xephyr-run 0.1.0__tar.gz

xephyr_run-0.1.0/PKG-INFO

@@ -0,0 +1,154 @@
+Metadata-Version: 2.4
+Name: xephyr-run
+Version: 0.1.0
+Summary: Run one X client in its own named Xephyr window at a chosen position
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: ziglang
+
+# xephyr-run
+Run X11 programs in xephyr jails so that they cannot talk to other X11 and perform actions or spy on your keypresses.
+
+Thin wrapper around Xephyr which deals with some defaults and tracks xephyr X11 sessions.
+Has some seccomp syscall filtering magic to prevent the jailed process from talking to other X sessions.
+
+AI-generated and unreviewed. Mostly tested by the AI itself.
+
+Run one X client in its own named [Xephyr](https://www.freedesktop.org/wiki/Software/Xephyr/)
+window. The client talks to the nested X server, not your session, so it cannot
+snoop your keystrokes, screenshot other windows or read your clipboard, as long as it is also
+stopped from connecting to your main X server (see [Confinement](#confinement-the-default); this
+is on by default). Your window manager places the Xephyr window like any other, and the client is
+stretched to fill it, following resizes. Xephyr exits when the client does.
+
+## Installation
+`pipx install xephyr-run`
+
+Requires `Xephyr` and `xdotool`. The package also installs `ziglang`, which compiles the connect
+filter described below on first use.
+
+## Usage
+
+```bash
+xephyr-run run -- xeyes
+xephyr-run run -n term -- xterm -fa 'DejaVu Sans Mono' -fs 10
+xephyr-run run --no-confine -- some-trusted-x-program   # switch the connect filter off
+xephyr-run list                    # name, display, Xephyr pid, command
+xephyr-run attach term -- xwininfo -root -tree
+xephyr-run kill term
+```
+
+The name defaults to the command's name, and two instances cannot share one. The
+Xephyr window is titled `xephyr-run-NAME`, which a window manager rule can match (for i3,
+`for_window [title="^xephyr-run-"] floating enable`).
+`-s WIDTHxHEIGHT` sets the initial size (default 640x400).
+
+Instances are recorded in `$XDG_STATE_HOME/xephyr-run/NAME.json` (default
+`~/.local/state/xephyr-run`) and cleaned up when they exit.
+
+
+## Caveats
+This tool only jails X11 access. You might like to combine it with some other sort of jail (which I
+may do persently). However, I felt this feature on its own was a useful demonstraction.
+
+
+## Alternatives and prior work 
+ed:  used Xerphyr direction with a jail
+
+ed: there was some socker of docker thing that did this
+
+## Why a plain Xephyr is not enough
+By itself, Xephyr does not prevent arbitrary code from connecting to your main X11 server. With a
+normal configuration, a program running as you can find the main server and connect to it: by its
+file socket `/tmp/.X11-unix/X0` or by the abstract socket `@/tmp/.X11-unix/X0`. Desktop sessions
+usually let any local process of your user in without a cookie (`xhost` lists `SI:localuser:you`),
+so hiding `~/.Xauthority` does not help. A client that connects there can log your keystrokes,
+take screenshots, and type into other windows.
+
+There are approaches for securing X11 servers (a separate Unix user, restricted X access control,
+untrusted cookies, a container or VM), but on Ubuntu everything is user based, and this tool is
+meant to work without changing your X11 configuration. So instead of changing what the X server
+allows, `xephyr-run` limits what the client can connect to.
+
+The host can see into the Xephyr window (pixels and input), but as a single opaque window: it
+cannot see the client's own windows, and `xwininfo -root -tree` on the host does not list them.
+
+## Confinement (the default)
+Unless you pass `--no-confine`, the client runs under a **connect filter** that stops it connecting
+to any X server other than its own nested one:
+
+* every abstract Unix socket is refused (`ECONNREFUSED`, so X libraries fall back to the file socket);
+* every Unix socket under `/tmp/.X11-unix` is refused (`EACCES`) except the instance's own display;
+* everything else, including all network connections, is allowed.
