Cameron Mcloughlin
fcde9d2384
The type of this value varies across glibc and musl, this works on both --- Release Notes: - N/A or Added/Fixed/Improved ...
1979 lines
77 KiB
Rust
1979 lines
77 KiB
Rust
//! Linux sandbox integration built on Bubblewrap (`bwrap`) for filesystem and
|
|
//! network confinement.
|
|
//!
|
|
//! We can use `--bind` and `--ro-bind` (read-only) to bind host filesystem
|
|
//! paths to paths in the sandbox. If networking is restricted, we also set
|
|
//! `--unshare-net` to disable *all* network access.
|
|
//!
|
|
//! When restricting network access, we:
|
|
//! - set `--unshare-net` - any requests to `example.com` will fail
|
|
//! - requests to `localhost` will succeed, but it will be an isolated localhost
|
|
//! from the host system.
|
|
//! - create a unix socket, and mount it in the sandbox with `--bind`
|
|
//! - run a bridge process inside the sandbox that:
|
|
//! - listens on `localhost:<port>` and forwards reads/writes to the socket
|
|
//! - then, runs the untrusted command
|
|
//! - on the zed side, we listen to the socket and forward reads/writes to the
|
|
//! internal HTTP proxy
|
|
//!
|
|
//! If networking is fully blocked or fully allowed, we don't bother with the
|
|
//! proxy/socket at all (and simply set/unset `--unshare-net`).
|
|
//!
|
|
//! This design for networking avoids needing seccomp, a fork/exec dance, and
|
|
//! eliminates a race condition involving BPF user notifications.
|
|
|
|
use anyhow::{Context as _, Result, anyhow, bail};
|
|
use std::ffi::{OsStr, OsString};
|
|
use std::io::{Read, Write};
|
|
use std::net::{Ipv4Addr, Shutdown, TcpListener, TcpStream};
|
|
use std::os::fd::{AsRawFd as _, FromRawFd as _, OwnedFd, RawFd};
|
|
use std::os::unix::fs::MetadataExt as _;
|
|
use std::os::unix::net::{UnixListener, UnixStream};
|
|
use std::os::unix::process::{CommandExt as _, ExitStatusExt as _};
|
|
use std::path::{Path, PathBuf};
|
|
use std::process::{Command, Stdio};
|
|
use std::sync::Arc;
|
|
use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};
|
|
use std::thread;
|
|
|
|
/// Re-exec marker for the in-sandbox launcher: it runs inside the sandbox before
|
|
/// the real command to (a) validate that bwrap bound the writable grants to the
|
|
/// inodes we captured (the bind-source TOCTOU backstop) and (b) run the
|
|
/// restricted-network HTTP bridge. See `README.md` for the design.
|
|
const LAUNCHER_FLAG: &str = "--zed-linux-sandbox-launcher";
|
|
/// Re-exec marker for the WSL-side helper. This runs *inside WSL* (a Linux
|
|
/// process) and does what `Sandbox::wrap` + the validation-fd sender do
|
|
/// in-process on native Linux: capture the writable binds' `O_PATH` fds, stand
|
|
/// up the validation socket, assemble the bwrap invocation, and spawn it. The
|
|
/// capture must happen WSL-side because a Windows process holds no Linux fds.
|
|
/// See `README.md`. Shared with the Windows side via `crate::WSL_SANDBOX_HELPER_FLAG`.
|
|
const WSL_HELPER_FLAG: &str = crate::WSL_SANDBOX_HELPER_FLAG;
|
|
const WSL_RESOLVE_FLAG: &str = crate::WSL_SANDBOX_RESOLVE_FLAG;
|
|
/// Sentinel argv token meaning "this optional field is absent".
|
|
const LAUNCHER_NONE: &str = "-";
|
|
const PROXY_SOCKET_SANDBOX_PATH_PREFIX: &str = "/tmp/zed-sandbox";
|
|
const VALIDATION_SOCKET_SANDBOX_PATH_PREFIX: &str = "/tmp/zed-sandbox-validate";
|
|
const SANDBOX_SETUP_FAILED_EXIT_CODE: i32 = 126;
|
|
const PUMP_BUFFER_SIZE: usize = 64 * 1024;
|
|
/// Upper bound on writable binds validated in a single `SCM_RIGHTS` message,
|
|
/// kept comfortably below the kernel's per-message fd limit (`SCM_MAX_FD`, 253).
|
|
/// Exceeding it fails closed rather than silently validating a subset.
|
|
const MAX_VALIDATED_BINDS: usize = 200;
|
|
|
|
/// Network-access setting for a sandboxed command.
|
|
///
|
|
/// Mirrors [`crate::macos_seatbelt::NetworkAccess`] so Linux and macOS expose
|
|
/// the same public shape.
|
|
#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
|
|
pub enum NetworkAccess {
|
|
/// All outbound network blocked (own network namespace).
|
|
#[default]
|
|
None,
|
|
/// Outbound HTTP(S) is available through a loopback proxy port inside the
|
|
/// sandbox. The port is bridged to a host-side Unix socket proxy that
|
|
/// enforces the hostname allowlist.
|
|
LocalhostPort(u16),
|
|
/// All outbound network allowed.
|
|
All,
|
|
}
|
|
|
|
/// Per-command relaxations of the default Bubblewrap (Linux) sandbox.
|
|
///
|
|
/// Mirrors [`crate::macos_seatbelt::SandboxPermissions`].
|
|
#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
|
|
pub struct SandboxPermissions {
|
|
/// Network access policy for the command.
|
|
pub network: NetworkAccess,
|
|
/// Allow unrestricted filesystem writes.
|
|
pub allow_fs_write: bool,
|
|
}
|
|
|
|
/// The outcome of preparing a Linux sandbox.
|
|
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
|
|
pub enum LauncherStatus {
|
|
/// No usable `bwrap` binary was found on `PATH` (or bundled).
|
|
BwrapNotFound,
|
|
/// The only `bwrap` found is setuid-root, which we refuse to execute.
|
|
SetuidRejected,
|
|
/// `bwrap` is present but failed to set up the sandbox with our arguments.
|
|
SandboxProbeFailed,
|
|
}
|
|
|
|
impl LauncherStatus {
|
|
/// A human-readable explanation suitable for diagnostics.
|
|
pub fn describe(self) -> &'static str {
|
|
match self {
|
|
LauncherStatus::BwrapNotFound => "no usable `bwrap` binary was found on PATH",
|
|
LauncherStatus::SetuidRejected => {
|
|
"the only available `bwrap` is setuid-root, which Zed refuses to run"
|
|
}
|
|
LauncherStatus::SandboxProbeFailed => {
|
|
"`bwrap` is present but failed to create a sandbox (unprivileged user \
|
|
namespaces may be disabled)"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Where a `bwrap` lookup ended up.
|
|
enum BwrapLocation {
|
|
/// A usable, non-setuid `bwrap` binary.
|
|
Found(PathBuf),
|
|
/// `bwrap` exists but every candidate is setuid-root (which we won't run).
|
|
OnlySetuid,
|
|
/// No `bwrap` binary was found at all.
|
|
NotFound,
|
|
}
|
|
|
|
fn locate_bwrap() -> BwrapLocation {
|
|
let mut saw_setuid = false;
|
|
for candidate in candidate_bwrap_paths() {
|
|
if !candidate.is_file() {
|
|
continue;
|
|
}
|
|
if is_setuid_root(&candidate) {
|
|
saw_setuid = true;
|
|
continue;
|
|
}
|
|
return BwrapLocation::Found(candidate);
|
|
}
|
|
if saw_setuid {
|
|
BwrapLocation::OnlySetuid
|
|
} else {
|
|
BwrapLocation::NotFound
|
|
}
|
|
}
|
|
|
|
fn candidate_bwrap_paths() -> Vec<PathBuf> {
|
|
let mut candidates = Vec::new();
|
|
if let Some(system) = system_bwrap_path() {
|
|
candidates.push(system);
|
|
}
|
|
if let Some(bundled) = bundled_bwrap_path() {
|
|
candidates.push(bundled);
|
|
}
|
|
candidates
|
|
}
|
|
|
|
fn system_bwrap_path() -> Option<PathBuf> {
|
|
let path = std::env::var_os("PATH")?;
|
|
std::env::split_paths(&path)
|
|
.map(|directory| directory.join("bwrap"))
|
|
.find(|candidate| candidate.is_file())
|
|
}
|
|
|
|
fn bundled_bwrap_path() -> Option<PathBuf> {
|
|
None
|
|
}
|
|
|
|
fn is_setuid_root(path: &Path) -> bool {
|
|
match std::fs::metadata(path) {
|
|
Ok(metadata) => (metadata.mode() & libc::S_ISUID != 0) && metadata.uid() == 0,
|
|
Err(_) => false,
|
|
}
|
|
}
|
|
|
|
#[allow(
|
|
clippy::disallowed_methods,
|
|
reason = "the probe is a short-lived background operation that must block on bwrap"
|
|
)]
|
|
fn probe_bwrap(bwrap: &Path, bwrap_args: &[String]) -> bool {
|
|
// Capture stderr (rather than discarding it) so a failed probe can report
|
|
// *why* bwrap refused — the difference between "user namespaces disabled",
|
|
// "chdir target missing", "no permission", etc. — instead of a bare
|
|
// `SandboxProbeFailed`.
