codecalc 0.1.0__py3-none-win_amd64.whl

codecalc/guarded.py

@@ -0,0 +1,300 @@
+"""Run SymPy where it can be KILLED, rather than where it must be trusted.
+
+`safe_expr` screens what reaches SymPy and bounds the shapes known to explode.
+Both are denylists, and a denylist is a bet that the list is complete. SymPy's
+own maintainers made and lost that bet: PR sympy/sympy#12524 added a `safe=`
+flag built on an AST whitelist plus a name blacklist and was never merged,
+abandoned since 2020, with the author calling it "security theater that leads
+users into a false sense of security, because it can still be bypassed".
+
+So the screen buys time and this buys a bound. The distinction that matters is
+that a bound does not have to anticipate anything: whatever the expression
+does, it does it in a process the parent can kill.
+
+WHY FORK, AND NOT A FRESH INTERPRETER:
+A spawned child re-imports SymPy, which is 437ms measured on this project and
+the reason the import is already lazy — that would be paid on every symbolic
+call. A forked child inherits the parent's already-imported SymPy through
+copy-on-write and costs single-digit milliseconds. The work is CPU-bound and
+short-lived, so there is nothing a fresh interpreter buys here except latency.
+
+THE THREADING HAZARD, STATED PLAINLY:
+`fork()` in a process with threads copies only the calling thread, so a lock
+held by another thread at that instant is held forever in the child. Python
+3.12 warns about exactly this. Two things bound the risk rather than removing
+it: the fork is serialised under `_FORK_LOCK` so this module never races
+itself, and the child touches only SymPy and `os.write` before `os._exit`,
+taking no path through logging, subprocess or the import system. It is the same
+trade `executor.py` already makes for `preexec_fn`, which is likewise not
+thread-safe and likewise serialised. A child that does deadlock is killed by
+the parent's wall clock like any other overrun, which is the property this
+module exists to provide.
+
+WINDOWS HAS NO FORK.
+There is no equivalent that avoids the import cost, so the call runs in-process
+and the result says so in `unenforced`, in the same vocabulary the executor
+uses for a ceiling it could not apply. Reporting a bound that is not there
+would be the failure this repository keeps correcting.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import select
+import signal
+import threading
+from time import monotonic as _monotonic
+from time import sleep as _sleep
+
+from . import errors
+
+#: Serialises forks from this module. See the threading note above.
+_FORK_LOCK = threading.Lock()
+
+#: The child's own ceilings. CPU is the one that stops a runaway computation;
+#: RLIMIT_AS stops the other way an expression gets out of hand, which is by
+#: allocating rather than by spinning.
+DEFAULT_CPU_SECONDS = 10
+DEFAULT_MEMORY_MB = 2048
+
+#: Wall clock, enforced by the PARENT. RLIMIT_CPU alone is not enough: a child
+#: blocked rather than computing burns no CPU and would never hit it.
+DEFAULT_WALL_SECONDS = 15
+
+#: A result is a small dict of strings. The cap is here so a child that decides
+#: to emit something enormous cannot make the parent hold it.
+_MAX_PAYLOAD_BYTES = 4 * 1024 * 1024
+
+#: Reported when the platform cannot provide the bound, in the executor's own
+#: style: a caller reading this knows the guarantee was not applied.
+UNENFORCED_NO_FORK = "expression_bound_not_enforced_without_fork"
+
+CAN_FORK = hasattr(os, "fork") and hasattr(os, "waitpid")
+
+#: The only fields a failed guarded call passes on. Everything else the child
+#: or the parent put in the outcome — `value` above all — stops here.
+_CARRIED_ON_FAILURE = ("ok", "code", "error", "remedy", "code_inferred")
+
+#: The out-of-memory answer, serialised AT IMPORT TIME.
+#:
+#: The OOM branch in `_child` cannot afford to build anything: under MemoryError
+#: even formatting a message can raise again, which is why that branch answered
+#: with a bare literal. The literal carried no `code`, so the one failure in the
+#: taxonomy that is unambiguously `resource_exhausted` arrived at the server
+#: boundary codeless and had its code guessed back out of the words "memory
+#: ceiling" — the weak claim, for the case we are most certain about.
