chainlesschain 0.162.188 → 0.162.189

package/src/lib/process-execution-broker/linux-generic-bwrap-runtime.js

@@ -90,12 +90,14 @@ const OPAQUE_NON_ROOT_FILESYSTEMS = new Set([
 const REQUIRED_BWRAP_OPTIONS = [
   "--assert-userns-disabled",
   "--bind-fd",
+  "--die-with-parent",
   "--disable-userns",
   "--file",
   "--perms",
   "--remount-ro",
   "--ro-bind-fd",
   "--seccomp",
+  "--unshare-pid",
 ];
 const SECCOMP_ARCHITECTURES = Object.freeze({
   x64: Object.freeze({
@@ -127,6 +129,8 @@ const DEFAULT_RUNTIME = Object.freeze({
   homedir: () => os.homedir(),
   tmpdir: () => os.tmpdir(),
   randomBytes: (size) => crypto.randomBytes(size),
+  sleepSync: (milliseconds) =>
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, milliseconds),
   spawnSync: nativeSpawnSync,
 });
 
@@ -771,6 +775,12 @@ function createTrustedResources(
     if (!/^net:\[\d+\]$/.test(hostNetworkNamespace)) {
       throw new Error("host_network_namespace_identity_unavailable");
     }
+    const hostPidNamespace = String(
+      runtime.fs.readlinkSync("/proc/self/ns/pid"),
+    );
+    if (!/^pid:\[\d+\]$/.test(hostPidNamespace)) {
+      throw new Error("host_pid_namespace_identity_unavailable");
+    }
 
     const workspace = openPair(contract.workspaceRoot, {
       directory: true,
@@ -1245,6 +1255,10 @@ function createTrustedResources(
         contract.workspaceRoot,
         `.chainless-bwrap-probe-${nonce}`,
       );
+      const processTreeMarker = path.posix.join(
+        contract.workspaceRoot,
+        `.chainless-bwrap-tree-probe-${nonce}`,
+      );
       const outsideMarker = path.posix.join(
         runtime.tmpdir(),
         `.chainless-bwrap-outside-${nonce}`,
@@ -1368,10 +1382,16 @@ function createTrustedResources(
           `test "$(readlink /proc/self/ns/net)" != ${shellQuote(
             hostNetworkNamespace,
           )}`,
+          `test "$(readlink /proc/self/ns/pid)" != ${shellQuote(
+            hostPidNamespace,
+          )}`,
           `printf %s ${shellQuote(nonce)} > ${shellQuote(workspaceMarker)}`,
           `test "$(cat ${shellQuote(workspaceMarker)})" = ${shellQuote(nonce)}`,
           `rm -f ${shellQuote(workspaceMarker)}`,
           socketProbeCommand,
+          `( sleep 0.05; printf late-writer > ${shellQuote(
+            processTreeMarker,
+          )} ) &`,
           `printf '%s\\n%s\\n' ${shellQuote(call.policyDigest)} ${shellQuote(
             call.contractDigest,
           )}`,
@@ -1392,6 +1412,8 @@ function createTrustedResources(
           devShmCreated &&
           String(runtime.fs.readFileSync(devShmMarker, "utf8")) ===
             `host-dev-shm-${nonce}`;
+        runtime.sleepSync(75);
+        const processTreeClosed = !runtime.fs.existsSync(processTreeMarker);
         const expectedOutput = `${call.policyDigest}\n${call.contractDigest}\n`;
         const runnable =
           !result?.error &&
@@ -1399,7 +1421,8 @@ function createTrustedResources(
           String(result.stdout) === expectedOutput &&
           outsideUnchanged &&
           homeUnchanged &&
-          devShmUnchanged;
+          devShmUnchanged &&
+          processTreeClosed;
         return {
           runnable,
           policyDigest: runnable ? call.policyDigest : null,
@@ -1414,6 +1437,9 @@ function createTrustedResources(
           outsideMarkerHidden: runnable,
           networkNamespace: runnable,
           networkNamespaceChanged: runnable,
+          pidNamespace: runnable,
+          pidNamespaceChanged: runnable,
+          processTreeCloseProbe: runnable,
           socketCreationDenied: runnable,
         };
       } catch {
@@ -1421,6 +1447,7 @@ function createTrustedResources(
       } finally {
         for (const marker of [
           workspaceMarker,
+          processTreeMarker,
           outsideMarker,
           homeMarker,
           devShmMarker,

