9dc951b72c264860db7eb3b0200ba345b4e4c3b14f67855ddf"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-interface"
-version = "0.59.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f316c4a2570ba26bbec722032c4099d8c8bc095efccdc15688708623367e358"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn",
-]
-
-[[package]]
-name = "windows-link"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
-
-[[package]]
-name = "windows-numerics"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6e2e40844ac143cdb44aead537bbf727de9b044e107a0f1220392177d15b0f26"
-dependencies = [
- "windows-core",
- "windows-link",
-]
-
-[[package]]
-name = "windows-result"
-version = "0.4.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7781fa89eaf60850ac3d2da7af8e5242a5ea78d1a11c49bf2910bb5a73853eb5"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-strings"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7837d08f69c77cf6b07689544538e017c1bfcf57e34b4c0ff58e6c2cd3b37091"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-sys"
-version = "0.61.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "windows-threading"
-version = "0.2.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3949bd5b99cafdf1c7ca86b43ca564028dfe27d66958f2470940f73d86d75b37"
-dependencies = [
- "windows-link",
-]
-
-[[package]]
-name = "zmij"
-version = "1.0.21"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8848ee67ecc8aedbaf3e4122217aff892639231befc6a1b58d29fff4c2cabaa"

package/dist/vendor/srt-win/Cargo.toml

@@ -1,46 +0,0 @@
-[package]
-name = "srt-win"
-version = "0.0.1"
-edition = "2024"
-publish = false
-description = "Windows network sandbox helper for sandbox-runtime"
-
-[lib]
-name = "srt_win"
-path = "src/lib.rs"
-
-[[bin]]
-name = "srt-win"
-path = "src/main.rs"
-
-[dependencies]
-anyhow = "1"
-clap = { version = "4", features = ["derive"] }
-serde = { version = "1", features = ["derive"] }
-serde_json = "1"
-
-[target.'cfg(windows)'.dependencies]
-windows = { version = "0.62.2", features = [
-  "Win32_Foundation",
-  "Win32_System_Threading",
-  "Win32_System_Memory",
-  "Win32_System_Rpc",
-  "Win32_System_SystemServices",
-  "Win32_System_JobObjects",
-  "Win32_System_StationsAndDesktops",
-  "Win32_System_Console",
-  "Win32_Graphics_Gdi",
-  "Win32_Security",
-  "Win32_Security_Authorization",
-  "Win32_NetworkManagement_WindowsFilteringPlatform",
-  "Win32_NetworkManagement_NetManagement",
-  "Win32_UI_Shell",
-  "Win32_UI_WindowsAndMessaging",
-  "Win32_System_Registry",
-] }
-
-[profile.release]
-opt-level = 2
-lto = "thin"
-codegen-units = 1
-strip = "symbols"

package/dist/vendor/srt-win/ci/cleanup.ps1

@@ -1,49 +0,0 @@
-<#
-  Best-effort teardown of any state smoke.ps1 may have left behind.
-  Intended for `if: always()` in CI; safe to run locally too.
-
-  Targets the same fixed test sublayer as smoke.ps1 (NOT the
-  production default), plus the per-run random alt sublayer if
-  smoke.ps1 wrote one to $env:SRT_ALT_GUID.
-
-  Usage:
-    pwsh vendor/srt-win/ci/cleanup.ps1 <path-to-srt-win.exe> [group-name]
-#>
-param(
-  [Parameter(Mandatory = $true)]
-  [string]$Exe,
-  [string]$GroupName = 'srt-ci-test',
-  # Must match smoke.ps1's default.
-  [string]$TestSublayer = 'a91b6f12-4c0e-4e30-b1f7-3d52890ce117',
-  # Must match smoke.ps1's single-install section.
-  [string]$InstallSublayer = 'b2e8a6c4-1f73-4d09-9e25-c7b0d3a48f61',
-  # Must match smoke-exec.ps1's default.
-  [string]$ExecSublayer = '5b0e64f4-09f1-4c2e-8c97-4d2c0f4e9b7d',
-  # Must match test/sandbox/winsrt.test.ts.
-  [string]$TsSublayer = '7c1f0e90-3a2b-4f5d-9e8c-1d2e3f4a5b6c'
-)
-
-$ErrorActionPreference = 'SilentlyContinue'
-
-if (-not (Test-Path $Exe)) {
-  Write-Host "cleanup: $Exe not found; nothing to do"
-  exit 0
-}
-
-if ($env:SRT_ALT_GUID) {
-  & $Exe wfp uninstall --sublayer-guid $env:SRT_ALT_GUID
-}
-& $Exe wfp uninstall --sublayer-guid $TestSublayer
-& $Exe wfp uninstall --sublayer-guid $InstallSublayer
-& $Exe wfp uninstall --sublayer-guid $ExecSublayer
-& $Exe wfp uninstall --sublayer-guid $TsSublayer
-# winsrt.test.ts installWindowsSandbox round-trip row uses this
-# sublayer + a per-process group name `srt-ts-test-<pid>`. The test
-# tears down via uninstallWindowsSandbox(); this is belt-and-braces
-# in case it crashed mid-row. The group name is per-pid so we can't
-# delete it here — harmless leftover state on an ephemeral runner.
-& $Exe wfp uninstall --sublayer-guid 8d2f1e91-4b3c-5a6e-af9d-2e3f4a5b6c7d
-& $Exe wfp uninstall --sublayer-guid 9e3a2fa2-5c4d-6b7f-ba0e-3f4a5b6c7d8e
-& $Exe group delete --name $GroupName
-& $Exe group delete --name "$GroupName-inst"
-exit 0