|
|
let output = Command::new(bwrap)
|
|
.args(bwrap_args)
|
|
.arg("--")
|
|
.arg("true")
|
|
.stdin(Stdio::null())
|
|
.stdout(Stdio::null())
|
|
.stderr(Stdio::piped())
|
|
.output();
|
|
|
|
match output {
|
|
Ok(output) if output.status.success() => true,
|
|
Ok(output) => {
|
|
log::warn!(
|
|
"[sandbox] bwrap probe failed ({}). command: {} {}\nbwrap stderr: {}",
|
|
output.status,
|
|
bwrap.display(),
|
|
bwrap_args.join(" "),
|
|
String::from_utf8_lossy(&output.stderr).trim()
|
|
);
|
|
false
|
|
}
|
|
Err(error) => {
|
|
log::warn!(
|
|
"[sandbox] bwrap probe could not be spawned: {error}. command: {} {}",
|
|
bwrap.display(),
|
|
bwrap_args.join(" ")
|
|
);
|
|
false
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Build the `bwrap` argument list (everything after the `bwrap` program and
|
|
/// before the trailing `-- <command>`) for the given policy.
|
|
///
|
|
/// `proxy_socket_path` is the host pathname Unix socket used for
|
|
/// [`NetworkAccess::LocalhostPort`]. It is bind-mounted to a unique path inside
|
|
/// the sandbox where the bridge connects to it.
|
|
pub fn build_bwrap_args(
|
|
writable_directories: &[&Path],
|
|
protected_paths: &[&Path],
|
|
permissions: SandboxPermissions,
|
|
cwd: Option<&Path>,
|
|
proxy_socket_path: Option<&Path>,
|
|
) -> Vec<String> {
|
|
let proxy_socket_sandbox_path = proxy_socket_path
|
|
.filter(|_| matches!(permissions.network, NetworkAccess::LocalhostPort(_)))
|
|
.map(|_| unique_proxy_socket_sandbox_path());
|
|
build_bwrap_args_with_sandbox_paths(
|
|
writable_directories,
|
|
protected_paths,
|
|
permissions,
|
|
cwd,
|
|
proxy_socket_path,
|
|
proxy_socket_sandbox_path.as_deref(),
|
|
None,
|
|
None,
|
|
)
|
|
}
|
|
|
|
#[allow(
|
|
clippy::too_many_arguments,
|
|
reason = "a flat arg list mirrors the bwrap flags this assembles"
|
|
)]
|
|
fn build_bwrap_args_with_sandbox_paths(
|
|
writable_directories: &[&Path],
|
|
protected_paths: &[&Path],
|
|
permissions: SandboxPermissions,
|
|
cwd: Option<&Path>,
|
|
proxy_socket_path: Option<&Path>,
|
|
proxy_socket_sandbox_path: Option<&Path>,
|
|
validation_socket_path: Option<&Path>,
|
|
validation_socket_sandbox_path: Option<&Path>,
|
|
) -> Vec<String> {
|
|
let mut args = Vec::new();
|
|
|
|
let root_bind = if permissions.allow_fs_write {
|
|
"--bind"
|
|
} else {
|
|
"--ro-bind"
|
|
};
|
|
push_bind(&mut args, root_bind, "/", "/");
|
|
|
|
args.push("--dev".to_string());
|
|
args.push("/dev".to_string());
|
|
args.push("--proc".to_string());
|
|
args.push("/proc".to_string());
|
|
|
|
if !permissions.allow_fs_write {
|
|
args.push("--tmpfs".to_string());
|
|
args.push("/tmp".to_string());
|
|
|
|
for directory in writable_directories {
|
|
// Bind each writable directory at its *exact* path, **verbatim** —
|
|
// never re-`canonicalize`d here. The path was already resolved once,
|
|
// at capture time, to the pinned inode's current path (`readlink` of
|
|
// the `O_PATH` fd); re-resolving it now would reopen the
|
|
// time-of-check-to-time-of-use gap a malicious swap exploits. We must
|
|
// also never widen to an existing ancestor, so a path that doesn't
|
|
// exist is skipped rather than falling back to a parent. Whatever
|
|
// inode bwrap actually binds is verified after the mounts by the
|
|
// in-sandbox launcher (see `validate_binds`), which fails closed on a
|
|
// mismatch.
|
|
if !directory.exists() {
|
|
continue;
|
|
}
|
|
let path = directory.to_string_lossy().into_owned();
|
|
push_bind(&mut args, "--bind", &path, &path);
|
|
}
|
|
}
|
|
|
|
// Protect requested paths by re-binding them read-only *over* any broader rw
|
|
// bind (order matters: later binds win). Unlike Seatbelt, bwrap can't deny
|
|
// writes while allowing content reads with a policy rule, so a protected path
|
|
// is read-only — its contents stay readable but can't be written. A
|
|
// not-yet-existing path can't be bound, so it's skipped.
|
|
for protected_path in protected_paths {
|
|
if !protected_path.exists() {
|
|
continue;
|
|
}
|
|
let path = protected_path.to_string_lossy().into_owned();
|
|
push_bind(&mut args, "--ro-bind", &path, &path);
|
|
}
|
|
|
|
for flag in [
|
|
"--unshare-user",
|
|
"--unshare-ipc",
|
|
"--unshare-uts",
|
|
"--unshare-pid",
|
|
"--unshare-cgroup-try",
|
|
"--die-with-parent",
|
|
] {
|
|
args.push(flag.to_string());
|
|
}
|
|
|
|
match permissions.network {
|
|
NetworkAccess::None => args.push("--unshare-net".to_string()),
|
|
NetworkAccess::LocalhostPort(_) => {
|
|
args.push("--unshare-net".to_string());
|
|
if let Some((proxy_socket_path, proxy_socket_sandbox_path)) =
|
|
proxy_socket_path.zip(proxy_socket_sandbox_path)
|
|
{
|
|
let source = proxy_socket_path.to_string_lossy().into_owned();
|
|
let destination = proxy_socket_sandbox_path.to_string_lossy().into_owned();
|
|
push_bind(&mut args, "--bind", &source, &destination);
|
|
}
|
|
}
|
|
NetworkAccess::All => {}
|
|
}
|
|
|
|
// The validation socket is filesystem-based, so it works regardless of the
|
|
// network policy (an `--unshare-net`'d sandbox can't reach an abstract
|
|
// socket, but a bind-mounted one is fine). Bind it after the `/tmp` tmpfs so
|
|
// it isn't shadowed by the overlay.
|
|
if let Some((source, destination)) = validation_socket_path.zip(validation_socket_sandbox_path)
|
|
{
|
|
let source = source.to_string_lossy().into_owned();
|
|
let destination = destination.to_string_lossy().into_owned();
|
|
push_bind(&mut args, "--bind", &source, &destination);
|
|
}
|
|
|
|
if let Some(cwd) = cwd {
|
|
args.push("--chdir".to_string());
|
|
args.push(cwd.to_string_lossy().into_owned());
|
|
}
|
|
|
|
args
|
|
}
|
|
|
|
/// A unique destination path for the proxy socket bind mount *inside* the
|
|
/// sandbox. Each sandboxed command runs in its own mount namespace, so the path
|
|
/// only needs to be unique enough to avoid colliding with anything a previous
|
|
/// command in the same namespace lineage may have created; combining the pid
|
|
/// with a monotonic counter is sufficient and keeps the path predictable for
|
|
/// diagnostics.
|
|
fn unique_proxy_socket_sandbox_path() -> PathBuf {
|
|
static COUNTER: AtomicU64 = AtomicU64::new(0);
|
|
let counter = COUNTER.fetch_add(1, Ordering::Relaxed);
|
|
PathBuf::from(format!(
|
|
"{PROXY_SOCKET_SANDBOX_PATH_PREFIX}-{}-{counter}.sock",
|
|
std::process::id()
|
|
))
|
|
}
|
|
|
|
/// In-sandbox bind destination for the validation socket. Each sandboxed command
|
|
/// runs in its own mount namespace, so this only needs to avoid colliding with
|
|
/// other binds in the same namespace.
|
|
fn unique_validation_socket_sandbox_path() -> PathBuf {
|
|
static COUNTER: AtomicU64 = AtomicU64::new(0);
|
|
let counter = COUNTER.fetch_add(1, Ordering::Relaxed);
|
|
PathBuf::from(format!(
|
|
"{VALIDATION_SOCKET_SANDBOX_PATH_PREFIX}-{}-{counter}.sock",
|
|
std::process::id()
|
|
))
|
|
}
|
|
|
|
/// Create a private, owner-only directory for the validation listener socket and
|
|
/// return `(directory, socket path)`. The socket is a host path (it lives
|
|
/// outside the sandbox's `/tmp` tmpfs) and is bind-mounted in at
|
|
/// [`unique_validation_socket_sandbox_path`].