+
+Things the client may legitimately use over abstract sockets, such as a D-Bus session bus
+configured with `unix:abstract=`, stop working. Try the program you intend to run, and use
+`--no-confine` for programs you trust and which need them.
+
+It does not need root, a container, or a network namespace.
+
+### How the connect filter works
+
+`xephyr_run/connect_filter.c` is a small supervisor. It runs your command with a
+[seccomp](https://man7.org/linux/man-pages/man2/seccomp.2.html) filter that pauses each `connect()`
+and hands it to the supervisor (seccomp user notification). The supervisor:
+
+1. copies the socket address out of the program's memory **once**;
+2. judges that copy against the ordered rules (first match wins; no match means allow);
+3. if allowed, performs the `connect()` itself on the program's own socket (through `pidfd_getfd`),
+   using the same copy.
+
+Because the connect is made from the copy, the program cannot change the address between the
+check and the use, which is the flaw in letting the kernel carry on with the original call.
+A Unix path is canonicalised first (relative paths use the program's working directory, symlinks
+are resolved) and the connect goes to that canonical path.
+
+The filter also refuses `io_uring_setup` (io_uring can connect without a `connect` syscall) and
+kills a process that switches to a different syscall ABI.
+
+The first time a confined client is started, the supervisor is compiled with the `ziglang` package
+(a self-contained C compiler, no system toolchain needed) into a static binary cached in
+`$XDG_CACHE_HOME/xephyr-run` (default `~/.cache/xephyr-run`); the first build takes roughly
+20 seconds. Delete that directory to force a rebuild. If it cannot be compiled, a slower Python
+implementation of the same logic (`xephyr_run/connect_filter.py`) is used, with a warning.
+
+The seccomp code is independent of the rest of the tool. `connect_filter.py` and
+`connect_filter.c` know nothing about X11 and can be reused with other rules:
+
+```python
+from xephyr_run import connect_filter
+process = connect_filter.popen_confined_rules(['some-command'], [('deny', '^@')])
+# or with an arbitrary Python decision function: connect_filter.popen_confined(argv, lambda address: ...)
+```
+
+### Limits
+
+* Only `connect()` is checked. A Unix **datagram** socket can be addressed with
+  `sendto`/`sendmsg` without connecting, and those are not covered. X11 uses stream sockets.
+* A descriptor the client inherits, or is passed over another socket, is not covered.
+* The supervisor's work is done per `connect()`, so a program that connects very often pays for
+  it; X clients connect rarely. The overhead has not been measured.
+* Path rules judge the canonical path in the supervisor's filesystem view. A directory the client can
+  write to could be swapped for a symlink after the check; `/tmp/.X11-unix` is sticky and root-owned.
+* Linux on x86_64 or aarch64 only, kernel 5.7 or newer (seccomp listeners and `pidfd_getfd`).
+* The supervisor exits when the client does; other processes the client left running keep the filter
+  but their connects then fail.
+* Landlock could do part of this without a supervisor (it can scope abstract Unix sockets since ABI 6),
+  but as far as I know it cannot yet restrict connecting to a pathname socket on kernel ABI 8.
+* I am lazy and do not build versions of this for differnt hardware - but I wanted something 
+  performant which others can use. I therefore outsource the building of filtering code to run time 
+  using `ziglang`
+ 
+
+## Development
+
+```bash
+pipx install --editable .
+python3 -m unittest discover -s tests
+```
+
+Run the tests with the pipx environment's Python so `ziglang` is available; otherwise the compiled
+supervisor's tests are skipped if no system C compiler exists. The tests check both supervisors
+against real sockets, including a test where a thread rewrites the address while `connect()` is
+pending (and a control test showing that the same program does reach the forbidden socket
+when unfiltered).

xephyr_run-0.1.0/README.md

@@ -0,0 +1,146 @@
+# xephyr-run
+Run X11 programs in xephyr jails so that they cannot talk to other X11 and perform actions or spy on your keypresses.
+
+Thin wrapper around Xephyr which deals with some defaults and tracks xephyr X11 sessions.
+Has some seccomp syscall filtering magic to prevent the jailed process from talking to other X sessions.
+
+AI-generated and unreviewed. Mostly tested by the AI itself.