+#:
+#: Building the same JSON here costs nothing at failure time and keeps the
+#: property that made the literal correct: by the time a child hits MemoryError,
+#: this string has existed since import.
+_OOM_PAYLOAD = json.dumps(errors.error_result(
+    errors.RESOURCE_EXHAUSTED, "expression exhausted the memory ceiling"))
+
+
+def _child(write_fd: int, fn, args: tuple, kwargs: dict,
+           cpu_seconds: int, memory_mb: int) -> None:
+    """Run `fn` under rlimits and write its result back as JSON. Never returns.
+
+    Every exception is caught, including the ones nobody predicted. That is the
+    point of running here rather than in the parent: `nextprime(100)` raised
+    `AttributeError: 'int' object has no attribute 'is_number'` out of
+    evaluate_expression, because some SymPy functions return plain Python
+    objects rather than expressions. A guard that only caught the failures
+    already known would not have contained that one.
+    """
+    import resource
+
+    try:
+        resource.setrlimit(resource.RLIMIT_CPU, (cpu_seconds, cpu_seconds))
+        if memory_mb > 0:
+            as_bytes = memory_mb * 1024 * 1024
+            resource.setrlimit(resource.RLIMIT_AS, (as_bytes, as_bytes))
+    except (ValueError, OSError):
+        # A ceiling that could not be set is reported by the parent as
+        # unenforced rather than silently skipped — but only the wall clock is
+        # truly load-bearing, and that one is the parent's.
+        pass
+
+    try:
+        payload = json.dumps({"ok": True, "value": fn(*args, **kwargs)})
+    except MemoryError:
+        # Formatting the error can itself allocate, so this one is answered
+        # with a constant — see _OOM_PAYLOAD, which is built at import time
+        # precisely so that nothing is constructed here.
+        payload = _OOM_PAYLOAD
+    except BaseException as exc:  # containment is the job — every failure, known or not
+        try:
+            payload = json.dumps(errors.error_result(
+                errors.classify(exc), f"{type(exc).__name__}: {exc}"[:2000]))
+        except Exception:
+            payload = '{"ok": false, "error": "evaluation failed"}'
+
+    data = payload.encode("utf-8", "replace")[:_MAX_PAYLOAD_BYTES]
+    try:
+        os.write(write_fd, data)
+    except OSError:
+        pass
+    # _exit, not sys.exit: no atexit handlers, no buffered flushes, nothing
+    # inherited from the parent that could run twice.
+    os._exit(0)
+
+
+def run_guarded(fn, *args, cpu_seconds: int = DEFAULT_CPU_SECONDS,
+                memory_mb: int = DEFAULT_MEMORY_MB,
+                wall_seconds: int = DEFAULT_WALL_SECONDS,
+                **kwargs) -> dict:
+    """Run `fn(*args, **kwargs)` in a killable child; return a result dict.
+
+    Returns `{"ok": True, "value": ...}` or `{"ok": False, "error": ...}`, plus
+    `"unenforced"` when the platform could not apply the bound. `fn` must return
+    something JSON-serialisable, which every tool result in this project is.
+    """
+    if not CAN_FORK:
+        # In-process, and SAYING SO. The screen in safe_expr still applies; what
+        # is missing is the ability to stop something it did not anticipate.