|
|
///
|
|
/// The socket carries the captured `O_PATH` descriptors over `SCM_RIGHTS`, so
|
|
/// connect access must be confined to us. Rather than bind in shared `/tmp` and
|
|
/// `chmod` after (which leaves a window where another user could connect before
|
|
/// the `chmod` lands), we create a `0700` directory up front: `create` is atomic
|
|
/// and fails if the path already exists, and `mode(0o700)` makes it
|
|
/// owner-only from creation, so no other user can even traverse to the socket.
|
|
fn unique_validation_socket_host_path() -> std::io::Result<(PathBuf, PathBuf)> {
|
|
use std::os::unix::fs::DirBuilderExt as _;
|
|
static COUNTER: AtomicU64 = AtomicU64::new(0);
|
|
let counter = COUNTER.fetch_add(1, Ordering::Relaxed);
|
|
let dir = std::env::temp_dir().join(format!(
|
|
"zed-sandbox-validate-{}-{counter}",
|
|
std::process::id()
|
|
));
|
|
// Clear a stale directory left by a previous run that reused this pid; this
|
|
// only succeeds for a directory we own, so it can't be used to displace
|
|
// another user's squatted path (in which case `create` below fails closed).
|
|
let _ = std::fs::remove_dir_all(&dir);
|
|
std::fs::DirBuilder::new().mode(0o700).create(&dir)?;
|
|
let socket_path = dir.join("validate.sock");
|
|
Ok((dir, socket_path))
|
|
}
|
|
|
|
/// Host endpoint that hands the in-sandbox validator the captured `O_PATH`
|
|
/// descriptors for the writable binds.
|
|
///
|
|
/// Runs in-process: `spawn` starts a short-lived background **thread** (never a
|
|
/// separate process) that listens on an owner-only `AF_UNIX` socket and serves
|
|
/// the descriptors to **exactly one** client (the in-sandbox validator) via
|
|
/// `SCM_RIGHTS`, then closes and removes the socket. The validator connects
|
|
/// once, after bwrap has mounted the binds; `SCM_RIGHTS` keeps the descriptors
|
|
/// alive in flight, so once the single send completes there is nothing left to
|
|
/// serve. Holding the descriptors until that send keeps the captured inodes
|
|
/// pinned (so they can't be recycled) up to the moment they're handed off.
|
|
///
|
|
/// It is owned by the per-command [`Sandbox`](crate::Sandbox); `Drop` wakes a
|
|
/// still-blocked accept and removes the socket and its private directory (a
|
|
/// no-op if the thread already tore them down). The socket is bind-mounted into
|
|
/// the sandbox at [`Self::sandbox_socket_path`].
|
|
pub(crate) struct ValidationFdSender {
|
|
host_socket_dir: PathBuf,
|
|
host_socket_path: PathBuf,
|
|
sandbox_socket_path: PathBuf,
|
|
shutdown: Arc<AtomicBool>,
|
|
}
|
|
|
|
impl ValidationFdSender {
|
|
/// Start serving `fds` (one per writable bind, in bind order). The caller
|
|
/// must pass the same order to the launcher so each fd lines up with its
|
|
/// bind-destination path.
|
|
pub(crate) fn spawn(fds: Vec<OwnedFd>) -> std::io::Result<Self> {
|
|
use std::os::unix::fs::PermissionsExt as _;
|
|
|
|
if fds.len() > MAX_VALIDATED_BINDS {
|
|
return Err(std::io::Error::other(format!(
|
|
"too many writable binds to validate ({} > {MAX_VALIDATED_BINDS})",
|
|
fds.len()
|
|
)));
|
|
}
|
|
let (host_socket_dir, host_socket_path) = unique_validation_socket_host_path()?;
|
|
let listener = UnixListener::bind(&host_socket_path)?;
|
|
// The enclosing directory is already `0700`, so this is defense in depth:
|
|
// connect permission on an `AF_UNIX` socket is governed by write
|
|
// permission on the socket file, so keep it owner-only too.
|
|
std::fs::set_permissions(&host_socket_path, std::fs::Permissions::from_mode(0o600))?;
|
|
let sandbox_socket_path = unique_validation_socket_sandbox_path();
|
|
let shutdown = Arc::new(AtomicBool::new(false));
|
|
|
|
// We use std threading APIs here because this code is run from both the
|
|
// Linux zed binary and also the WSL helper, which does not have a GPUI
|
|
// runtime.
|
|
thread::Builder::new()
|
|
.name("zed-sandbox-validation".to_string())
|
|
.spawn({
|
|
let shutdown = shutdown.clone();
|
|
let host_socket_path = host_socket_path.clone();
|
|
move || {
|
|
// `fds` is held until the single send below, keeping the
|
|
// pinned inodes alive until they're handed to the validator.
|
|
let raw_fds: Vec<RawFd> = fds.iter().map(|fd| fd.as_raw_fd()).collect();
|
|
// Serve exactly one client: the in-sandbox validator connects
|
|
// once. A second connection (e.g. the wake from `Drop`) is
|
|
// distinguished by the `shutdown` flag and never served.
|
|
match listener.accept() {
|
|
Ok((stream, _)) => {
|
|
if !shutdown.load(Ordering::SeqCst) {
|
|
if let Err(error) = send_fds(&stream, &raw_fds) {
|
|
log::warn!("[sandbox] failed to send validation fds: {error}");
|
|
}
|
|
}
|
|
}
|
|
Err(error) => {
|
|
if !shutdown.load(Ordering::SeqCst) {
|
|
log::warn!("[sandbox] sandbox validation accept failed: {error}");
|
|
}
|
|
}
|
|
}
|
|
drop(fds);
|
|
// Close the listener and remove the socket so it can't be
|
|
// connected to again. The directory is removed by `Drop`.
|
|
drop(listener);
|
|
let _ = std::fs::remove_file(&host_socket_path);
|
|
}
|
|
})?;
|
|
|
|
Ok(Self {
|
|
host_socket_dir,
|
|
host_socket_path,
|
|
sandbox_socket_path,
|
|
shutdown,
|
|
})
|
|
}
|
|
|
|
pub(crate) fn host_socket_path(&self) -> &Path {
|
|
&self.host_socket_path
|
|
}
|
|
|
|
pub(crate) fn sandbox_socket_path(&self) -> &Path {
|
|
&self.sandbox_socket_path
|
|
}
|
|
}
|
|
|
|
impl Drop for ValidationFdSender {
|
|
fn drop(&mut self) {
|
|
// If the validator never connected (e.g. bwrap failed before the
|
|
// launcher ran), the thread is still blocked in `accept`. Flag shutdown
|
|
// and poke the socket so the accept returns and the thread exits without
|
|
// serving the descriptors, then remove the socket and its private
|
|
// directory (a no-op if the thread already removed the socket after its
|
|
// single send).
|
|
self.shutdown.store(true, Ordering::SeqCst);
|
|
let _ = UnixStream::connect(&self.host_socket_path);
|
|
let _ = std::fs::remove_file(&self.host_socket_path);
|
|
let _ = std::fs::remove_dir_all(&self.host_socket_dir);
|
|
}
|
|
}
|
|
|
|
fn push_bind(args: &mut Vec<String>, flag: &str, source: &str, destination: &str) {
|
|
args.push(flag.to_string());
|
|
args.push(source.to_string());
|
|
args.push(destination.to_string());
|
|
}
|
|
|
|
fn resolve_bwrap() -> std::result::Result<PathBuf, LauncherStatus> {
|
|
match locate_bwrap() {
|
|
BwrapLocation::Found(path) => Ok(path),
|
|
BwrapLocation::OnlySetuid => Err(LauncherStatus::SetuidRejected),
|
|
BwrapLocation::NotFound => Err(LauncherStatus::BwrapNotFound),
|
|
}
|
|
}
|
|
|
|
fn prepare_sandbox(
|
|
permissions: SandboxPermissions,
|
|
) -> std::result::Result<(PathBuf, Vec<String>), LauncherStatus> {
|
|
let bwrap = match resolve_bwrap() {
|
|
Ok(bwrap) => bwrap,
|
|
Err(status) => {
|
|
log::warn!("[sandbox] cannot create sandbox: {}", status.describe());
|
|
return Err(status);
|
|
}
|
|
};
|
|
// The probe only answers "can a sandbox be created on this host at all", so
|
|
// it runs a bare, representative sandbox: no writable grants, no protected
|
|
// Git dirs, no proxy socket, and no `--chdir` into a command's working
|
|
// directory. None of those affect createability, and binding them would make
|
|
// the probe depend on per-command layout (e.g. a worktree under the `/tmp`
|
|
// tmpfs that `--chdir` then can't reach).