+
+Run one X client in its own named [Xephyr](https://www.freedesktop.org/wiki/Software/Xephyr/)
+window. The client talks to the nested X server, not your session, so it cannot
+snoop your keystrokes, screenshot other windows or read your clipboard, as long as it is also
+stopped from connecting to your main X server (see [Confinement](#confinement-the-default); this
+is on by default). Your window manager places the Xephyr window like any other, and the client is
+stretched to fill it, following resizes. Xephyr exits when the client does.
+
+## Installation
+`pipx install xephyr-run`
+
+Requires `Xephyr` and `xdotool`. The package also installs `ziglang`, which compiles the connect
+filter described below on first use.
+
+## Usage
+
+```bash
+xephyr-run run -- xeyes
+xephyr-run run -n term -- xterm -fa 'DejaVu Sans Mono' -fs 10
+xephyr-run run --no-confine -- some-trusted-x-program   # switch the connect filter off
+xephyr-run list                    # name, display, Xephyr pid, command
+xephyr-run attach term -- xwininfo -root -tree
+xephyr-run kill term
+```
+
+The name defaults to the command's name, and two instances cannot share one. The
+Xephyr window is titled `xephyr-run-NAME`, which a window manager rule can match (for i3,
+`for_window [title="^xephyr-run-"] floating enable`).
+`-s WIDTHxHEIGHT` sets the initial size (default 640x400).
+
+Instances are recorded in `$XDG_STATE_HOME/xephyr-run/NAME.json` (default
+`~/.local/state/xephyr-run`) and cleaned up when they exit.
+
+
+## Caveats
+This tool only jails X11 access. You might like to combine it with some other sort of jail (which I
+may do persently). However, I felt this feature on its own was a useful demonstraction.
+
+
+## Alternatives and prior work 
+ed:  used Xerphyr direction with a jail
+
+ed: there was some socker of docker thing that did this
+
+## Why a plain Xephyr is not enough
+By itself, Xephyr does not prevent arbitrary code from connecting to your main X11 server. With a
+normal configuration, a program running as you can find the main server and connect to it: by its
+file socket `/tmp/.X11-unix/X0` or by the abstract socket `@/tmp/.X11-unix/X0`. Desktop sessions
+usually let any local process of your user in without a cookie (`xhost` lists `SI:localuser:you`),
+so hiding `~/.Xauthority` does not help. A client that connects there can log your keystrokes,
+take screenshots, and type into other windows.
+
+There are approaches for securing X11 servers (a separate Unix user, restricted X access control,
+untrusted cookies, a container or VM), but on Ubuntu everything is user based, and this tool is
+meant to work without changing your X11 configuration. So instead of changing what the X server
+allows, `xephyr-run` limits what the client can connect to.
+
+The host can see into the Xephyr window (pixels and input), but as a single opaque window: it
+cannot see the client's own windows, and `xwininfo -root -tree` on the host does not list them.
+
+## Confinement (the default)
+Unless you pass `--no-confine`, the client runs under a **connect filter** that stops it connecting
+to any X server other than its own nested one:
+
+* every abstract Unix socket is refused (`ECONNREFUSED`, so X libraries fall back to the file socket);
+* every Unix socket under `/tmp/.X11-unix` is refused (`EACCES`) except the instance's own display;
+* everything else, including all network connections, is allowed.
+
+Things the client may legitimately use over abstract sockets, such as a D-Bus session bus
+configured with `unix:abstract=`, stop working. Try the program you intend to run, and use
+`--no-confine` for programs you trust and which need them.
+
+It does not need root, a container, or a network namespace.
+
+### How the connect filter works
+
+`xephyr_run/connect_filter.c` is a small supervisor. It runs your command with a
+[seccomp](https://man7.org/linux/man-pages/man2/seccomp.2.html) filter that pauses each `connect()`
+and hands it to the supervisor (seccomp user notification). The supervisor:
+
+1. copies the socket address out of the program's memory **once**;
+2. judges that copy against the ordered rules (first match wins; no match means allow);
+3. if allowed, performs the `connect()` itself on the program's own socket (through `pidfd_getfd`),
+   using the same copy.
