shadow-hdk-linux-sandbox 0.33.0__tar.gz

shadow_hdk_linux_sandbox-0.33.0/Cargo.lock

@@ -0,0 +1,284 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "bitflags"
+version = "2.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3ded4057c258ba199e2d26386d3af3780957ecaee6c4ef4041c6b4b8b97c0b06"
+
+[[package]]
+name = "cfg-if"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4e7648175b45a9a48536d676f68d918270699102aa8dab5496df06904c914600"
+
+[[package]]
+name = "enumflags2"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"
+dependencies = [
+ "enumflags2_derive",
+]
+
+[[package]]
+name = "enumflags2_derive"
+version = "0.7.12"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
+[[package]]
+name = "errno"
+version = "0.3.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
+dependencies = [
+ "libc",
+ "windows-sys",
+]
+
+[[package]]
+name = "fastrand"
+version = "2.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"
+
+[[package]]
+name = "getrandom"
+version = "0.4.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "300e883d756b2e4ec94e02791f39b04b522276138852cfc41d9fb7e904106099"
+dependencies = [
+ "cfg-if",
+ "libc",
+ "r-efi",
+]
+
+[[package]]
+name = "itoa"
+version = "1.0.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682"
+
+[[package]]
+name = "landlock"
+version = "0.4.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4cca98e95f35b29d469dade6724c6f96cec9236640f745a0e99b0334ec320ab1"
+dependencies = [
+ "enumflags2",
+ "libc",
+ "thiserror",
+]
+
+[[package]]
+name = "libc"
+version = "0.2.189"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+
+[[package]]
+name = "linux-raw-sys"
+version = "0.12.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32a66949e030da00e8c7d4434b251670a91556f4144941d37452769c25d58a53"
+
+[[package]]
+name = "memchr"
+version = "2.8.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cf8baf1c55e62ffcace7a9f06f4bd9cd3f0c4beb022d3b367256b91b87513d98"
+
+[[package]]
+name = "once_cell"
+version = "1.21.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50"
+
+[[package]]
+name = "proc-macro2"
+version = "1.0.107"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9"
+dependencies = [
+ "unicode-ident",
+]
+
+[[package]]
+name = "quote"
+version = "1.0.47"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001"
+dependencies = [
+ "proc-macro2",
+]
+
+[[package]]
+name = "r-efi"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f8dcc9c7d52a811697d2151c701e0d08956f92b0e24136cf4cf27b57a6a0d9bf"
+
+[[package]]
+name = "rustix"
+version = "1.1.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "891efababe418670775f199f0d233d84843c227a0949a883ce15b37c78d6629d"
+dependencies = [
+ "bitflags",
+ "errno",
+ "libc",
+ "linux-raw-sys",
+ "windows-sys",
+]
+
+[[package]]
+name = "seccompiler"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a4ae55de56877481d112a559bbc12667635fdaf5e005712fd4e2b2fa50ffc884"
+dependencies = [
+ "libc",
+]
+
+[[package]]
+name = "serde"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4148590afebada386688f18773da617792bf2ef03ffc1e4cbd2b1d45b023e0ba"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67dca2c9c51e58a4791a4b1ed58308b39c64224d349a935ab5039aa360942a48"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.229"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "serde_json"
+version = "1.0.151"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+dependencies = [
+ "itoa",
+ "memchr",
+ "serde",
+ "serde_core",
+ "zmij",
+]
+
+[[package]]
+name = "shadow-hdk-sandbox"
+version = "0.33.0"
+dependencies = [
+ "landlock",
+ "libc",
+ "seccompiler",
+ "serde_json",
+ "tempfile",
+]
+
+[[package]]
+name = "syn"
+version = "2.0.119"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "syn"
+version = "3.0.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "unicode-ident",
+]
+
+[[package]]
+name = "tempfile"
+version = "3.27.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
+dependencies = [
+ "fastrand",
+ "getrandom",
+ "once_cell",
+ "rustix",
+ "windows-sys",
+]
+
+[[package]]
+name = "thiserror"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ec86235f5fcc2a73650310756d2ac5b138a5780bbbdfae3eeccec992c435ba4f"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "2.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 3.0.6",
+]
+
+[[package]]
+name = "unicode-ident"
+version = "1.0.26"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d245f478577f809a851594d02313b640fb437e0bb33866753cff937863096954"
+
+[[package]]
+name = "windows-link"
+version = "0.2.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
+
+[[package]]
+name = "windows-sys"
+version = "0.61.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ae137229bcbd6cdf0f7b80a31df61766145077ddf49416a728b02cb3921ff3fc"
+dependencies = [
+ "windows-link",
+]
+
+[[package]]
+name = "zmij"
+version = "1.0.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "29666d0abbfad1e3dc4dcf6144730dd3a3ab225bbbdac83319345b1b44ccfc1b"