|
|
let bwrap_args = build_bwrap_args(&[], &[], permissions, None, None);
|
|
if !probe_bwrap(&bwrap, &bwrap_args) {
|
|
return Err(LauncherStatus::SandboxProbeFailed);
|
|
}
|
|
Ok((bwrap, bwrap_args))
|
|
}
|
|
|
|
/// Check whether an OS sandbox can be created on this host for this policy.
|
|
pub fn check_can_create_sandbox(
|
|
permissions: SandboxPermissions,
|
|
) -> std::result::Result<(), LauncherStatus> {
|
|
prepare_sandbox(permissions).map(|_| ())
|
|
}
|
|
|
|
/// The host (Zed-side) socket paths for the in-sandbox bind validator.
|
|
#[derive(Clone, Copy)]
|
|
pub struct ValidationSocket<'a> {
|
|
/// Host pathname of the listener the validator connects back to.
|
|
pub host_socket_path: &'a Path,
|
|
/// In-sandbox path the host socket is bind-mounted to (where the validator
|
|
/// actually connects).
|
|
pub sandbox_socket_path: &'a Path,
|
|
}
|
|
|
|
/// Build the final command line that runs `program` inside Bubblewrap.
|
|
///
|
|
/// `bridge_program` should be the current Zed executable; it is re-exec'd inside
|
|
/// the sandbox as the launcher whenever bind validation and/or the
|
|
/// restricted-network bridge are needed, running before the real command.
|
|
///
|
|
/// The host `proxy_socket_path` and `validation_socket` are each bind-mounted to
|
|
/// a per-invocation path inside the sandbox, and those in-sandbox paths are
|
|
/// handed to the launcher.
|
|
#[allow(
|
|
clippy::too_many_arguments,
|
|
reason = "assembling a bwrap command line is inherently parameter-heavy"
|
|
)]
|
|
pub fn wrap_invocation(
|
|
bridge_program: &str,
|
|
permissions: SandboxPermissions,
|
|
writable_dirs: &[&Path],
|
|
protected_paths: &[&Path],
|
|
cwd: Option<&Path>,
|
|
program: &str,
|
|
args: &[String],
|
|
proxy_socket_path: Option<&Path>,
|
|
validation_socket: Option<ValidationSocket<'_>>,
|
|
) -> Result<(String, Vec<String>)> {
|
|
if matches!(permissions.network, NetworkAccess::LocalhostPort(_)) && proxy_socket_path.is_none()
|
|
{
|
|
bail!("restricted Linux network access requires a proxy Unix socket path");
|
|
}
|
|
if writable_dirs.len() > MAX_VALIDATED_BINDS {
|
|
bail!(
|
|
"too many writable binds to validate ({} > {MAX_VALIDATED_BINDS})",
|
|
writable_dirs.len()
|
|
);
|
|
}
|
|
|
|
// Every writable path must already exist: `bwrap` can't bind a nonexistent
|
|
// source, and the command can't create it either (its parent is read-only
|
|
// inside the sandbox). Callers hand us captured canonical paths whose
|
|
// inodes were pinned at policy-construction time, so a missing path here
|
|
// means the location vanished since capture. Never create it with the
|
|
// agent's ambient permissions — recreating from path text would bind a
|
|
// fresh, unapproved object in place of the pinned one (and historically
|
|
// this materialized bogus paths, e.g. a granted *file* path springing into
|
|
// existence as a directory). Running anyway would give the command silently
|
|
// less access than it believes it has — so fail closed with a clear error.
|
|
if !permissions.allow_fs_write {
|
|
for directory in writable_dirs {
|
|
if !directory.exists() {
|
|
bail!(
|
|
"failed to provide writable sandbox path {}: it no longer exists",
|
|
directory.display()
|
|
);
|
|
}
|
|
}
|
|
}
|
|
|
|
let bwrap = resolve_bwrap().map_err(|status| anyhow!(status.describe()))?;
|
|
let proxy_socket_sandbox_path = match permissions.network {
|
|
NetworkAccess::LocalhostPort(_) => Some(unique_proxy_socket_sandbox_path()),
|
|
NetworkAccess::None | NetworkAccess::All => None,
|
|
};
|
|
let mut bwrap_args = build_bwrap_args_with_sandbox_paths(
|
|
writable_dirs,
|
|
protected_paths,
|
|
permissions,
|
|
cwd,
|
|
proxy_socket_path,
|
|
proxy_socket_sandbox_path.as_deref(),
|
|
validation_socket.map(|socket| socket.host_socket_path),
|
|
validation_socket.map(|socket| socket.sandbox_socket_path),
|
|
);
|
|
bwrap_args.push("--".to_string());
|
|
|
|
let bridge = match permissions.network {
|
|
NetworkAccess::LocalhostPort(port) => {
|
|
let proxy_socket_sandbox_path = proxy_socket_sandbox_path
|
|
.as_ref()
|
|
.context("missing in-sandbox proxy socket path")?;
|
|
Some((proxy_socket_sandbox_path.clone(), port))
|
|
}
|
|
NetworkAccess::None | NetworkAccess::All => None,
|
|
};
|
|
|
|
// Always route through the in-sandbox launcher, even when there are no
|
|
// writable binds to validate and no restricted-network bridge: the launcher
|
|
// is where the seccomp filter is installed on the untrusted command (see
|
|
// `exec_command` / `run_bridge`). Absent fields are passed as the `-`
|
|
// sentinel, and `run_launcher` then just installs the filter and `exec`s.
|
|
bwrap_args.push(bridge_program.to_string());
|
|
bwrap_args.push(LAUNCHER_FLAG.to_string());
|
|
// Field 1: validation socket (in-sandbox path) or sentinel.
|
|
bwrap_args.push(match validation_socket {
|
|
Some(socket) => socket.sandbox_socket_path.to_string_lossy().into_owned(),
|
|
None => LAUNCHER_NONE.to_string(),
|
|
});
|
|
// Fields 2-3: bridge socket (in-sandbox path) + port, or sentinels.
|
|
match &bridge {
|
|
Some((socket, port)) => {
|
|
bwrap_args.push(socket.to_string_lossy().into_owned());
|
|
bwrap_args.push(port.to_string());
|
|
}
|
|
None => {
|
|
bwrap_args.push(LAUNCHER_NONE.to_string());
|
|
bwrap_args.push(LAUNCHER_NONE.to_string());
|
|
}
|
|
}
|
|
// Field 4: the writable bind-destination paths to validate (count, then
|
|
// the paths), in the same order the host sends their fds.
|
|
let validation_paths: &[&Path] = if validation_socket.is_some() {
|
|
writable_dirs
|
|
} else {
|
|
&[]
|
|
};
|
|
bwrap_args.push(validation_paths.len().to_string());
|
|
for path in validation_paths {
|
|
bwrap_args.push(path.to_string_lossy().into_owned());
|
|
}
|
|
bwrap_args.push("--".to_string());
|
|
|
|
bwrap_args.push(program.to_string());
|
|
bwrap_args.extend(args.iter().cloned());
|
|
|
|
let bwrap = bwrap
|
|
.to_str()
|
|
.with_context(|| format!("bwrap path contains invalid UTF-8: {}", bwrap.display()))?;
|
|
Ok((bwrap.to_string(), bwrap_args))
|
|
}
|
|
|
|
/// Handle a possible re-exec of this binary as the in-sandbox launcher (bind
|
|
/// validator + network bridge). Does not return if it was invoked as one.
|
|
pub fn run_launcher_if_invoked() {
|
|
let Some(invocation) = parse_launcher_args(std::env::args_os()) else {
|
|
return;
|
|
};
|
|
let invocation = match invocation {
|
|
Ok(invocation) => invocation,
|
|
Err(error) => {
|
|
eprintln!("zed: malformed sandbox launcher invocation: {error:#}");
|
|
std::process::exit(127);
|
|
}
|
|
};
|
|
run_launcher(invocation);
|
|
}
|
|
|
|
/// A decoded in-sandbox launcher invocation (the `--zed-linux-sandbox-launcher`
|
|
/// re-exec). All fields are produced by the trusted host side and parsed before
|
|
/// any untrusted command runs.
|
|
struct LauncherInvocation {
|
|
/// In-sandbox path of the validation socket, if bind validation is required.
|
|
validation_socket: Option<PathBuf>,
|
|
/// Writable bind-destination paths to validate, in the order the host sends
|
|
/// their fds. Empty when validation isn't required.
|
|
validation_paths: Vec<PathBuf>,
|
|
/// `(in-sandbox proxy socket path, loopback port)` if the restricted-network
|
|
/// bridge is required.
|
|
bridge: Option<(PathBuf, u16)>,
|
|
program: OsString,
|
|
args: Vec<OsString>,
|
|
}
|
|
|
|
fn parse_launcher_args(
|
|
args: impl IntoIterator<Item = OsString>,
|
|
) -> Option<Result<LauncherInvocation>> {
|
|
let mut args = args.into_iter();
|
|
args.next()?;
|
|
if args.next()?.to_str() != Some(LAUNCHER_FLAG) {
|
|
return None;
|
|
}
|
|
Some(decode_launcher_args(args))
|
|
}
|
|
|
|
/// Parse an optional field encoded as either a real value or the `-` sentinel.