+
+Because the connect is made from the copy, the program cannot change the address between the
+check and the use, which is the flaw in letting the kernel carry on with the original call.
+A Unix path is canonicalised first (relative paths use the program's working directory, symlinks
+are resolved) and the connect goes to that canonical path.
+
+The filter also refuses `io_uring_setup` (io_uring can connect without a `connect` syscall) and
+kills a process that switches to a different syscall ABI.
+
+The first time a confined client is started, the supervisor is compiled with the `ziglang` package
+(a self-contained C compiler, no system toolchain needed) into a static binary cached in
+`$XDG_CACHE_HOME/xephyr-run` (default `~/.cache/xephyr-run`); the first build takes roughly
+20 seconds. Delete that directory to force a rebuild. If it cannot be compiled, a slower Python
+implementation of the same logic (`xephyr_run/connect_filter.py`) is used, with a warning.
+
+The seccomp code is independent of the rest of the tool. `connect_filter.py` and
+`connect_filter.c` know nothing about X11 and can be reused with other rules:
+
+```python
+from xephyr_run import connect_filter
+process = connect_filter.popen_confined_rules(['some-command'], [('deny', '^@')])
+# or with an arbitrary Python decision function: connect_filter.popen_confined(argv, lambda address: ...)
+```
+
+### Limits
+
+* Only `connect()` is checked. A Unix **datagram** socket can be addressed with
+  `sendto`/`sendmsg` without connecting, and those are not covered. X11 uses stream sockets.
+* A descriptor the client inherits, or is passed over another socket, is not covered.
+* The supervisor's work is done per `connect()`, so a program that connects very often pays for
+  it; X clients connect rarely. The overhead has not been measured.
+* Path rules judge the canonical path in the supervisor's filesystem view. A directory the client can
+  write to could be swapped for a symlink after the check; `/tmp/.X11-unix` is sticky and root-owned.
+* Linux on x86_64 or aarch64 only, kernel 5.7 or newer (seccomp listeners and `pidfd_getfd`).
+* The supervisor exits when the client does; other processes the client left running keep the filter
+  but their connects then fail.
+* Landlock could do part of this without a supervisor (it can scope abstract Unix sockets since ABI 6),
+  but as far as I know it cannot yet restrict connecting to a pathname socket on kernel ABI 8.
+* I am lazy and do not build versions of this for differnt hardware - but I wanted something 
+  performant which others can use. I therefore outsource the building of filtering code to run time 
+  using `ziglang`
+ 
+
+## Development
+
+```bash
+pipx install --editable .
+python3 -m unittest discover -s tests
+```
+
+Run the tests with the pipx environment's Python so `ziglang` is available; otherwise the compiled
+supervisor's tests are skipped if no system C compiler exists. The tests check both supervisors
+against real sockets, including a test where a thread rewrites the address while `connect()` is
+pending (and a control test showing that the same program does reach the forbidden socket
+when unfiltered).