+        try:
+            return {"ok": True, "value": fn(*args, **kwargs),
+                    "unenforced": [UNENFORCED_NO_FORK]}
+        except BaseException as exc:  # containment is the job
+            return errors.error_result(
+                errors.classify(exc), f"{type(exc).__name__}: {exc}"[:2000],
+                unenforced=[UNENFORCED_NO_FORK])
+
+    read_fd, write_fd = os.pipe()
+    with _FORK_LOCK:
+        pid = os.fork()
+        if pid == 0:
+            os.close(read_fd)
+            _child(write_fd, fn, args, kwargs, cpu_seconds, memory_mb)
+            # unreachable: _child always _exits
+
+    os.close(write_fd)
+    chunks: list[bytes] = []
+    total = 0
+    timed_out = False
+    deadline = _monotonic() + wall_seconds
+    try:
+        while True:
+            remaining = deadline - _monotonic()
+            if remaining <= 0:
+                timed_out = True
+                break
+            ready, _, _ = select.select([read_fd], [], [], remaining)
+            if not ready:
+                timed_out = True
+                break
+            chunk = os.read(read_fd, 65536)
+            if not chunk:
+                break  # child closed the pipe: it is done
+            total += len(chunk)
+            if total > _MAX_PAYLOAD_BYTES:
+                timed_out = False
+                chunks.append(chunk)
+                break
+            chunks.append(chunk)
+    finally:
+        os.close(read_fd)
+        if timed_out:
+            # SIGKILL, not SIGTERM. The child may be inside a C loop in SymPy
+            # with no opportunity to handle a catchable signal.
+            try:
+                os.kill(pid, signal.SIGKILL)
+            except OSError:
+                pass
+        _reap(pid)
+
+    # The three failures below are the PARENT's own diagnosis, not the child's.
+    # Each one knows exactly what happened, so each names its code here rather
+    # than leaving `ensure_code` to guess it back out of the sentence. A code
+    # chosen where the failure is detected is the strong claim; one recovered
+    # from prose is the weak one, and these are not cases where we have to
+    # settle for the weak one.
+    if timed_out:
+        return errors.error_result(
+            errors.TIMEOUT,
+            f"expression exceeded the {wall_seconds}s evaluation limit and was killed")
+    raw = b"".join(chunks)
+    if not raw:
+        # The child died without answering: RLIMIT_CPU (SIGXCPU) and the kernel
+        # OOM killer both land here. Distinguishable from a timeout, which is
+        # the parent's doing, and worth saying so rather than reporting a
+        # generic failure.
+        return errors.error_result(
+            errors.RESOURCE_EXHAUSTED,
+            "expression was terminated by a resource limit "
+            f"(CPU {cpu_seconds}s / memory {memory_mb}MB) before producing a result")
+    try:
+        return json.loads(raw.decode("utf-8", "replace"))
+    except ValueError:
+        return errors.error_result(
+            errors.INTERNAL, "the guarded evaluation returned no usable result")
+
+
+def _reap(pid: int) -> None:
+    """Wait for `pid`, without letting a stuck child block the caller forever."""
+    for _ in range(100):
+        try:
+            done, _ = os.waitpid(pid, os.WNOHANG)
+        except ChildProcessError:
+            return
+        if done:
+            return
+        _sleep(0.01)
+    # Still alive after a second: it ignored the kill or is unkillable. Reaping
+    # is abandoned rather than blocking the server; the process is already
+    # SIGKILLed and init will collect it.
+    try:
+        os.kill(pid, signal.SIGKILL)
+        os.waitpid(pid, os.WNOHANG)
+    except OSError:
+        pass
+
+
+def guarded_call(fn, *args, **kwargs) -> dict:
+    """Run a tool function under the bound and hand back its own result dict.
+
+    Every symbolic tool in this project returns `{"ok": ..., ...}`, so the
+    unwrapping is identical for all of them and lives here rather than being
+    written out at each call site — six copies of this would be six chances to
+    drop the `unenforced` passthrough, which is the part a caller cannot
+    reconstruct.
+    """
+    outcome = run_guarded(fn, *args, **kwargs)
+    if outcome.get("ok"):
+        result = outcome["value"]
+    else:
+        # Carry the failure through whole. This used to rebuild a bare
+        # `{"ok": False, "error": ...}`, which DISCARDED the `code` the child's
+        # `errors.classify()` had chosen at the raise site — and `ensure_code`
+        # at the server boundary then re-derived one from the message text and
+        # stamped it `code_inferred: True`. Two things were wrong with that.
+        #
+        # It downgraded every guarded failure's provenance from "chosen where it
+        # was raised" to "guessed from prose", which is the exact distinction
+        # errors.py exists to preserve and which check_claims counts.