|
|
fn optional_field(value: OsString) -> Option<OsString> {
|
|
if value == LAUNCHER_NONE {
|
|
None
|
|
} else {
|
|
Some(value)
|
|
}
|
|
}
|
|
|
|
fn decode_launcher_args(mut args: impl Iterator<Item = OsString>) -> Result<LauncherInvocation> {
|
|
let validation_socket =
|
|
optional_field(args.next().context("missing validation socket field")?).map(PathBuf::from);
|
|
let bridge_socket =
|
|
optional_field(args.next().context("missing bridge socket field")?).map(PathBuf::from);
|
|
let bridge_port = optional_field(args.next().context("missing bridge port field")?)
|
|
.map(|value| {
|
|
value
|
|
.to_str()
|
|
.context("bridge port is not valid UTF-8")?
|
|
.parse::<u16>()
|
|
.context("invalid bridge port")
|
|
})
|
|
.transpose()?;
|
|
let bridge = match (bridge_socket, bridge_port) {
|
|
(Some(socket), Some(port)) => Some((socket, port)),
|
|
(None, None) => None,
|
|
_ => bail!("bridge socket and port must be set together"),
|
|
};
|
|
|
|
let path_count = args
|
|
.next()
|
|
.context("missing validation path count")?
|
|
.to_str()
|
|
.context("validation path count is not valid UTF-8")?
|
|
.parse::<usize>()
|
|
.context("invalid validation path count")?;
|
|
if path_count > MAX_VALIDATED_BINDS {
|
|
bail!("validation path count {path_count} exceeds {MAX_VALIDATED_BINDS}");
|
|
}
|
|
let mut validation_paths = Vec::with_capacity(path_count);
|
|
for _ in 0..path_count {
|
|
validation_paths.push(PathBuf::from(
|
|
args.next().context("missing validation path")?,
|
|
));
|
|
}
|
|
|
|
let separator = args.next().context("missing launcher argument separator")?;
|
|
if separator != "--" {
|
|
bail!("missing launcher argument separator");
|
|
}
|
|
let program = args.next().context("missing program to run")?;
|
|
let args = args.collect();
|
|
Ok(LauncherInvocation {
|
|
validation_socket,
|
|
validation_paths,
|
|
bridge,
|
|
program,
|
|
args,
|
|
})
|
|
}
|
|
|
|
/// The in-sandbox launcher entry point. Runs after bwrap's mounts and before the
|
|
/// real command: it verifies the writable binds weren't redirected, optionally
|
|
/// starts the restricted-network bridge, then runs the command. Never returns.
|
|
fn run_launcher(invocation: LauncherInvocation) -> ! {
|
|
if let Some(socket) = &invocation.validation_socket {
|
|
if let Err(error) = validate_binds(socket, &invocation.validation_paths) {
|
|
// Fail closed: a redirected (or unverifiable) writable bind means the
|
|
// command must not run at all.
|
|
eprintln!("zed: sandbox bind validation failed: {error:#}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
}
|
|
|
|
match invocation.bridge {
|
|
Some((socket_path, port)) => {
|
|
run_bridge(socket_path, port, &invocation.program, &invocation.args)
|
|
}
|
|
// No bridge to keep alive, so `exec` the command directly rather than
|
|
// lingering as a parent process.
|
|
None => exec_command(&invocation.program, &invocation.args),
|
|
}
|
|
}
|
|
|
|
/// Verify each writable bind resolves, inside the sandbox, to the exact inode the
|
|
/// host captured. Receives the captured `O_PATH` fds over `socket_path` via
|
|
/// `SCM_RIGHTS` (in the same order as `paths`), then compares `fstat(received
|
|
/// fd)` against `lstat(mounted path)`. Both stats run in this process inside the
|
|
/// sandbox, so the comparison needs no cross-namespace assumption about device
|
|
/// numbers. Any mismatch — or any failure to obtain the expected number of fds —
|
|
/// is an error (the caller fails closed).
|
|
fn validate_binds(socket_path: &Path, paths: &[PathBuf]) -> Result<()> {
|
|
let stream = UnixStream::connect(socket_path)
|
|
.with_context(|| format!("connecting to validation socket {}", socket_path.display()))?;
|
|
let fds = recv_fds(&stream).context("receiving validation descriptors")?;
|
|
if fds.len() != paths.len() {
|
|
bail!(
|
|
"expected {} validation descriptor(s), received {}",
|
|
paths.len(),
|
|
fds.len()
|
|
);
|
|
}
|
|
for (fd, path) in fds.iter().zip(paths) {
|
|
let expected = fd_dev_ino(fd.as_raw_fd())
|
|
.with_context(|| format!("fstat of captured descriptor for {}", path.display()))?;
|
|
let mounted = lstat_dev_ino(path)
|
|
.with_context(|| format!("lstat of mounted bind {}", path.display()))?;
|
|
if expected != mounted {
|
|
bail!(
|
|
"writable bind {} was redirected (captured inode {:?}, mounted inode {:?})",
|
|
path.display(),
|
|
expected,
|
|
mounted
|
|
);
|
|
}
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
/// Build the seccomp-BPF program installed on the untrusted command before it
|
|
/// runs. This is the syscall-level half of preventing session-IPC-socket
|
|
/// sandbox escapes: a read-only bind mount does not stop `connect()` to a unix
|
|
/// socket, so instead we stop the command from ever *obtaining* a non-IP socket.
|
|
///
|
|
/// The program (default action: allow):
|
|
/// - `socket()` is denied (`EPERM`) unless the family is `AF_INET`/`AF_INET6`/
|
|
/// `AF_NETLINK` — so no `AF_UNIX` (session IPC) or `AF_VSOCK` (VM host) sockets.
|
|
/// - `socketpair()` is allowed only for `AF_UNIX` (a process-local pair that
|
|
/// cannot reach anything outside the sandbox).
|
|
/// - `io_uring_*` is denied, so its ring ops can't create/connect sockets
|
|
/// without going through the filtered syscalls.
|
|
/// - `ptrace`/`process_vm_*` are denied.
|
|
///
|
|
/// `connect`/`recvmsg`/`sendmsg`/`bind`/`listen`/`accept` stay allowed: with no
|
|
/// way to create a forbidden socket (and — by fd hygiene — no forbidden fd
|
|
/// inherited), there is nothing dangerous for them to act on, and blocking
|
|
/// `connect` would break legitimate loopback/proxy use. Foreign-architecture
|
|
/// syscalls are killed by seccompiler's arch check, closing the 32-bit-ABI
|
|
/// (`socketcall`) bypass.
|
|
///
|
|
/// Returns `None` on an architecture seccompiler can't target (we ship on
|
|
/// x86_64/aarch64, so that is not a configuration we run in practice).
|
|
fn build_command_seccomp_program() -> Result<Option<seccompiler::BpfProgram>> {
|
|
use seccompiler::{
|
|
BpfProgram, SeccompAction, SeccompCmpArgLen, SeccompCmpOp, SeccompCondition, SeccompFilter,
|
|
SeccompRule, TargetArch,
|
|
};
|
|
use std::collections::BTreeMap;
|
|
|
|
let Ok(target_arch) = TargetArch::try_from(std::env::consts::ARCH) else {
|
|
return Ok(None);
|
|
};
|
|
|
|
// `socket(domain, ...)`: deny unless `domain` (arg0, an `int` — compare the
|
|
// low 32 bits) is an allowed IP/netlink family. The rule matches when the
|
|
// family is none of the allowed ones, and a matched rule takes the deny
|
|
// action; an allowed family matches no rule and falls through to `Allow`.
|
|
let socket_deny = SeccompRule::new(vec![
|
|
SeccompCondition::new(
|
|
0,
|
|
SeccompCmpArgLen::Dword,
|
|
SeccompCmpOp::Ne,
|
|
libc::AF_INET as u64,
|
|
)?,
|
|
SeccompCondition::new(
|
|
0,
|
|
SeccompCmpArgLen::Dword,
|
|
SeccompCmpOp::Ne,
|
|
libc::AF_INET6 as u64,
|
|
)?,
|
|
SeccompCondition::new(
|
|
0,
|
|
SeccompCmpArgLen::Dword,
|
|
SeccompCmpOp::Ne,
|
|
libc::AF_NETLINK as u64,
|
|
)?,
|
|
])?;
|
|
// `socketpair(domain, ...)`: allow only `AF_UNIX`.
|
|
let socketpair_deny = SeccompRule::new(vec![SeccompCondition::new(
|
|
0,
|
|
SeccompCmpArgLen::Dword,
|
|
SeccompCmpOp::Ne,
|
|
libc::AF_UNIX as u64,
|
|
)?])?;
|
|
|
|
let mut rules: BTreeMap<i64, Vec<SeccompRule>> = BTreeMap::new();
|
|
rules.insert(libc::SYS_socket, vec![socket_deny]);
|
|
rules.insert(libc::SYS_socketpair, vec![socketpair_deny]);
|
|
// Unconditional denials (an empty rule chain always takes the match action).