xephyr_run-0.1.0/pyproject.toml

@@ -0,0 +1,20 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "xephyr-run"
+version = "0.1.0"
+description = "Run one X client in its own named Xephyr window at a chosen position"
+readme = "README.md"
+requires-python = ">=3.9"
+dependencies = ["ziglang"]
+
+[project.scripts]
+xephyr-run = "xephyr_run.cli:main"
+
+[tool.setuptools.packages.find]
+include = ["xephyr_run*"]
+
+[tool.setuptools.package-data]
+xephyr_run = ["*.c"]

xephyr_run-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

xephyr_run-0.1.0/tests/test_cli.py

@@ -0,0 +1,76 @@
+import os
+import re
+import tempfile
+import unittest
+from pathlib import Path
+
+from xephyr_run import cli, connect_filter, registry
+
+
+class Size(unittest.TestCase):
+    def test_parse(self):
+        self.assertEqual(cli.parse_size('640x400'), '640x400')
+        for bad in ('', '640', 'axb', '640x400+1+1'):
+            with self.assertRaises(ValueError):
+                cli.parse_size(bad)
+
+
+class Display(unittest.TestCase):
+    def test_skips_taken_numbers(self):
+        with tempfile.TemporaryDirectory() as directory:
+            sockets = Path(directory)
+            self.assertEqual(cli.free_display(sockets, first=5), 5)
+            (sockets/'X5').touch()
+            (sockets/'X6').touch()
+            self.assertEqual(cli.free_display(sockets, first=5), 7)
+
+
+class Confinement(unittest.TestCase):
+    def policy_for(self, number):
+        with tempfile.TemporaryDirectory() as directory:
+            sockets = Path(directory)/'.X11-unix'
+            sockets.mkdir()
+            return connect_filter.rules_policy(cli.confine_rules(number, sockets)), os.path.realpath(sockets)
+
+    def test_only_the_own_display_and_non_x_sockets_are_allowed(self):
+        policy, base = self.policy_for(90)
+        unix = lambda name: connect_filter.Address(1, name, b'')
+        self.assertTrue(policy(unix(f'{base}/X90')))
+        self.assertFalse(policy(unix(f'{base}/X0')))
+        self.assertFalse(policy(unix(f'{base}/X900')))
+        self.assertFalse(policy(unix('@/tmp/.X11-unix/X0')))
+        self.assertFalse(policy(unix('@anything')))
+        self.assertTrue(policy(unix('/run/user/1000/bus')))
+
+
+class Registry(unittest.TestCase):
+    def record(self, name, server_pid=None):
+        return {'name': name, 'display': ':90', 'server_pid': server_pid or os.getpid(),
+                'pid': os.getpid(), 'command': ['xclock'], 'started': 0}
+
+    def test_round_trip_and_listing(self):
+        with tempfile.TemporaryDirectory() as directory:
+            where = Path(directory)/'state'
+            self.assertEqual(registry.records(where), [])
+            registry.save(self.record('b'), where)
+            registry.save(self.record('a'), where)
+            self.assertEqual([r['name'] for r in registry.records(where)], ['a', 'b'])
+            registry.remove('a', where)
+            self.assertIsNone(registry.load('a', where))
+            self.assertEqual(registry.load('b', where)['display'], ':90')
+
+    def test_stale_record_is_pruned(self):
+        with tempfile.TemporaryDirectory() as directory:
+            where = Path(directory)
+            registry.save(self.record('gone', server_pid=2**22 + 12345), where)
+            self.assertIsNone(registry.load('gone', where))
+            self.assertFalse((where/'gone.json').exists())
+
+    def test_rejects_unsafe_names(self):
+        for bad in ('', '../x', 'a b', 'a/b'):
+            with self.assertRaises(ValueError):
+                registry.validate_name(bad)
+
+
+if __name__ == '__main__':
+    unittest.main()

xephyr_run-0.1.0/tests/test_connect_filter.py

@@ -0,0 +1,231 @@
+import errno
+import json
+import os
+import re
+import shutil
+import socket
+import struct
+import subprocess
+import sys
+import tempfile
+import threading
+import unittest
+
+from xephyr_run import connect_filter as cf
+from xephyr_run import native
+
+
+def sockaddr_un(path):
+    return struct.pack('=H', socket.AF_UNIX) + path.encode() + b'\0'
+
+
+class Policy(unittest.TestCase):
+    def test_first_matching_rule_wins_and_default_allows(self):
+        policy = cf.rules_policy([('allow', r'^/run/x/X90$'), ('deny', r'^@'), ('deny', r'^/run/x/')])
+        unix = lambda name: cf.Address(socket.AF_UNIX, name, b'')
+        self.assertTrue(policy(unix('/run/x/X90')))
+        self.assertFalse(policy(unix('/run/x/X0')))
+        self.assertFalse(policy(unix('@/tmp/.X11-unix/X0')))
+        self.assertTrue(policy(unix('/elsewhere/sock')))
+        self.assertTrue(policy(cf.Address(socket.AF_INET, None, b'')))
+
+    def test_rejects_unknown_verdict(self):
+        with self.assertRaises(ValueError):
