nawabari 0.7.1 → 0.9.2

package/dist/domain/sandbox-launcher.d.ts

@@ -1,5 +1,8 @@
 import { type DomainResult } from "./errors.js";
+import { type LandlockEffectiveState } from "./landlock.js";
+import { type SandboxSeccompProfileMetadata } from "./sandbox-seccomp.js";
 import type { SandboxExecutionRequest } from "./sandbox.js";
+import { type CgroupAccounting } from "./cgroups-v2.js";
 export type SandboxCommand = {
     readonly command: string;
     readonly args?: readonly string[];
@@ -13,6 +16,14 @@ export type SandboxInvocation = {
     readonly args: readonly string[];
     readonly cwd: string;
     readonly env: Readonly<Record<string, string>>;
+    /** Raw sock_filter bytes supplied to bubblewrap through inherited fd 3. */
+    readonly seccomp_profile: Uint8Array;
+    readonly seccomp_profile_metadata: SandboxSeccompProfileMetadata;
+    readonly landlock: {
+        readonly abi: number | null;
+        readonly state: LandlockEffectiveState;
+        readonly rule_count: number;
+    };
 };
 export type SandboxExecutionResult = {
     readonly exit_code: number | null;
@@ -20,11 +31,25 @@ export type SandboxExecutionResult = {
     readonly stdout: string;
     readonly stderr: string;
     readonly duration_ms: number;
+    /** Applied policy identity, retained as bounded machine-readable evidence. */
+    readonly seccomp_profile?: SandboxSeccompProfileMetadata;
+    readonly resources?: {
+        readonly cgroup_contract_id: string;
+        readonly scope: string;
+        readonly accounting: CgroupAccounting;
+        readonly limit_events: readonly string[];
+    };
+    readonly landlock?: {
+        readonly abi: number | null;
+        readonly state: LandlockEffectiveState;
+        readonly rule_count: number;
+    };
 };
 export type SandboxLauncherOptions = {
     readonly timeout_ms?: number;
     readonly max_output_bytes?: number;
 };
+export type { LandlockRule } from "./landlock.js";
 /**
  * Compile one authoritative request into a deterministic bubblewrap argv.
  * Mounts are derived from fixed topology fields; caller data is used only as
@@ -33,3 +58,4 @@ export type SandboxLauncherOptions = {
 export declare function compileSandboxInvocation(request: SandboxExecutionRequest, command: SandboxCommand): DomainResult<SandboxInvocation>;
 /** Execute the compiled invocation with shell execution disabled and no fallback path. */
 export declare function runSandboxedCommand(request: SandboxExecutionRequest, command: SandboxCommand, options?: SandboxLauncherOptions): Promise<DomainResult<SandboxExecutionResult>>;
+export { deriveLandlockRules } from "./landlock.js";

package/dist/domain/sandbox-launcher.js

@@ -3,6 +3,9 @@ import fs from "node:fs";
 import path from "node:path";
 import process from "node:process";
 import { DomainError, failure, success } from "./errors.js";
+import { deriveLandlockRules, LANDLOCK_ABI_MINIMUM, LANDLOCK_SETUP_FAILURE_PREFIX, LANDLOCK_TRAMPOLINE, } from "./landlock.js";
+import { compileSandboxSeccompProfile, SANDBOX_CAPABILITY_BASELINE_ID, SANDBOX_CAPABILITY_BASELINE_VERSION, SANDBOX_SECCOMP_PROFILE_ID, SANDBOX_SECCOMP_PROFILE_VERSION, } from "./sandbox-seccomp.js";
+import { attachProcessToCgroup, cleanupCgroupScope, cgroupLimitEvents, createCgroupScope, readCgroupAccounting, } from "./cgroups-v2.js";
 const SANDBOX_HOME = "/home/nawabari";
 const SANDBOX_CONFIG_HOME = `${SANDBOX_HOME}/.config`;
 const SANDBOX_LOCAL_HOME = `${SANDBOX_HOME}/.local`;
@@ -143,13 +146,11 @@ function validateTopology(request) {
 function pathMatches(candidate, root) {
     return candidate === root || candidate.startsWith(`${root}${path.sep}`);
 }
-function allowedSystemPath(candidate) {
+const BROAD_FHS_SYSTEM_ROOTS = ["/usr", "/bin", "/lib", "/lib64"];
+function allowedSystemPath(candidate, nixOSRuntime = false) {
     const normalized = path.normalize(candidate);
     const roots = [
-        "/usr",
-        "/bin",
-        "/lib",
-        "/lib64",
+        ...BROAD_FHS_SYSTEM_ROOTS,