+        #
+        # And for one code in six it did not round-trip at all. Measured across
+        # the taxonomy: FileNotFoundError classifies as `runtime_unavailable`
+        # (the language is not installed — remedy: install it), while its
+        # message "ghc" matches no hint and falls through to `internal` (remedy:
+        # report a bug). A caller was told to file an issue about a missing
+        # compiler. Wrong in the actionable direction, which is the failure mode
+        # errors.py's own comments call out.
+        # An explicit allowlist, not "everything except unenforced". The
+        # blocklist form was the first fix and a cross-vendor review flagged it:
+        # no current producer in run_guarded returns a `value` on the failure
+        # path, so nothing leaks today, but the shape of the code invited one.
+        # A future `{"ok": False, "value": ...}` — or a child payload shaped by
+        # something other than error_result — would have been forwarded whole
+        # into a tool result. Naming the four fields that belong to the error
+        # contract costs nothing and cannot acquire a fifth by accident.
+        result = {k: outcome[k] for k in _CARRIED_ON_FAILURE if k in outcome}
+        result["ok"] = False
+        result.setdefault("error", "evaluation failed")
+    if outcome.get("unenforced"):
+        # The platform could not apply the bound. Merged rather than replacing
+        # any `unenforced` the tool itself reported.
+        existing = list(result.get("unenforced") or [])
+        result = {**result, "unenforced": existing + list(outcome["unenforced"])}
+    return result

codecalc/landlock.py

@@ -0,0 +1,231 @@
+"""Confine a process to a set of paths, using the Landlock LSM.
+
+LAYER 2 of the #23 mitigation. Layer 1 stops the package managers from running
+third-party code at all (`--ignore-scripts` and friends in packages.py). This
+is for what still runs: the manager itself, and anything a future entry cannot
+disable.
+
+Landlock is an unprivileged, stackable Linux LSM. A process declares which
+paths it may touch, calls `landlock_restrict_self`, and the kernel enforces
+that on it and every process it goes on to create. No root, no daemon, no
+container runtime, and — the part that matters here — no delegated cgroup
+write access, which is what ruled out `cgroup v2 pids.max` for a stdio MCP
+server launched by an arbitrary client.
+
+WHY ctypes AND NOT A LIBRARY:
+`py-landlock` is at 0.1.1 with two releases, and `landlock` is at 1.0.0.dev5.
+Both may well be fine; neither is something to put a security boundary on in a
+project that gates this carefully, when the interface being wrapped is three
+syscalls. Nothing here is imported at module scope that a fork would inherit
+badly, and there is no new dependency to pin, audit or keep current.
+
+WHAT LANDLOCK DOES NOT DO, from the kernel documentation, because a boundary
+whose gaps are not written down gets mistaken for a complete one:
+
+  - It cannot restrict `chdir`, `stat`, `flock`, `chmod`, `chown`, `setxattr`,
+    `utime`, `fcntl` or `access`. Metadata is readable and changeable on paths
+    the process can reach.
+  - `chroot(2)` remains allowed.
+  - A file descriptor opened BEFORE the ruleset is applied stays usable. This
+    is why the ruleset is applied in `preexec_fn`, after fork and before exec,
+    with `close_fds=True` doing the rest.
+  - UDP needs ABI 10. On anything lower — including the ABI 7 this was
+    developed against — a confined process can still reach the network over
+    UDP, DNS included. TCP needs ABI 4.
+  - Multithreaded `restrict_self` needs ABI 8 (TSYNC). Irrelevant here and
+    deliberately so: this runs in a freshly forked child, which has exactly one
+    thread.
+
+Everything in that list is reported by `unenforced_reasons()` rather than
+being left for a reader to discover in a kernel manual.
+"""
+
+from __future__ import annotations
+
+import ctypes
+import os
+import pathlib
+
+#: Syscall numbers. Identical on x86_64 and aarch64 — Landlock arrived after
+#: both moved to the generic table — and verified on aarch64 before use.