+            cf.rules_policy([('permit', '.*')])
+
+
+class ParseAddress(unittest.TestCase):
+    def test_abstract_path_and_unnamed(self):
+        pid = os.getpid()
+        self.assertEqual(cf.parse_address(struct.pack('=H', 1) + b'\0hello', pid).name, '@hello')
+        self.assertEqual(cf.parse_address(struct.pack('=H', 1), pid).name, '')
+        address = cf.parse_address(sockaddr_un('/tmp/../tmp/./some.sock'), pid)
+        self.assertEqual(address.name, os.path.realpath('/tmp/some.sock'))
+        self.assertEqual(address.raw, sockaddr_un(os.path.realpath('/tmp/some.sock')))
+
+    def test_relative_path_uses_the_programs_working_directory(self):
+        address = cf.parse_address(sockaddr_un('rel.sock'), os.getpid())
+        self.assertEqual(address.name, os.path.join(os.path.realpath(os.getcwd()), 'rel.sock'))
+
+    def test_other_families_are_untouched(self):
+        raw = struct.pack('=H', socket.AF_INET) + b'\x00' * 14
+        address = cf.parse_address(raw, os.getpid())
+        self.assertIsNone(address.name)
+        self.assertEqual(address.raw, raw)
+
+    def test_rejects_short_addresses(self):
+        with self.assertRaises(OSError):
+            cf.parse_address(b'\x01', os.getpid())
+
+
+def supported():
+    try:
+        process = cf.popen_confined(['true'], lambda address: True)
+    except (RuntimeError, OSError):
+        return False
+    process.wait()
+    return True
+
+
+class Server(threading.Thread):
+    """Accepts connections on a listening socket and counts them."""
+    def __init__(self, listener):
+        super().__init__(daemon=True)
+        self.listener = listener
+        self.listener.settimeout(0.1)
+        self.accepted = 0
+        self.stopped = False
+        self.start()
+
+    def run(self):
+        while not self.stopped:
+            try:
+                self.listener.accept()[0].close()
+                self.accepted += 1
+            except socket.timeout:
+                pass
+            except OSError:
+                return
+
+    def stop(self):
+        self.stopped = True
+        self.join()
+        self.listener.close()
+
+
+def unix_server(address):
+    listener = socket.socket(socket.AF_UNIX)
+    listener.bind(address)
+    listener.listen(64)
+    return Server(listener)
+
+
+CONNECTS = r'''
+import ctypes, errno, json, socket, sys
+libc = ctypes.CDLL(None, use_errno=True)
+def attempt(family, address):
+    s = socket.socket(family)
+    try:
+        s.connect(address)
+        return 'ok'
+    except OSError as error:
+        return errno.errorcode.get(error.errno, str(error.errno))
+    finally:
+        s.close()
+targets = json.loads(sys.argv[1])
+results = {
+    'allowed': attempt(socket.AF_UNIX, targets['allowed']),
+    'denied': attempt(socket.AF_UNIX, targets['denied']),
+    'abstract': attempt(socket.AF_UNIX, ('\0' + targets['abstract']).encode()),
+    'tcp': attempt(socket.AF_INET, ('127.0.0.1', targets['port'])),
+}
+ctypes.set_errno(0)
+results['io_uring'] = 'ok' if libc.syscall(425, 1, None) >= 0 else errno.errorcode[ctypes.get_errno()]
+print(json.dumps(results))
+'''
+
+RACE = r'''
+import ctypes, socket, struct, sys, threading
+good, bad, count = sys.argv[1], sys.argv[2], int(sys.argv[3])
+libc = ctypes.CDLL(None, use_errno=True)
+pack = lambda path: struct.pack('=H', 1) + path.encode() + b'\0'
+a, b = pack(good), pack(bad)
+buffer = ctypes.create_string_buffer(a, len(a))
+stop = False
+def flip():
+    while not stop:
+        ctypes.memmove(buffer, b, len(b))
+        ctypes.memmove(buffer, a, len(a))
+threading.Thread(target=flip, daemon=True).start()
+for _ in range(count):
+    s = socket.socket(socket.AF_UNIX)
+    libc.connect(s.fileno(), buffer, len(a))
+    s.close()
+stop = True
+'''
+
+
+class RaceHarness(unittest.TestCase):
+    def test_the_flipping_program_does_reach_the_denied_socket_when_unconfined(self):
+        directory = os.path.realpath(tempfile.mkdtemp())
+        self.addCleanup(shutil.rmtree, directory, True)
+        servers = {name: unix_server(os.path.join(directory, name + '.sock')) for name in ('good', 'evil')}
+        for server in servers.values():
+            self.addCleanup(server.stop)
+        subprocess.run([sys.executable, '-c', RACE, os.path.join(directory, 'good.sock'),
+                        os.path.join(directory, 'evil.sock'), '150'], check=True, timeout=60)
+        self.assertGreater(servers['evil'].accepted, 0)
+        self.assertGreater(servers['good'].accepted, 0)
+
+
+def native_available():
+    try:
+        native.binary()
+    except RuntimeError:
+        return False
+    return True
+
+
+class ConfinedTests:
+    """The same behaviour, whichever supervisor enforces it."""