         "/nix/store",
         "/run/current-system",
         "/run/wrappers",
@@ -162,10 +163,16 @@ function allowedSystemPath(candidate) {
         "/etc/pki",
         "/etc/ca-certificates",
     ];
+    if (nixOSRuntime && BROAD_FHS_SYSTEM_ROOTS.some((root) => pathMatches(normalized, root)))
+        return false;
     if (roots.some((root) => pathMatches(normalized, root)))
         return true;
     return new Set(["/etc/passwd", "/etc/group", "/etc/nsswitch.conf", "/etc/hosts", "/etc/resolv.conf"]).has(normalized);
 }
+function isNixOSRuntime(request) {
+    const runtimePaths = new Set(request.filesystem.runtime_paths);
+    return runtimePaths.has("/nix/store") && runtimePaths.has("/run/current-system");
+}
 function allowedRuntimePath(candidate) {
     const normalized = path.normalize(candidate);
     return (normalized === "/dev" ||
@@ -278,7 +285,7 @@ function validateExecutable(request) {
                 path: request.sandbox_executable,
             }));
         }
-        if (!allowedSystemPath(resolved) &&
+        if (!allowedSystemPath(resolved, isNixOSRuntime(request)) &&
             allowedUserToolPath(resolved, request.filesystem.user_tool_home) === null &&
             !allowedRuntimePath(resolved)) {
             return topologyError("Bubblewrap resolved outside the fixed runtime profile.", {
@@ -294,7 +301,54 @@ function validateExecutable(request) {
     }
     return checked;
 }
+function sandboxPathForLandlockHelper(source, request) {
+    const kind = allowedUserToolPath(source, request.filesystem.user_tool_home);
+    if (kind === "local_bin")
+        return `${SANDBOX_LOCAL_HOME}/bin/${path.basename(source)}`;
+    if (kind === "local_lib")
+        return `${SANDBOX_LOCAL_HOME}/lib/${path.basename(source)}`;
+    if (kind === "pnpm_bin")
+        return `${SANDBOX_LOCAL_HOME}/share/pnpm/${path.basename(source)}`;
+    return source;
+}
+function validateLandlockExecutable(request) {
+    const source = request.landlock_executable;
+    if (source === undefined || source === null)
+        return success(null);
+    if (!path.isAbsolute(source) || source.includes("\0")) {
+        return topologyError("The Landlock runtime adapter must be an absolute path without NUL bytes.", {
+            path: source,
+        });
+    }
+    const checked = ensureSourcePath(source, "Landlock runtime adapter");
+    if (!checked.ok)
+        return checked;
+    try {
+        const stat = fs.statSync(source);
+        if (!stat.isFile() || (stat.mode & 0o111) === 0) {
+            return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The Landlock runtime adapter is not executable.", {
+                path: source,
+            }));
+        }
+        const resolved = fs.realpathSync.native(source);
+        if (!allowedSystemPath(resolved, isNixOSRuntime(request)) &&
+            !allowedRuntimePath(resolved) &&
+            allowedUserToolPath(resolved, request.filesystem.user_tool_home) === null) {
+            return topologyError("The Landlock runtime adapter resolves outside the canonical runtime profile.", {
+                path: source,
+                resolved,
+            });
+        }
+        return success(sandboxPathForLandlockHelper(resolved, request));
+    }
+    catch {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The Landlock runtime adapter cannot be canonicalized.", {
+            path: source,
+        }));
+    }
+}
 function validateProfilePaths(request) {
+    const nixOSRuntime = isNixOSRuntime(request);
     for (const source of request.filesystem.runtime_paths) {
         if (!allowedRuntimePath(source)) {
             return topologyError("The runtime path is outside the canonical profile.", { path: source });
@@ -318,7 +372,7 @@ function validateProfilePaths(request) {
         }
     }
     for (const source of request.filesystem.system_paths) {
-        if (!allowedSystemPath(source)) {
+        if (!allowedSystemPath(source, nixOSRuntime)) {