+_NR_CREATE_RULESET = 444
+_NR_ADD_RULE = 445
+_NR_RESTRICT_SELF = 446
+
+_LANDLOCK_CREATE_RULESET_VERSION = 1 << 0
+_LANDLOCK_RULE_PATH_BENEATH = 1
+
+_PR_SET_NO_NEW_PRIVS = 38
+
+# Filesystem access rights, with the ABI that introduced each. The set is
+# masked against the running kernel's ABI: asking for a right it does not know
+# makes the whole ruleset fail, which would turn a partial boundary into none.
+_FS = {
+    "execute": (1 << 0, 1), "write_file": (1 << 1, 1), "read_file": (1 << 2, 1),
+    "read_dir": (1 << 3, 1), "remove_dir": (1 << 4, 1), "remove_file": (1 << 5, 1),
+    "make_char": (1 << 6, 1), "make_dir": (1 << 7, 1), "make_reg": (1 << 8, 1),
+    "make_sock": (1 << 9, 1), "make_fifo": (1 << 10, 1), "make_block": (1 << 11, 1),
+    "make_sym": (1 << 12, 1),
+    "refer": (1 << 13, 2), "truncate": (1 << 14, 3), "ioctl_dev": (1 << 15, 5),
+}
+
+_READ_RIGHTS = ("execute", "read_file", "read_dir")
+_WRITE_RIGHTS = ("write_file", "remove_dir", "remove_file", "make_char",
+                 "make_dir", "make_reg", "make_sock", "make_fifo",
+                 "make_block", "make_sym", "refer", "truncate", "ioctl_dev")
+
+#: Rights that mean anything for a NON-directory. The kernel rejects a rule
+#: carrying directory-only rights on a file with EINVAL, so a mask has to be
+#: narrowed by what the path actually is. Found by adding /dev/null to a
+#: ruleset and watching the whole confinement fail to apply — which is the
+#: right direction to fail, but only if the caller notices.
+_FILE_RIGHTS = ("execute", "read_file", "write_file", "truncate", "ioctl_dev")
+
+
+class _RulesetAttr(ctypes.Structure):
+    """struct landlock_ruleset_attr.
+
+    Only `handled_access_fs` is declared. The syscall takes an explicit size,
+    so passing the ABI-1 size asks the kernel for exactly the ABI-1 semantics —
+    which is what this module uses. Network handling would add
+    `handled_access_net` (ABI 4) and a larger size; it is deliberately absent,
+    because a TCP-only network boundary on a kernel where UDP cannot be
+    restricted is worth less than saying so plainly.
+    """
+
+    _fields_ = [("handled_access_fs", ctypes.c_uint64)]
+
+
+class _PathBeneathAttr(ctypes.Structure):
+    """struct landlock_path_beneath_attr — PACKED.
+
+    12 bytes, not 16. The kernel struct carries __attribute__((packed)), and a
+    default-aligned ctypes Structure would pad to 16 and be rejected with
+    EINVAL. This is the single easiest thing to get wrong here.
+    """
+
+    _pack_ = 1
+    _fields_ = [("allowed_access", ctypes.c_uint64),
+                ("parent_fd", ctypes.c_int32)]
+
+
+def _libc() -> ctypes.CDLL:
+    return ctypes.CDLL("libc.so.6", use_errno=True)
+
+
+def abi_version() -> int:
+    """The kernel's Landlock ABI, or 0 if Landlock is unavailable/disabled."""
+    if not hasattr(os, "uname") or os.uname().sysname != "Linux":
+        return 0
+    try:
+        version = _libc().syscall(_NR_CREATE_RULESET, None, 0,
+                                  _LANDLOCK_CREATE_RULESET_VERSION)
+    except OSError:
+        return 0
+    return version if version > 0 else 0
+
+
+def available() -> bool:
+    return abi_version() > 0
+
+
+def unenforced_reasons(abi: int | None = None, scope: str = "install") -> list[str]:
+    """What this confinement does NOT cover, in the executor's own vocabulary.
+
+    Returned whether or not Landlock applied, because "we could not confine
+    the installer" and "we confined it but UDP is still open" are different
+    facts and a caller acting on either needs to know which it has.
+
+    `scope` names what was being confined. It defaults to "install" so the
+    package-install strings (#23) are unchanged, and sessions pass "session"
+    (#104) — a session result reading `install_udp_egress_unrestricted` is
+    describing the wrong subject, and a caller who greps for the guarantee
+    they lost would not find it under a name about installing packages.