shadow_hdk_linux_sandbox-0.33.0/Cargo.toml

@@ -0,0 +1,33 @@
+# The OS layer's native parts (Epic 0010, D123): one crate, one small static helper per operating
+# system that needs one, invoked by the Python leash exactly as `sandbox-exec` is on macOS. The
+# policy — which mode allows what — the detection and the D36 proof stay in Python; this crate is
+# the syscalls a child has to make on itself before `exec`.
+[package]
+name = "shadow-hdk-sandbox"
+version = "0.33.0"
+edition = "2024"
+rust-version = "1.85"
+license = "MIT"
+description = "Shadow HDK's OS-layer helpers: the Linux sandbox (Landlock + seccomp, applied before exec)"
+repository = "https://github.com/avinash-singh-io/shadow-hdk"
+publish = false
+readme = "README.md"
+
+[[bin]]
+name = "shadow-hdk-linux-sandbox"
+path = "src/main.rs"
+
+[target.'cfg(target_os = "linux")'.dependencies]
+landlock = "0.4"
+seccompiler = "0.5"
+libc = "0.2"
+
+[dev-dependencies]
+serde_json = "1"
+tempfile = "3"
+
+[profile.release]
+strip = true
+lto = true
+codegen-units = 1
+panic = "abort"

shadow_hdk_linux_sandbox-0.33.0/PKG-INFO

@@ -0,0 +1,75 @@
+Metadata-Version: 2.4
+Name: shadow-hdk-linux-sandbox
+Version: 0.33.0
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Rust
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries
+Summary: Shadow HDK's Linux confinement helper: Landlock and seccomp applied before exec, invoked by the kit's local environment.
+License-Expression: MIT
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Homepage, https://github.com/avinash-singh-io/shadow-hdk
+Project-URL: Repository, https://github.com/avinash-singh-io/shadow-hdk
+
+# shadow-hdk-linux-sandbox
+
+Shadow HDK's Linux confinement helper — the first executable of the kit's OS layer (Epic 0010,
+D123). `LocalEnvironment` invokes it exactly as it invokes `sandbox-exec` on macOS: the helper
+confines *itself* and `exec`s the command, so there is one process, in the leash's process group,
+exiting with the command's own code.
+
+```
+shadow-hdk-linux-sandbox --mode read-only|workspace-write [--root <dir>]... -- <argv>...
+shadow-hdk-linux-sandbox --probe
+```
+
+## What it applies
+
+- **Landlock** (a kernel LSM any unprivileged process may apply to itself; Linux 5.13+, ABI 4 on
+  Ubuntu 24.04's 6.8): reads everywhere — the interpreter has to read its own installation;
+  writes beneath each `--root` for `workspace-write` and nowhere for `read-only`; the null, zero,
+  full, random, urandom, tty, ptmx and pts devices writable in both modes, because devices are not
+  files (`git` opens `/dev/null` read-write at startup); TCP `bind` and `connect` handled and
+  denied where the kernel has it (ABI 4+).
+- **seccomp**: `socket()` with any domain but `AF_UNIX` fails with `EPERM`, and so does
+  `io_uring_setup` — io_uring can open and connect sockets without a `socket` syscall, so a filter
+  that stopped at `socket` would stop nothing. Every other syscall is allowed; the filesystem is
+  Landlock's.
+
+No namespaces, no root, no daemon — which is what survives Ubuntu 24.04's default AppArmor policy,
+where bubblewrap's unprivileged user namespace does not. Bubblewrap stays behind it as the
+fallback on a kernel without Landlock; the kit's D36 proof decides which is in force by watching
+a write outside denied, a socket refused and a write inside land, before any confined mode opens.
+Nothing here is trusted for having run.
+
+## Exit codes
+
+| code | meaning |
+|---|---|
+| the command's | after `exec`, the helper *is* the command |
+| **120** | cannot confine — no Landlock (absent or `lsm=` without it), a ruleset the kernel did not enforce, seccomp refused; stderr says why |
+| **121** | usage — the arguments above are the contract; `full` never reaches the helper |
+| **126** / **127** | the command could not be executed / was not found |
+
+`--probe` prints one JSON line — `{"version": "…", "landlock_abi": N, "supported": true|false}` —
+and exits 0 or 120.
+
+## Building
+
+```
+cargo build --release
+cargo test            # the argument tests everywhere; the confinement tests on a Linux kernel
+```
+
+Packaged for PyPI by maturin (`bindings = "bin"`): one `py3-none-<platform>` wheel per OS × arch,
+no Python-version coupling. `shadow-hdk` depends on it where `sys_platform == 'linux'`. Off Linux
+the binary builds and refuses with 120 — so the crate lints, unit-tests and packages on any
+developer machine.
+
+Environment variables the *kit* reads (not the helper): `SHADOW_HDK_LINUX_SANDBOX` names the
+helper's path when it is not beside the interpreter or on `PATH`; `SHADOW_HDK_SANDBOX` narrows the
+kit's candidates to one mechanism (`landlock`, `bubblewrap`, `seatbelt`).
+