             return topologyError("The system path is outside the canonical profile.", { path: source });
         }
         const checked = ensureSourcePath(source, "system path");
@@ -326,7 +380,7 @@ function validateProfilePaths(request) {
             return checked;
         try {
             const resolved = fs.realpathSync.native(source);
-            if (!allowedSystemPath(resolved)) {
+            if (!allowedSystemPath(resolved, nixOSRuntime)) {
                 return topologyError("The system path symlink resolves outside the canonical profile.", {
                     path: source,
                     resolved,
@@ -453,6 +507,49 @@ export function compileSandboxInvocation(request, command) {
     const profilePaths = validateProfilePaths(request);
     if (!profilePaths.ok)
         return profilePaths;
+    if (request.seccomp_profile.id !== SANDBOX_SECCOMP_PROFILE_ID ||
+        request.seccomp_profile.version !== SANDBOX_SECCOMP_PROFILE_VERSION ||
+        request.capability_baseline.id !== SANDBOX_CAPABILITY_BASELINE_ID ||
+        request.capability_baseline.version !== SANDBOX_CAPABILITY_BASELINE_VERSION ||
+        request.capability_baseline.ambient_capabilities.length !== 0) {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The protected execution security baseline is incompatible.", {
+            seccomp_profile_id: request.seccomp_profile.id,
+            seccomp_profile_version: request.seccomp_profile.version,
+            capability_baseline_id: request.capability_baseline.id,
+            capability_baseline_version: request.capability_baseline.version,
+        }));
+    }
+    const seccompProfile = compileSandboxSeccompProfile(request.seccomp_profile.architecture);
+    if (!seccompProfile.ok)
+        return seccompProfile;
+    const landlockAbi = request.landlock_abi ?? null;
+    const landlockSupported = landlockAbi !== null && Number.isSafeInteger(landlockAbi) && landlockAbi >= LANDLOCK_ABI_MINIMUM;
+    const landlockUnavailableState = request.landlock_state === "error" || (landlockAbi !== null && !Number.isSafeInteger(landlockAbi))
+        ? "error"
+        : landlockAbi === null
+            ? "reduced-defense"
+            : "incompatible";
+    const landlockRequired = request.landlock_required === true;
+    if (landlockRequired && !landlockSupported) {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The required Landlock ABI is unavailable or incompatible.", {
+            session_id: request.session_id,
+            abi: landlockAbi,
+            effective_state: landlockUnavailableState,
+        }));
+    }
+    const landlockSource = request.landlock_executable ?? null;
+    const shouldValidateLandlock = landlockRequired || (landlockSupported && landlockSource !== null);
+    const landlockExecutable = shouldValidateLandlock ? validateLandlockExecutable(request) : success(null);
+    if (!landlockExecutable.ok)
+        return landlockExecutable;
+    if (landlockRequired && landlockExecutable.value === null) {
+        return failure(new DomainError("SANDBOX_CAPABILITY_UNAVAILABLE", "The required Landlock runtime adapter is unavailable.", {
+            session_id: request.session_id,
+            abi: landlockAbi,
+        }));
+    }
+    const landlockEnabled = landlockSupported && landlockExecutable.value !== null;
+    const landlockRules = deriveLandlockRules(request.filesystem);
     const gitMetadata = prepareGitMetadata(request, topology.value);
     if (!gitMetadata.ok)
         return gitMetadata;
@@ -471,6 +568,8 @@ export function compileSandboxInvocation(request, command) {
         "0",
         "--cap-drop",
         "ALL",
+        "--seccomp",
+        "3",
         "--clearenv",
         "--setenv",
         "HOME",
@@ -551,7 +650,18 @@ export function compileSandboxInvocation(request, command) {
         seenDirectories.add(parent);
         args.push("--dir", parent);
     }
-    args.push("--chdir", worktreeDestination, "--", command.command, ...commandArgs);
+    const commandArgv = landlockEnabled