|
|
for syscall in [
|
|
libc::SYS_io_uring_setup,
|
|
libc::SYS_io_uring_enter,
|
|
libc::SYS_io_uring_register,
|
|
libc::SYS_ptrace,
|
|
libc::SYS_process_vm_readv,
|
|
libc::SYS_process_vm_writev,
|
|
] {
|
|
rules.insert(syscall, Vec::new());
|
|
}
|
|
|
|
let filter = SeccompFilter::new(
|
|
rules,
|
|
SeccompAction::Allow,
|
|
SeccompAction::Errno(libc::EPERM as u32),
|
|
target_arch,
|
|
)
|
|
.context("building sandbox command seccomp filter")?;
|
|
let program =
|
|
BpfProgram::try_from(filter).context("compiling sandbox command seccomp filter")?;
|
|
Ok(Some(program))
|
|
}
|
|
|
|
/// Install [`build_command_seccomp_program`] on the calling thread, which is
|
|
/// about to become (or `exec` into) the untrusted command; the filter survives
|
|
/// `exec`. `apply_filter` also sets `PR_SET_NO_NEW_PRIVS`. On an unsupported
|
|
/// architecture there is no filter to install — log and proceed rather than
|
|
/// break the sandbox on a platform we don't ship.
|
|
fn install_command_seccomp_filter() -> Result<()> {
|
|
match build_command_seccomp_program()? {
|
|
Some(program) => seccompiler::apply_filter(&program)
|
|
.context("installing sandbox command seccomp filter")?,
|
|
None => log::warn!(
|
|
"[sandbox] seccomp is unavailable on {}; the unix-socket syscall guard \
|
|
was not installed",
|
|
std::env::consts::ARCH
|
|
),
|
|
}
|
|
Ok(())
|
|
}
|
|
|
|
/// Replace this process with the sandboxed command. Only returns (after logging)
|
|
/// if `exec` itself fails.
|
|
fn exec_command(program: &OsStr, args: &[OsString]) -> ! {
|
|
// Lock down socket/io_uring/ptrace syscalls right before handing control to
|
|
// the untrusted command; the filter survives `exec`.
|
|
if let Err(error) = install_command_seccomp_filter() {
|
|
eprintln!("zed: failed to install sandbox seccomp filter: {error:#}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
let error = Command::new(program).args(args).exec();
|
|
eprintln!("zed: failed to exec sandboxed command: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
|
|
#[allow(
|
|
clippy::disallowed_methods,
|
|
reason = "the bridge is an in-sandbox process that must synchronously spawn and wait for the command"
|
|
)]
|
|
fn run_bridge(socket_path: PathBuf, port: u16, program: &OsStr, program_args: &[OsString]) -> ! {
|
|
let listener = match TcpListener::bind((Ipv4Addr::LOCALHOST, port)) {
|
|
Ok(listener) => listener,
|
|
Err(error) => {
|
|
eprintln!("zed: failed to bind sandbox proxy bridge: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
};
|
|
|
|
if let Err(error) = thread::Builder::new()
|
|
.name("zed-sandbox-bridge".to_string())
|
|
.stack_size(128 * 1024)
|
|
.spawn(move || run_bridge_listener(listener, socket_path))
|
|
{
|
|
eprintln!("zed: failed to spawn sandbox proxy bridge: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
|
|
// The command runs under the syscall filter, installed in the child via
|
|
// `pre_exec` — *this* bridge process must NOT be filtered, since it keeps
|
|
// using `AF_UNIX` to reach the host proxy for every request the command
|
|
// makes. Build the program before the fork; the child only applies it.
|
|
let seccomp_program = match build_command_seccomp_program() {
|
|
Ok(program) => program,
|
|
Err(error) => {
|
|
eprintln!("zed: failed to build sandbox seccomp filter: {error:#}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
};
|
|
let mut command = Command::new(program);
|
|
command.args(program_args);
|
|
// SAFETY: the closure runs in the forked child after `fork` and before
|
|
// `exec`. It only calls `seccompiler::apply_filter` (a `prctl` on a program
|
|
// built before the fork) — async-signal-safe and allocation-free.
|
|
unsafe {
|
|
command.pre_exec(move || {
|
|
if let Some(program) = &seccomp_program {
|
|
seccompiler::apply_filter(program)
|
|
.map_err(|error| std::io::Error::other(format!("seccomp: {error}")))?;
|
|
}
|
|
Ok(())
|
|
});
|
|
}
|
|
let mut child = match command.spawn() {
|
|
Ok(child) => child,
|
|
Err(error) => {
|
|
eprintln!("zed: failed to spawn sandboxed command: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
};
|
|
|
|
match child.wait() {
|
|
Ok(status) => {
|
|
if let Some(code) = status.code() {
|
|
std::process::exit(code);
|
|
}
|
|
let signal = status.signal().unwrap_or(1);
|
|
std::process::exit(128 + signal);
|
|
}
|
|
Err(error) => {
|
|
eprintln!("zed: failed to wait for sandboxed command: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
}
|
|
}
|
|
|
|
/// Send `fds` over `stream` in a single message carrying one byte of payload and
|
|
/// the descriptors as `SCM_RIGHTS` ancillary data.
|
|
fn send_fds(stream: &UnixStream, fds: &[RawFd]) -> std::io::Result<()> {
|
|
use nix::sys::socket::{ControlMessage, MsgFlags, sendmsg};
|
|
let payload = [0u8; 1];
|
|
let iov = [std::io::IoSlice::new(&payload)];
|
|
let control = [ControlMessage::ScmRights(fds)];
|
|
sendmsg::<()>(
|
|
stream.as_raw_fd(),
|
|
&iov,
|
|
&control,
|
|
MsgFlags::MSG_NOSIGNAL,
|
|
None,
|
|
)
|
|
.map_err(std::io::Error::from)?;
|
|
Ok(())
|
|
}
|
|
|
|
/// Receive the descriptors sent via `SCM_RIGHTS` on `stream`. They arrive with
|
|
/// `O_CLOEXEC` (via `MSG_CMSG_CLOEXEC`) so they don't leak into the command
|
|
/// that's `exec`'d after validation. The ancillary buffer is sized for the
|
|
/// protocol maximum ([`MAX_VALIDATED_BINDS`]); a sender exceeding it trips
|
|
/// `MSG_CTRUNC` and a mismatched count is rejected by the caller.
|
|
fn recv_fds(stream: &UnixStream) -> std::io::Result<Vec<OwnedFd>> {
|
|
use nix::sys::socket::{ControlMessageOwned, MsgFlags, recvmsg};
|
|
let mut payload = [0u8; 1];
|
|
let mut iov = [std::io::IoSliceMut::new(&mut payload)];
|
|
let mut control = nix::cmsg_space!([RawFd; MAX_VALIDATED_BINDS]);
|
|
let message = recvmsg::<()>(
|
|
stream.as_raw_fd(),
|
|
&mut iov,
|
|
Some(&mut control),
|
|
MsgFlags::MSG_CMSG_CLOEXEC,
|
|
)
|
|
.map_err(std::io::Error::from)?;
|
|
if message.flags.contains(MsgFlags::MSG_CTRUNC) {
|
|
return Err(std::io::Error::other(
|
|
"validation descriptors were truncated in transit",
|
|
));
|
|
}
|
|
|
|
let mut fds = Vec::new();
|
|
for control_message in message.cmsgs().map_err(std::io::Error::from)? {
|
|
if let ControlMessageOwned::ScmRights(raw_fds) = control_message {
|
|
for raw in raw_fds {
|
|
// SAFETY: the kernel installs each `SCM_RIGHTS` descriptor as a
|
|
// freshly-allocated, open fd in *our* table for this message
|
|
// (with `O_CLOEXEC` via `MSG_CMSG_CLOEXEC`), so it's valid and
|
|
// can't alias an fd we already hold. `nix`'s `ScmRights` does not
|
|
// take ownership of received fds (closing them is the caller's
|
|
// responsibility), so wrapping each exactly once here makes us
|
|
// their sole owner. Both hold for any peer, which is why this
|
|
// (and `recv_fds`) is sound as a safe fn rather than needing an
|
|
// `unsafe fn` precondition on the caller.
|
|
fds.push(unsafe { OwnedFd::from_raw_fd(raw) });
|
|
}
|
|
}
|
|
}
|
|
Ok(fds)
|
|
}
|
|
|
|
/// `(device, inode)` of the object an already-open descriptor refers to.
|
|
fn fd_dev_ino(fd: RawFd) -> std::io::Result<(u64, u64)> {
|
|
let stat = nix::sys::stat::fstat(fd).map_err(std::io::Error::from)?;
|
|
Ok((stat.st_dev as u64, stat.st_ino as u64))
|
|
}
|
|
|
|
/// `(device, inode)` of `path` without following a final symlink.