package/src/lib/process-execution-broker/linux-generic-bwrap.js

@@ -3,7 +3,7 @@
  *
  * This module is intentionally independent from platform-sandbox.js so the
  * Broker can adopt it without weakening the narrow Plugin-bin contract. A raw
- * manifest policy can request filesystem/network boundaries, but it cannot
+ * manifest policy can request filesystem/network/process-tree boundaries, but it cannot
  * nominate a writable root: only an exact object issued here is accepted, and
  * every contract is single-use.
  *
@@ -26,7 +26,7 @@ export const LINUX_GENERIC_BWRAP_BACKEND = "linux-bwrap-workspace";
 export const LINUX_GENERIC_CONTRACT_KIND = "strict-workspace-command";
 export const LINUX_GENERIC_PTY_LAUNCHER_PATH = "/usr/bin/setsid";
 
-const SUPPORTED_BOUNDARIES = new Set(["filesystem", "network"]);
+const SUPPORTED_BOUNDARIES = new Set(["filesystem", "network", "process-tree"]);
 const SYSTEM_RUNTIME_DESTINATIONS = new Set([
   "/usr",
   "/bin",
@@ -185,7 +185,7 @@ function normalizeBoundaries(boundaries) {
     )
   ) {
     throw new TypeError(
-      "requiredBoundaries may contain only filesystem and network",
+      "requiredBoundaries may contain only filesystem, network, and process-tree",
     );
   }
   return Object.freeze(normalized);
@@ -1018,6 +1018,13 @@ function policyBinding({
       namespace: "new",
       seccomp: validated.seccomp,
     },
+    processTree: {
+      namespace: "new",
+      init: "bubblewrap-pid1-reaper",
+      dieWithParent: true,
+      asPid1: false,
+      closeFence: "pid-namespace-empty-or-killed",
+    },
     target: {
       requestedCommand: validated.target.requestedCommand,
       command: validated.target.resolvedCommand,
@@ -1199,6 +1206,9 @@ export function planLinuxGenericBubblewrap(
     probeResult.outsideMarkerHidden !== true ||
     probeResult.networkNamespace !== true ||
     probeResult.networkNamespaceChanged !== true ||
+    probeResult.pidNamespace !== true ||
+    probeResult.pidNamespaceChanged !== true ||
+    probeResult.processTreeCloseProbe !== true ||
     probeResult.socketCreationDenied !== true
   ) {
     return unavailablePlan(
@@ -1268,7 +1278,7 @@ export function planLinuxGenericBubblewrap(
     enforcement: LINUX_GENERIC_BWRAP_BACKEND,
     backend: LINUX_GENERIC_BWRAP_BACKEND,
     candidateBackend: null,
-    guarantees: Object.freeze(["filesystem", "network"]),
+    guarantees: Object.freeze(["filesystem", "network", "process-tree"]),
     requiredBoundaries: Object.freeze([...requiredBoundaries]),
     policyAttested: true,
     policyDigest,
@@ -1303,6 +1313,12 @@ export function planLinuxGenericBubblewrap(
       outsideMarkerHidden: true,
       networkNamespace: true,
       networkNamespaceChanged: true,
+      pidNamespace: true,
+      pidNamespaceChanged: true,
+      processTreeCloseProbe: true,
+      bubblewrapPid1Reaper: true,
+      dieWithParent: true,
+      closeImpliesProcessTreeClosed: true,
       socketCreationDenied: true,
       descriptorMounts: true,
     }),
@@ -1339,6 +1355,14 @@ export function planLinuxGenericBubblewrap(
       namespaceIdentityChanged: true,
       seccomp: "deny-network-creation",
     }),
+    processTreePolicy: Object.freeze({
+      namespace: "new",
+      namespaceIdentityChanged: true,
+      init: "bubblewrap-pid1-reaper",
+      parentDeathSignal: "SIGKILL",
+      asPid1: false,
+      closeFence: "pid-namespace-empty-or-killed",
+    }),
     ptyPolicy: issued.pty
       ? Object.freeze({
           mode: "dedicated-controlling-terminal",

package/src/lib/process-execution-broker/platform-sandbox.js

@@ -1113,8 +1113,8 @@ function buildWindowsAdapterInvocation(entry, invocation) {
   };
 }
 