+        ? [
+            landlockExecutable.value,
+            "-c",
+            LANDLOCK_TRAMPOLINE,
+            JSON.stringify(landlockRules),
+            "--",
+            command.command,
+            ...commandArgs,
+        ]
+        : [command.command, ...commandArgs];
+    args.push("--chdir", worktreeDestination, "--", ...commandArgv);
     const env = {
         PATH: pathValue,
         HOME: SANDBOX_HOME,
@@ -563,21 +673,116 @@ export function compileSandboxInvocation(request, command) {
         LOGNAME: "nawabari",
         NAWABARI_SESSION_ID: request.session_id,
     };
-    return success({ executable: executable.value, args, cwd: topology.value.worktree, env });
+    return success({
+        executable: executable.value,
+        args,
+        cwd: topology.value.worktree,
+        env,
+        seccomp_profile: seccompProfile.value,
+        seccomp_profile_metadata: request.seccomp_profile,
+        landlock: {
+            abi: landlockAbi,
+            state: landlockEnabled ? "enforced" : landlockUnavailableState,
+            rule_count: landlockRules.length,
+        },
+    });
+}
+/**
+ * Give bubblewrap an unlinked, read-only profile file.  The descriptor stays
+ * open only for the launch; no profile pathname is exposed inside the child.
+ */
+function openSeccompProfile(profile) {
+    let directory = null;
+    let fd = null;
+    try {
+        directory = fs.mkdtempSync(path.join(requirementTempDirectory(), "nawabari-seccomp-"));
+        const profilePath = path.join(directory, "profile.bpf");
+        fs.writeFileSync(profilePath, profile, { mode: 0o600 });
+        fd = fs.openSync(profilePath, fs.constants.O_RDONLY);
+        fs.unlinkSync(profilePath);
+        fs.rmdirSync(directory);
+        directory = null;
+        return success({
+            fd,
+            close: () => {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch {
+                    // Closing an already-closed descriptor is harmless cleanup.
+                }
+            },
+        });
+    }
+    catch (error) {
+        if (fd !== null) {
+            try {
+                fs.closeSync(fd);
+            }
+            catch {
+                // Preserve the original setup failure.
+            }
+        }
+        if (directory !== null) {
+            try {
+                fs.rmSync(directory, { recursive: true, force: true });
+            }
+            catch {
+                // Best-effort cleanup; the profile is never used after setup failure.
+            }
+        }
+        return failure(new DomainError("SANDBOX_EXECUTION_FAILED", "The seccomp baseline could not be prepared for protected execution.", {
+            profile_id: SANDBOX_SECCOMP_PROFILE_ID,
+            reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
+        }));
+    }
+}
+function requirementTempDirectory() {
+    return process.env.TMPDIR !== undefined && path.isAbsolute(process.env.TMPDIR) ? process.env.TMPDIR : "/tmp";
 }
 function boundedOutput(chunks, bytes, maxBytes, value) {
-    const text = typeof value === "string" ? value : value.toString("utf8");
-    const textBytes = Buffer.byteLength(text, "utf8");
+    const encoded = typeof value === "string" ? Buffer.from(value, "utf8") : value;
+    const textBytes = encoded.byteLength;
     const remaining = maxBytes - bytes;
     if (remaining <= 0)
         return { bytes, exceeded: textBytes > 0 };
     if (textBytes <= remaining) {
-        chunks.push(text);
+        chunks.push(encoded.toString("utf8"));
         return { bytes: bytes + textBytes, exceeded: false };
     }
-    const bounded = Buffer.from(text).subarray(0, remaining).toString("utf8");
-    chunks.push(bounded);
-    return { bytes: maxBytes, exceeded: true };
+    // Do not let a partial UTF-8 code point turn into U+FFFD and exceed the
+    // advertised byte bound.  The launcher reports text, but the bound is
+    // defined in bytes so that machine callers can rely on it for arbitrary
+    // child output.