|
|
fn lstat_dev_ino(path: &Path) -> std::io::Result<(u64, u64)> {
|
|
// `symlink_metadata` is `lstat(2)` (it does not follow a final symlink).
|
|
let metadata = std::fs::symlink_metadata(path)?;
|
|
Ok((metadata.dev(), metadata.ino()))
|
|
}
|
|
|
|
/// A decoded WSL-helper invocation (`--wsl-sandbox-helper`). All fields are
|
|
/// produced by the trusted Windows side and parsed before any untrusted command
|
|
/// runs.
|
|
struct WslHelperInvocation {
|
|
/// Absolute path of `bwrap` inside WSL (located by the Windows-side probe).
|
|
bwrap_path: PathBuf,
|
|
/// Pre-built bwrap *options* — everything before the trailing `-- cmd` —
|
|
/// assembled on the Windows side (`windows_wsl::build_bwrap_args`): root
|
|
/// bind, `/tmp` tmpfs, writable binds, Windows-interop blocking, `--setenv`s,
|
|
/// `--chdir`, namespace flags, etc.
|
|
base_args: Vec<OsString>,
|
|
/// The writable bind destinations to validate — exactly the ones `base_args`
|
|
/// binds read-write. Each is captured here (WSL-side) and checked in-sandbox.
|
|
writable_paths: Vec<PathBuf>,
|
|
program: OsString,
|
|
args: Vec<OsString>,
|
|
}
|
|
|
|
/// Handle a possible re-exec of this binary as the WSL-side sandbox helper. Does
|
|
/// not return if it was invoked as one.
|
|
pub fn run_wsl_helper_if_invoked() {
|
|
let args: Vec<OsString> = std::env::args_os().collect();
|
|
if args.get(1).and_then(|arg| arg.to_str()) == Some(WSL_RESOLVE_FLAG) {
|
|
let Some(path) = args.get(2) else {
|
|
eprintln!("zed: malformed WSL canonical-path resolver invocation");
|
|
std::process::exit(127);
|
|
};
|
|
if args.len() != 3 {
|
|
eprintln!("zed: malformed WSL canonical-path resolver invocation");
|
|
std::process::exit(127);
|
|
}
|
|
match crate::util::CanonicalPathBuf::resolve(PathBuf::from(path.as_os_str())) {
|
|
Ok(canonical) => {
|
|
let Some(canonical) = canonical.path().to_str() else {
|
|
eprintln!("zed: canonical WSL sandbox grant is not valid UTF-8");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
};
|
|
let Ok(distro) = std::env::var("WSL_DISTRO_NAME") else {
|
|
eprintln!("zed: WSL_DISTRO_NAME is unavailable while resolving sandbox grant");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
};
|
|
// Classify the backing filesystem of the *canonical* target (the
|
|
// path that will actually be bound), so the Windows side can
|
|
// persist whether this grant lives on a Windows-hosted (DrvFs)
|
|
// filesystem, whose sandbox-integrity guarantees are weaker.
|
|
let fs_class = if path_is_on_windows_fs(Path::new(canonical)) {
|
|
"windows-fs"
|
|
} else {
|
|
"native-fs"
|
|
};
|
|
println!("{distro}");
|
|
println!("{canonical}");
|
|
println!("{fs_class}");
|
|
std::process::exit(0);
|
|
}
|
|
Err(error) => {
|
|
eprintln!("zed: could not resolve WSL sandbox grant: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
}
|
|
}
|
|
|
|
let Some(invocation) = parse_wsl_helper_args(args) else {
|
|
return;
|
|
};
|
|
let invocation = match invocation {
|
|
Ok(invocation) => invocation,
|
|
Err(error) => {
|
|
eprintln!("zed: malformed WSL sandbox helper invocation: {error:#}");
|
|
std::process::exit(127);
|
|
}
|
|
};
|
|
run_wsl_helper(invocation);
|
|
}
|
|
|
|
/// Whether `path` resides on a Windows-hosted filesystem exposed to WSL via
|
|
/// DrvFs. Inside WSL the Windows drives (`/mnt/<letter>`) are served by either
|
|
/// 9p or virtiofs, whereas the distro's own filesystems are native (ext4/btrfs/
|
|
/// overlay/tmpfs). We use the backing filesystem type rather than a `/mnt/`
|
|
/// path prefix so a reconfigured automount root, or a symlink that lands on a
|
|
/// Windows drive, is still classified correctly. Fails safe: if the type can't
|
|
/// be determined we report `true` (weaker guarantees ⇒ warn) rather than
|
|
/// silently treating it as native.
|
|
fn path_is_on_windows_fs(path: &Path) -> bool {
|
|
// `statfs.f_type` magics for the DrvFs transports. virtiofs is FUSE-backed.
|
|
const V9FS_MAGIC: u64 = 0x0102_1997;
|
|
const FUSE_SUPER_MAGIC: u64 = 0x6573_5546;
|
|
match nix::sys::statfs::statfs(path) {
|
|
Ok(stat) => {
|
|
// `f_type` is `i64` on glibc but `u64` on musl, so widen it
|
|
// losslessly instead of comparing against a fixed-width constant.
|
|
u64::try_from(stat.filesystem_type().0)
|
|
.is_ok_and(|fs_type| fs_type == V9FS_MAGIC || fs_type == FUSE_SUPER_MAGIC)
|
|
}
|
|
Err(_) => true,
|
|
}
|
|
}
|
|
|
|
fn parse_wsl_helper_args(
|
|
args: impl IntoIterator<Item = OsString>,
|
|
) -> Option<Result<WslHelperInvocation>> {
|
|
let mut args = args.into_iter();
|
|
args.next()?;
|
|
if args.next()?.to_str() != Some(WSL_HELPER_FLAG) {
|
|
return None;
|
|
}
|
|
Some(decode_wsl_helper_args(args))
|
|
}
|
|
|
|
fn decode_wsl_helper_args(mut args: impl Iterator<Item = OsString>) -> Result<WslHelperInvocation> {
|
|
let bwrap_path = PathBuf::from(args.next().context("missing bwrap path")?);
|
|
let base_count = parse_count(
|
|
args.next().context("missing base-arg count")?,
|
|
"base-arg count",
|
|
)?;
|
|
let mut base_args = Vec::with_capacity(base_count);
|
|
for _ in 0..base_count {
|
|
base_args.push(args.next().context("missing base arg")?);
|
|
}
|
|
let writable_count = parse_count(
|
|
args.next().context("missing writable count")?,
|
|
"writable count",
|
|
)?;
|
|
if writable_count > MAX_VALIDATED_BINDS {
|
|
bail!("writable count {writable_count} exceeds {MAX_VALIDATED_BINDS}");
|
|
}
|
|
let mut writable_paths = Vec::with_capacity(writable_count);
|
|
for _ in 0..writable_count {
|
|
writable_paths.push(PathBuf::from(args.next().context("missing writable path")?));
|
|
}
|
|
let separator = args.next().context("missing argument separator")?;
|
|
if separator != "--" {
|
|
bail!("missing argument separator");
|
|
}
|
|
let program = args.next().context("missing program to run")?;
|
|
let args = args.collect();
|
|
Ok(WslHelperInvocation {
|
|
bwrap_path,
|
|
base_args,
|
|
writable_paths,
|
|
program,
|
|
args,
|
|
})
|
|
}
|
|
|
|
fn parse_count(value: OsString, what: &str) -> Result<usize> {
|
|
value
|
|
.to_str()
|
|
.with_context(|| format!("{what} is not valid UTF-8"))?
|
|
.parse::<usize>()
|
|
.with_context(|| format!("invalid {what}"))
|
|
}
|
|
|
|
/// The WSL-side helper entry point. Mirrors the native-Linux host side: capture
|
|
/// the writable binds' inodes (here, inside WSL), stand up the validation socket,
|
|
/// finish assembling the bwrap invocation (validation socket bind + in-sandbox
|
|
/// validator re-exec), spawn bwrap, and propagate its exit. Never returns.
|
|
#[allow(
|
|
clippy::disallowed_methods,
|
|
reason = "the WSL helper is a dedicated per-command process that must spawn and wait for bwrap"
|
|
)]
|
|
fn run_wsl_helper(invocation: WslHelperInvocation) -> ! {
|
|
let mut fds = Vec::with_capacity(invocation.writable_paths.len());
|
|
for path in &invocation.writable_paths {
|
|
let fd = crate::util::CanonicalPathBuf::from_canonical(path.clone())
|
|
.and_then(|canonical| canonical.dup_fd());
|
|
match fd {
|
|
Ok(fd) => fds.push(fd),
|
|
Err(error) => {
|
|
eprintln!(
|
|
"zed: WSL sandbox helper could not verify canonical writable bind {}: {error}",
|
|
path.display()
|
|
);
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
}
|
|
}
|
|
|
|
let validation = if fds.is_empty() {
|
|
None
|
|
} else {
|
|
match ValidationFdSender::spawn(fds) {
|
|
Ok(sender) => Some(sender),
|
|
Err(error) => {
|
|
eprintln!("zed: WSL sandbox helper could not start the bind validator: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
}
|
|
};
|
|
|
|
let current_exe = match std::env::current_exe() {
|
|
Ok(path) => path,
|
|
Err(error) => {
|
|
eprintln!("zed: WSL sandbox helper could not resolve its own path: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
};
|
|
|
|
let mut args = invocation.base_args.clone();
|
|
// Always re-exec ourselves as the in-sandbox launcher, even when there is
|
|
// nothing to validate: the launcher is where the seccomp filter is installed
|
|
// on the untrusted command (see `exec_command`). When there are writable
|
|
// binds, also bind the validation socket so the launcher can verify them.