shadow_hdk_linux_sandbox-0.33.0/README.md

@@ -0,0 +1,58 @@
+# shadow-hdk-linux-sandbox
+
+Shadow HDK's Linux confinement helper — the first executable of the kit's OS layer (Epic 0010,
+D123). `LocalEnvironment` invokes it exactly as it invokes `sandbox-exec` on macOS: the helper
+confines *itself* and `exec`s the command, so there is one process, in the leash's process group,
+exiting with the command's own code.
+
+```
+shadow-hdk-linux-sandbox --mode read-only|workspace-write [--root <dir>]... -- <argv>...
+shadow-hdk-linux-sandbox --probe
+```
+
+## What it applies
+
+- **Landlock** (a kernel LSM any unprivileged process may apply to itself; Linux 5.13+, ABI 4 on
+  Ubuntu 24.04's 6.8): reads everywhere — the interpreter has to read its own installation;
+  writes beneath each `--root` for `workspace-write` and nowhere for `read-only`; the null, zero,
+  full, random, urandom, tty, ptmx and pts devices writable in both modes, because devices are not
+  files (`git` opens `/dev/null` read-write at startup); TCP `bind` and `connect` handled and
+  denied where the kernel has it (ABI 4+).
+- **seccomp**: `socket()` with any domain but `AF_UNIX` fails with `EPERM`, and so does
+  `io_uring_setup` — io_uring can open and connect sockets without a `socket` syscall, so a filter
+  that stopped at `socket` would stop nothing. Every other syscall is allowed; the filesystem is
+  Landlock's.
+
+No namespaces, no root, no daemon — which is what survives Ubuntu 24.04's default AppArmor policy,
+where bubblewrap's unprivileged user namespace does not. Bubblewrap stays behind it as the
+fallback on a kernel without Landlock; the kit's D36 proof decides which is in force by watching
+a write outside denied, a socket refused and a write inside land, before any confined mode opens.
+Nothing here is trusted for having run.
+
+## Exit codes
+
+| code | meaning |
+|---|---|
+| the command's | after `exec`, the helper *is* the command |
+| **120** | cannot confine — no Landlock (absent or `lsm=` without it), a ruleset the kernel did not enforce, seccomp refused; stderr says why |
+| **121** | usage — the arguments above are the contract; `full` never reaches the helper |
+| **126** / **127** | the command could not be executed / was not found |
+
+`--probe` prints one JSON line — `{"version": "…", "landlock_abi": N, "supported": true|false}` —
+and exits 0 or 120.
+
+## Building
+
+```
+cargo build --release
+cargo test            # the argument tests everywhere; the confinement tests on a Linux kernel
+```
+
+Packaged for PyPI by maturin (`bindings = "bin"`): one `py3-none-<platform>` wheel per OS × arch,
+no Python-version coupling. `shadow-hdk` depends on it where `sys_platform == 'linux'`. Off Linux
+the binary builds and refuses with 120 — so the crate lints, unit-tests and packages on any
+developer machine.
+
+Environment variables the *kit* reads (not the helper): `SHADOW_HDK_LINUX_SANDBOX` names the
+helper's path when it is not beside the interpreter or on `PATH`; `SHADOW_HDK_SANDBOX` narrows the
+kit's candidates to one mechanism (`landlock`, `bubblewrap`, `seatbelt`).

shadow_hdk_linux_sandbox-0.33.0/pyproject.toml

@@ -0,0 +1,32 @@
+# The Linux helper as a distribution (Epic 0010, D123 as amended 2026-09-19): maturin packages the
+# `shadow-hdk-linux-sandbox` binary alone — `bindings = "bin"`, no Python module, no Python ABI —
+# so there is one `py3-none-<platform>` wheel per OS × arch and never one per Python version.
+# `shadow-hdk` depends on it under a Linux marker; the version moves with the kit's
+# (`tests/test_versions.py`).
+[build-system]
+requires = ["maturin>=1.7,<2"]
+build-backend = "maturin"
+
+[project]
+name = "shadow-hdk-linux-sandbox"
+version = "0.33.0"
+description = "Shadow HDK's Linux confinement helper: Landlock and seccomp applied before exec, invoked by the kit's local environment."
+readme = "README.md"
+requires-python = ">=3.12"
+license = "MIT"
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Rust",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries",
+]
+
+[project.urls]
+Homepage = "https://github.com/avinash-singh-io/shadow-hdk"
+Repository = "https://github.com/avinash-singh-io/shadow-hdk"
+
+[tool.maturin]
+bindings = "bin"
+strip = true