+    let end = remaining;
+    while (end > 0) {
+        const last = encoded[end - 1] ?? 0;
+        if ((last & 0x80) === 0)
+            break;
+        if ((last & 0xc0) === 0x80) {
+            let start = end - 1;
+            while (start > 0 && ((encoded[start - 1] ?? 0) & 0xc0) === 0x80)
+                start -= 1;
+            const lead = encoded[start] ?? 0;
+            const width = (lead & 0xe0) === 0xc0 ? 2 : (lead & 0xf0) === 0xe0 ? 3 : (lead & 0xf8) === 0xf0 ? 4 : 1;
+            if (start + width > end) {
+                end = start;
+                continue;
+            }
+        }
+        break;
+    }
+    chunks.push(encoded.subarray(0, end).toString("utf8"));
+    return { bytes: bytes + end, exceeded: true };
+}
+function landlockSetupDiagnostic(stderr) {
+    const marker = stderr.indexOf(LANDLOCK_SETUP_FAILURE_PREFIX);
+    if (marker === -1)
+        return null;
+    return stderr
+        .slice(marker + LANDLOCK_SETUP_FAILURE_PREFIX.length)
+        .trim()
+        .slice(0, 240);
 }
 /** Execute the compiled invocation with shell execution disabled and no fallback path. */
 export function runSandboxedCommand(request, command, options = {}) {
@@ -596,25 +801,55 @@ export function runSandboxedCommand(request, command, options = {}) {
         })));
     }
     const started = Date.now();
+    const profile = openSeccompProfile(invocation.value.seccomp_profile);
+    if (!profile.ok)
+        return Promise.resolve(profile);
+    let cgroupScope = null;
+    const cgroupConfig = request.cgroups;
+    if (cgroupConfig !== undefined && (cgroupConfig.required || cgroupConfig.limits !== undefined)) {
+        const scope = createCgroupScope({ session_id: request.session_id, execution_id: cgroupConfig.execution_id }, { root: cgroupConfig.root, limits: cgroupConfig.limits });
+        if (!scope.ok) {
+            profile.value.close();
+            return Promise.resolve(scope);
+        }
+        cgroupScope = scope.value;
+    }
     let child;
     try {
         child = spawn(invocation.value.executable, [...invocation.value.args], {
             cwd: invocation.value.cwd,
             env: { ...invocation.value.env },
             shell: false,
-            stdio: ["ignore", "pipe", "pipe"],
+            stdio: ["ignore", "pipe", "pipe", profile.value.fd],
         });
+        profile.value.close();
     }
     catch (error) {
+        profile.value.close();
+        if (cgroupScope !== null)
+            cleanupCgroupScope(cgroupScope);
         return Promise.resolve(failure(new DomainError("SANDBOX_EXECUTION_FAILED", "Bubblewrap could not be started.", {
             reason: error instanceof Error ? error.message.slice(0, 200) : "unknown",
         })));
     }
+    if (cgroupScope !== null) {
+        const childPid = child.pid;
+        if (typeof childPid !== "number" || !Number.isSafeInteger(childPid) || childPid < 1) {
+            child.kill("SIGKILL");
+            cleanupCgroupScope(cgroupScope);
+            return Promise.resolve(failure(new DomainError("SANDBOX_CGROUP_SETUP_FAILED", "The protected process did not expose a valid process id.", {})));
+        }
+        const attached = attachProcessToCgroup(cgroupScope, childPid);
+        if (!attached.ok) {
+            child.kill("SIGKILL");
+            cleanupCgroupScope(cgroupScope);
+            return Promise.resolve(attached);
+        }
+    }
     return new Promise((resolve) => {
         const stdout = [];
         const stderr = [];
-        let stdoutBytes = 0;
-        let stderrBytes = 0;
+        let outputBytes = 0;
         let timedOut = false;
         let outputExceeded = false;
         let spawnError = null;
@@ -628,21 +863,62 @@ export function runSandboxedCommand(request, command, options = {}) {
                 return;
             settled = true;
             clearTimeout(timer);
+            const accounting = cgroupScope === null ? null : readCgroupAccounting(cgroupScope);
+            if (cgroupScope !== null) {
+                const cleaned = cleanupCgroupScope(cgroupScope);
+                if (!cleaned.ok) {
+                    resolve(cleaned);
+                    return;
+                }
+            }
+            const resourceDetails = cgroupScope === null || accounting === null
+                ? {}
+                : {
+                    cgroup_scope: cgroupScope.name,
+                    cgroup_accounting: accounting,