+    """
+    abi = abi_version() if abi is None else abi
+    if abi == 0:
+        return [f"{scope}_not_confined_no_landlock"] if scope != "install" else [
+            "package_install_not_confined_no_landlock"]
+    out = [
+        # True at every ABI: these are documented gaps, not version gaps.
+        f"{scope}_metadata_syscalls_unrestricted",  # chmod/chown/stat/utime/...
+    ]
+    if abi < 10:
+        out.append(f"{scope}_udp_egress_unrestricted")
+    if abi < 4:
+        out.append(f"{scope}_tcp_egress_unrestricted")
+    return out
+
+
+def _mask_for(abi: int, names: tuple[str, ...]) -> int:
+    mask = 0
+    for name in names:
+        bit, since = _FS[name]
+        if abi >= since:
+            mask |= bit
+    return mask
+
+
+def restrict_self(read_write: list[str], read_only: list[str]) -> None:
+    """Confine THIS process (and its children) to the given paths.
+
+    Irreversible, by design. Raises OSError if the kernel refuses, and the
+    caller must treat that as a failure to confine rather than proceeding —
+    silently continuing unconfined is the failure mode this whole module
+    exists to remove.
+
+    Intended for use in `preexec_fn`: after fork, before exec, in a child with
+    one thread and no inherited descriptors beyond the ones subprocess keeps.
+    """
+    abi = abi_version()
+    if abi == 0:
+        raise OSError("Landlock unavailable on this kernel")
+
+    libc = _libc()
+    handled = _mask_for(abi, tuple(_FS))
+    attr = _RulesetAttr(handled_access_fs=handled)
+    ruleset_fd = libc.syscall(_NR_CREATE_RULESET, ctypes.byref(attr),
+                              ctypes.sizeof(attr), 0)
+    if ruleset_fd < 0:
+        raise OSError(ctypes.get_errno(), "landlock_create_ruleset failed")
+
+    try:
+        rw_names = _READ_RIGHTS + _WRITE_RIGHTS
+        ro_names = _READ_RIGHTS
+        for paths, names in ((read_write, rw_names), (read_only, ro_names)):
+            for path in paths:
+                # A file gets the file-applicable subset; a directory gets the
+                # lot. Passing the lot for a file makes landlock_add_rule
+                # return EINVAL and takes the ENTIRE ruleset down with it.
+                is_dir = pathlib.Path(path).is_dir()
+                mask = _mask_for(abi, tuple(n for n in names
+                                            if is_dir or n in _FILE_RIGHTS))
+                if not mask:
+                    continue
+                try:
+                    path_fd = os.open(path, os.O_PATH | os.O_CLOEXEC)
+                except OSError:
+                    # A path that does not exist is skipped rather than fatal:
+                    # the allow-list is a superset covering several platforms
+                    # and toolchain layouts, and refusing to confine at all
+                    # because /opt is absent would be the worst outcome.
+                    continue
+                try:
+                    rule = _PathBeneathAttr(allowed_access=mask, parent_fd=path_fd)
+                    if libc.syscall(_NR_ADD_RULE, ruleset_fd,
+                                    _LANDLOCK_RULE_PATH_BENEATH,
+                                    ctypes.byref(rule), 0) < 0:
+                        raise OSError(ctypes.get_errno(),
+                                      f"landlock_add_rule failed for {path}")
+                finally:
+                    os.close(path_fd)
+
+        # REQUIRED before restrict_self, and it is its own hardening: without
+        # it a confined process could still gain privileges through a setuid
+        # binary it is allowed to execute.
+        if libc.prctl(_PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) != 0:
+            raise OSError(ctypes.get_errno(), "prctl(PR_SET_NO_NEW_PRIVS) failed")
+        if libc.syscall(_NR_RESTRICT_SELF, ruleset_fd, 0) < 0:
+            raise OSError(ctypes.get_errno(), "landlock_restrict_self failed")
+    finally:
+        os.close(ruleset_fd)