+    def setUp(self):
+        self.directory = os.path.realpath(tempfile.mkdtemp())
+        self.addCleanup(shutil.rmtree, self.directory, True)
+        self.allowed = os.path.join(self.directory, 'good.sock')
+        self.denied = os.path.join(self.directory, 'evil.sock')
+        self.rules = [('allow', '^' + cf.ere_escape(self.allowed) + '$'), ('deny', '.*')]
+        self.servers = {}
+        for name, path in (('allowed', self.allowed), ('denied', self.denied)):
+            self.servers[name] = unix_server(path)
+            self.addCleanup(self.servers[name].stop)
+
+    def run_confined(self, *script, expect=0):
+        process = self.launch([sys.executable, '-c', *script], stdout=subprocess.PIPE, text=True)
+        output = process.communicate(timeout=60)[0]
+        self.assertEqual(process.returncode, expect)
+        return output
+
+    def test_exit_status_is_passed_through(self):
+        self.run_confined('import sys; sys.exit(7)', expect=7)
+
+    def test_limits(self):
+        abstract = socket.socket(socket.AF_UNIX)
+        abstract.bind(b'\0confined-test-%d' % os.getpid())
+        abstract.listen(4)
+        self.addCleanup(abstract.close)
+        tcp = socket.socket()
+        tcp.bind(('127.0.0.1', 0))
+        tcp.listen(4)
+        self.addCleanup(tcp.close)
+        targets = {'allowed': self.allowed, 'denied': self.denied, 'port': tcp.getsockname()[1],
+                   'abstract': 'confined-test-%d' % os.getpid()}
+        results = json.loads(self.run_confined(CONNECTS, json.dumps(targets)))
+        self.assertEqual(results, {'allowed': 'ok', 'denied': 'EACCES', 'abstract': 'ECONNREFUSED',
+                                   'tcp': 'ok', 'io_uring': 'EPERM'})
+        self.assertEqual(self.servers['denied'].accepted, 0)
+
+    def test_changing_the_address_during_the_check_cannot_reach_a_denied_socket(self):
+        self.run_confined(RACE, self.allowed, self.denied, '150')
+        self.assertEqual(self.servers['denied'].accepted, 0)
+        self.assertGreater(self.servers['allowed'].accepted, 0)
+
+
+@unittest.skipUnless(supported(), 'seccomp user notification is not available here')
+class PythonConfined(ConfinedTests, unittest.TestCase):
+    def launch(self, argv, **kwargs):
+        return cf.popen_confined(argv, cf.rules_policy(self.rules), **kwargs)
+
+
+@unittest.skipUnless(native_available(), 'the compiled supervisor cannot be built here')
+class NativeConfined(ConfinedTests, unittest.TestCase):
+    def launch(self, argv, **kwargs):
+        return native.popen(argv, self.rules, **kwargs)
+
+    def test_bad_regular_expression_is_refused(self):
+        process = native.popen([sys.executable, '-c', 'pass'], [('deny', '(')], stderr=subprocess.PIPE, text=True)
+        self.assertIn('bad regular expression', process.communicate(timeout=60)[1])
+        self.assertEqual(process.returncode, 2)
+
+
+if __name__ == '__main__':
+    unittest.main()

xephyr_run-0.1.0/xephyr_run/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())