+                    cgroup_limit_events: cgroupLimitEvents(accounting),
+                };
             if (spawnError !== null) {
                 resolve(failure(new DomainError("SANDBOX_EXECUTION_FAILED", "Bubblewrap failed before the command could run.", {
                     reason: spawnError.message.slice(0, 200),
+                    ...resourceDetails,
                 })));
                 return;
             }
             if (timedOut) {
                 resolve(failure(new DomainError("SANDBOX_EXECUTION_TIMEOUT", "The sandboxed command exceeded its execution timeout.", {
                     timeout_ms: timeoutMs,
+                    ...resourceDetails,
                 })));
                 return;
             }
             if (outputExceeded) {
                 resolve(failure(new DomainError("SANDBOX_OUTPUT_LIMIT", "The sandboxed command exceeded its output limit.", {
                     max_output_bytes: maxOutputBytes,
+                    ...resourceDetails,
+                })));
+                return;
+            }
+            const diagnostic = stderr.join("");
+            if (code !== 0 && /^bwrap:/mu.test(diagnostic)) {
+                const seccompFailure = /seccomp/u.test(diagnostic);
+                resolve(failure(new DomainError(seccompFailure ? "SANDBOX_CAPABILITY_UNAVAILABLE" : "SANDBOX_EXECUTION_FAILED", seccompFailure
+                    ? "The required seccomp baseline could not be applied by bubblewrap."
+                    : "Bubblewrap could not establish the protected execution boundary.", {
+                    profile_id: invocation.value.seccomp_profile_metadata.id,
+                    profile_version: invocation.value.seccomp_profile_metadata.version,
+                    stderr: diagnostic.slice(0, maxOutputBytes),
+                })));
+                return;
+            }
+            const landlockDiagnostic = invocation.value.landlock.state === "enforced" ? landlockSetupDiagnostic(diagnostic) : null;
+            if (landlockDiagnostic !== null) {
+                resolve(failure(new DomainError("SANDBOX_EXECUTION_FAILED", "Landlock setup failed; the protected command was not executed.", {
+                    session_id: request.session_id,
+                    abi: invocation.value.landlock.abi,
+                    effective_state: "error",
+                    retryable: false,
+                    diagnostic: landlockDiagnostic,
                 })));
                 return;
             }
@@ -652,19 +928,31 @@ export function runSandboxedCommand(request, command, options = {}) {
                 stdout: stdout.join(""),
                 stderr: stderr.join(""),
                 duration_ms: Date.now() - started,
+                seccomp_profile: invocation.value.seccomp_profile_metadata,
+                ...(cgroupScope === null || accounting === null
+                    ? {}
+                    : {
+                        resources: {
+                            cgroup_contract_id: cgroupScope.contract_id,
+                            scope: cgroupScope.name,
+                            accounting,
+                            limit_events: cgroupLimitEvents(accounting),
+                        },
+                    }),
+                landlock: invocation.value.landlock,
             }));
         };
         child.stdout?.on("data", (value) => {
-            const collected = boundedOutput(stdout, stdoutBytes, maxOutputBytes, value);
-            stdoutBytes = collected.bytes;
+            const collected = boundedOutput(stdout, outputBytes, maxOutputBytes, value);
+            outputBytes = collected.bytes;
             if (collected.exceeded) {
                 outputExceeded = true;
                 child.kill("SIGKILL");
             }
         });
         child.stderr?.on("data", (value) => {
-            const collected = boundedOutput(stderr, stderrBytes, maxOutputBytes, value);
-            stderrBytes = collected.bytes;
+            const collected = boundedOutput(stderr, outputBytes, maxOutputBytes, value);
+            outputBytes = collected.bytes;
             if (collected.exceeded) {
                 outputExceeded = true;
                 child.kill("SIGKILL");
@@ -676,4 +964,5 @@ export function runSandboxedCommand(request, command, options = {}) {
         child.on("close", (code, signal) => finish(code, signal));
     });
 }
+export { deriveLandlockRules } from "./landlock.js";
 //# sourceMappingURL=sandbox-launcher.js.map