-function resolveWindowsPowerShellHost(runtime, loaderMode) {
-  if (loaderMode !== "powershell-byte-assembly") return null;
+function resolveWindowsPowerShellHosts(runtime, loaderMode) {
+  if (loaderMode !== "powershell-byte-assembly") return [];
   const windowsDirectory = path.win32.resolve(runtime.windowsDir());
   const driveRoot = path.win32.parse(windowsDirectory).root;
   const modernHost = runtime.joinPath(
@@ -1126,13 +1126,14 @@ function resolveWindowsPowerShellHost(runtime, loaderMode) {
   );
   const realpath =
     runtime.fs.realpathSync?.native || runtime.fs.realpathSync || null;
+  const hosts = [];
   if (runtime.fs.existsSync(modernHost) && typeof realpath === "function") {
     try {
       if (
         windowsCanonicalPathKey(realpath.call(runtime.fs, modernHost)) ===
         windowsCanonicalPathKey(modernHost)
       ) {
-        return modernHost;
+        hosts.push(modernHost);
       }
     } catch {
       // Fall through to the protected in-box host.
@@ -1146,15 +1147,24 @@ function resolveWindowsPowerShellHost(runtime, loaderMode) {
     "v1.0",
     "powershell.exe",
   );
-  return runtime.fs.existsSync(inboxHost) ? inboxHost : null;
+  if (runtime.fs.existsSync(inboxHost) && !hosts.includes(inboxHost)) {
+    hosts.push(inboxHost);
+  }
+  return hosts;
 }
 
 function createFreshWindowsAdapter(runtime, source, hostEnvironment) {
   const materialized = materializeWindowsAdapter(runtime, source);
   if (!materialized.assemblyPath) return materialized;
 
-  const powershell = resolveWindowsPowerShellHost(runtime, source.loaderMode);
-  if (source.loaderMode === "powershell-byte-assembly" && !powershell) {
+  const powershellHosts = resolveWindowsPowerShellHosts(
+    runtime,
+    source.loaderMode,
+  );
+  if (
+    source.loaderMode === "powershell-byte-assembly" &&
+    powershellHosts.length === 0
+  ) {
     const assemblyDeleted = materialized.cleanupAssembly();
     return {
       reason: assemblyDeleted
@@ -1188,7 +1198,7 @@ function createFreshWindowsAdapter(runtime, source, hostEnvironment) {
     sourceDigest: source.sourceDigest,
     sourceContractDigest: source.sourceContractDigest,
     loaderMode: source.loaderMode,
-    powershellPath: powershell,
+    powershellPath: powershellHosts[0] || null,
     adapterDirectory: materialized.adapterDirectory,
     assemblyPath: materialized.assemblyPath,
     assemblyDigest: attestation.assemblyDigest,
@@ -1198,69 +1208,76 @@ function createFreshWindowsAdapter(runtime, source, hostEnvironment) {
     retired: false,
     cleaned: false,
   };
-  const probePayload = materializeWindowsAdapterInvocation(runtime, [
-    "--probe-helper",
-  ]);
-  if (!probePayload.payloadPath) {
-    const assemblyDeleted = materialized.cleanupAssembly();
-    return assemblyDeleted
-      ? probePayload
-      : { reason: "windows_native_adapter_compile_cleanup_unverified" };
-  }
-  const probeInvocation = buildWindowsAdapterInvocation(entry, probePayload);
-  let probeResult;
-  let probePayloadDeleted = false;
-  try {
-    probeResult = runtime.spawnSync(
-      probeInvocation.command,
-      probeInvocation.args,
-      {
-        shell: false,
-        windowsHide: true,
-        encoding: "utf8",
-        timeout: WINDOWS_SANDBOX_HELPER_OPERATION_TIMEOUT_MS,
-        cwd: runtime.joinPath(runtime.windowsDir(), "System32"),
-        env: hostEnvironment,
-      },
-    );
-  } catch (error) {
-    probeResult = { error, status: null };
-  } finally {
-    probePayloadDeleted = probeInvocation.cleanup();
-  }
-  let probeReady = false;
-  try {
-    const probe = JSON.parse(String(probeResult?.stdout || "").trim());
-    probeReady =
-      probeResult?.status === 0 &&
-      probe?.ready === true &&
-      probe?.hostRuntime ===
-        (source.loaderMode === "managed-executable"
-          ? "managed-executable-v1"
-          : "powershell-byte-assembly-v1") &&
-      (source.sourceContractDigest === null ||
-        probe?.sourceSha256 === source.sourceContractDigest);
-  } catch {
-    probeReady = false;
-  }
-  if (
-    !probePayloadDeleted ||
-    !probeReady ||
-    !verifyWindowsAdapterEntry(entry, runtime, source)
-  ) {
-    const assemblyDeleted = materialized.cleanupAssembly();
-    return {
-      reason:
-        !assemblyDeleted || !probePayloadDeleted
-          ? "windows_native_adapter_compile_cleanup_unverified"
-          : "windows_in_memory_adapter_probe_failed",
-    };
+  const probeHosts =
+    source.loaderMode === "powershell-byte-assembly" ? powershellHosts : [null];
+  for (const powershellPath of probeHosts) {
+    entry.powershellPath = powershellPath;
+    const probePayload = materializeWindowsAdapterInvocation(runtime, [
+      "--probe-helper",
+    ]);
+    if (!probePayload.payloadPath) {
+      const assemblyDeleted = materialized.cleanupAssembly();
+      return assemblyDeleted
+        ? probePayload
+        : { reason: "windows_native_adapter_compile_cleanup_unverified" };
+    }
+    const probeInvocation = buildWindowsAdapterInvocation(entry, probePayload);
+    let probeResult;
+    let probePayloadDeleted = false;
+    try {
+      probeResult = runtime.spawnSync(
+        probeInvocation.command,
+        probeInvocation.args,
+        {
+          shell: false,
+          windowsHide: true,
+          encoding: "utf8",
+          timeout: WINDOWS_SANDBOX_HELPER_OPERATION_TIMEOUT_MS,
+          cwd: runtime.joinPath(runtime.windowsDir(), "System32"),
+          env: hostEnvironment,
+        },
+      );
+    } catch (error) {
+      probeResult = { error, status: null };
+    } finally {
+      probePayloadDeleted = probeInvocation.cleanup();
+    }
+    if (!probePayloadDeleted) {
+      materialized.cleanupAssembly();
+      return {
+        reason: "windows_native_adapter_compile_cleanup_unverified",
+      };
+    }
+    let probeReady = false;
+    try {
+      const probe = JSON.parse(String(probeResult?.stdout || "").trim());
+      probeReady =
+        probeResult?.status === 0 &&
+        probe?.ready === true &&
+        probe?.hostRuntime ===
+          (source.loaderMode === "managed-executable"
+            ? "managed-executable-v1"
+            : "powershell-byte-assembly-v1") &&
+        (source.sourceContractDigest === null ||
+          probe?.sourceSha256 === source.sourceContractDigest);
+    } catch {
+      probeReady = false;
+    }
+    if (!probeReady) continue;
+    if (!verifyWindowsAdapterEntry(entry, runtime, source)) break;
+
+    windowsAdapterCacheEntries.add(entry);
+    windowsAdapterCache = entry;
+    registerWindowsAdapterExitCleanup();
+    return { entry };
   }
 
-  windowsAdapterCacheEntries.add(entry);
-  windowsAdapterCache = entry;
-  registerWindowsAdapterExitCleanup();
-  return { entry };
+  const assemblyDeleted = materialized.cleanupAssembly();
+  return {
+    reason: assemblyDeleted
+      ? "windows_in_memory_adapter_probe_failed"
+      : "windows_native_adapter_compile_cleanup_unverified",
+  };
 }
 
 function acquireWindowsAdapterLease(runtime, source, hostEnvironment) {
@@ -5418,7 +5435,8 @@ export function applyLinuxSandbox(
   const requiresStrongLinuxBoundary = requiredBoundaries.some(
     (boundary) =>
       boundary === SANDBOX_BOUNDARIES.FILESYSTEM ||
-      boundary === SANDBOX_BOUNDARIES.NETWORK,
+      boundary === SANDBOX_BOUNDARIES.NETWORK ||
+      boundary === SANDBOX_BOUNDARIES.PROCESS_TREE,
   );
 
   if (requiresStrongLinuxBoundary) {
@@ -6116,7 +6134,11 @@ export function applyLinuxSandbox(
       policyDigest,
       runtimeProbe,
       reason: null,
-      guarantees: [SANDBOX_BOUNDARIES.FILESYSTEM, SANDBOX_BOUNDARIES.NETWORK],
+      guarantees: [
+        SANDBOX_BOUNDARIES.FILESYSTEM,
+        SANDBOX_BOUNDARIES.NETWORK,
+        SANDBOX_BOUNDARIES.PROCESS_TREE,
+      ],
       command: finalLaunch.command,
       args: [...policyArgs, "--", ...targetArgs],
       options,