|
|
// WSL has no restricted-network bridge, so both bridge fields are the absent
|
|
// sentinel.
|
|
if let Some(sender) = &validation {
|
|
// Bind the validation socket in, after the base args' tmpfs and writable
|
|
// binds so it isn't shadowed.
|
|
args.push(OsString::from("--bind"));
|
|
args.push(sender.host_socket_path().as_os_str().to_os_string());
|
|
args.push(sender.sandbox_socket_path().as_os_str().to_os_string());
|
|
}
|
|
args.push(OsString::from("--"));
|
|
args.push(current_exe.into_os_string());
|
|
args.push(OsString::from(LAUNCHER_FLAG));
|
|
// Field 1: validation socket (in-sandbox path) or sentinel.
|
|
match &validation {
|
|
Some(sender) => args.push(sender.sandbox_socket_path().as_os_str().to_os_string()),
|
|
None => args.push(OsString::from(LAUNCHER_NONE)),
|
|
}
|
|
// Fields 2-3: bridge socket + port (WSL has no bridge).
|
|
args.push(OsString::from(LAUNCHER_NONE));
|
|
args.push(OsString::from(LAUNCHER_NONE));
|
|
// Field 4: writable bind-destination paths to validate (count, then paths);
|
|
// empty when there is nothing to validate.
|
|
let validation_paths: &[PathBuf] = if validation.is_some() {
|
|
&invocation.writable_paths
|
|
} else {
|
|
&[]
|
|
};
|
|
args.push(OsString::from(validation_paths.len().to_string()));
|
|
for path in validation_paths {
|
|
args.push(path.clone().into_os_string());
|
|
}
|
|
args.push(OsString::from("--"));
|
|
args.push(invocation.program.clone());
|
|
args.extend(invocation.args.iter().cloned());
|
|
|
|
let mut child = match Command::new(&invocation.bwrap_path).args(&args).spawn() {
|
|
Ok(child) => child,
|
|
Err(error) => {
|
|
eprintln!("zed: WSL sandbox helper could not spawn bwrap: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
};
|
|
|
|
let status = child.wait();
|
|
// Hold the validator open until bwrap (and thus the in-sandbox validator that
|
|
// connects to it during startup) has finished.
|
|
drop(validation);
|
|
match status {
|
|
Ok(status) => {
|
|
if let Some(code) = status.code() {
|
|
std::process::exit(code);
|
|
}
|
|
let signal = status.signal().unwrap_or(1);
|
|
std::process::exit(128 + signal);
|
|
}
|
|
Err(error) => {
|
|
eprintln!("zed: WSL sandbox helper failed waiting for bwrap: {error}");
|
|
std::process::exit(SANDBOX_SETUP_FAILED_EXIT_CODE);
|
|
}
|
|
}
|
|
}
|
|
|
|
fn run_bridge_listener(listener: TcpListener, socket_path: PathBuf) {
|
|
for stream in listener.incoming() {
|
|
match stream {
|
|
Ok(stream) => {
|
|
let socket_path = socket_path.clone();
|
|
if let Err(error) = thread::Builder::new()
|
|
.name("zed-sandbox-bridge-conn".to_string())
|
|
.stack_size(128 * 1024)
|
|
.spawn(move || forward_bridge_connection(stream, socket_path))
|
|
{
|
|
eprintln!("zed: failed to spawn sandbox bridge connection thread: {error}");
|
|
}
|
|
}
|
|
Err(error) => eprintln!("zed: sandbox bridge accept failed: {error}"),
|
|
}
|
|
}
|
|
}
|
|
|
|
fn forward_bridge_connection(tcp_stream: TcpStream, socket_path: PathBuf) {
|
|
let unix_stream = match UnixStream::connect(&socket_path) {
|
|
Ok(stream) => stream,
|
|
Err(error) => {
|
|
eprintln!(
|
|
"zed: sandbox bridge failed to connect to proxy socket {}: {error}",
|
|
socket_path.display()
|
|
);
|
|
return;
|
|
}
|
|
};
|
|
copy_bidirectional(tcp_stream, unix_stream);
|
|
}
|
|
|
|
fn copy_bidirectional(tcp_stream: TcpStream, unix_stream: UnixStream) {
|
|
let tcp_read = match tcp_stream.try_clone() {
|
|
Ok(stream) => stream,
|
|
Err(error) => {
|
|
eprintln!("zed: sandbox bridge failed to clone TCP stream: {error}");
|
|
return;
|
|
}
|
|
};
|
|
let unix_read = match unix_stream.try_clone() {
|
|
Ok(stream) => stream,
|
|
Err(error) => {
|
|
eprintln!("zed: sandbox bridge failed to clone Unix stream: {error}");
|
|
return;
|
|
}
|
|
};
|
|
|
|
let tcp_write = tcp_stream;
|
|
let unix_write = unix_stream;
|
|
let to_proxy = match thread::Builder::new()
|
|
.name("zed-sandbox-bridge-out".to_string())
|
|
.stack_size(128 * 1024)
|
|
.spawn(move || copy_one_way(tcp_read, unix_write))
|
|
{
|
|
Ok(handle) => handle,
|
|
Err(error) => {
|
|
eprintln!("zed: failed to spawn sandbox bridge pump thread: {error}");
|
|
return;
|
|
}
|
|
};
|
|
copy_one_way(unix_read, tcp_write);
|
|
if to_proxy.join().is_err() {
|
|
eprintln!("zed: sandbox bridge pump thread panicked");
|
|
}
|
|
}
|
|
|
|
trait BridgeStream: Read + Write {
|
|
fn shutdown(&self, how: Shutdown) -> std::io::Result<()>;
|
|
}
|
|
|
|
impl BridgeStream for TcpStream {
|
|
fn shutdown(&self, how: Shutdown) -> std::io::Result<()> {
|
|
TcpStream::shutdown(self, how)
|
|
}
|
|
}
|
|
|
|
impl BridgeStream for UnixStream {
|
|
fn shutdown(&self, how: Shutdown) -> std::io::Result<()> {
|
|
UnixStream::shutdown(self, how)
|
|
}
|
|
}
|
|
|
|
fn copy_one_way(mut from: impl Read, mut to: impl BridgeStream) {
|
|
let mut buffer = vec![0; PUMP_BUFFER_SIZE];
|
|
loop {
|
|
let count = match from.read(&mut buffer) {
|
|
Ok(0) => break,
|
|
Ok(count) => count,
|
|
Err(_) => break,
|
|
};
|
|
if to.write_all(&buffer[..count]).is_err() {
|
|
break;
|
|
}
|
|
}
|
|
let _ = to.shutdown(Shutdown::Write);
|
|
}
|
|
|
|
#[cfg(test)]
|
|
mod tests {
|
|
use super::*;
|
|
|
|
fn launcher_argv(program: &str, args: Vec<&str>) -> Vec<OsString> {
|
|
std::iter::once(program)
|
|
.chain(args)
|
|
.map(OsString::from)
|
|
.collect()
|
|
}
|
|
|
|
#[test]
|
|
fn test_build_bwrap_args_binds_exact_path_never_widens_to_ancestor() {
|
|
// A requested writable path that doesn't exist must NOT be bound, and in
|
|
// particular must never cause an existing ancestor (here the tempdir) to
|
|
// be bound read-write — that was a sandbox-escape (scope widening).
|
|
let dir = tempfile::tempdir().unwrap();
|
|
let existing = dir.path().canonicalize().unwrap();
|
|
let missing = existing.join("does-not-exist").join("nested");
|
|
|
|
let args = build_bwrap_args(
|
|
&[missing.as_path()],
|
|
&[],
|
|
SandboxPermissions::default(),
|
|
None,
|
|
None,
|
|
);
|
|
|
|
let existing_str = existing.to_string_lossy().into_owned();
|
|
assert!(
|
|
!windows_contains(&args, &["--bind", &existing_str, &existing_str]),
|
|
"a missing writable path must not widen the bind to an existing ancestor: {args:?}"
|
|
);
|
|
let missing_str = missing.to_string_lossy().into_owned();
|
|
assert!(
|
|
!windows_contains(&args, &["--bind", &missing_str, &missing_str]),
|
|
"a missing writable path must not be bound: {args:?}"
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_build_bwrap_args_default_binds_writable_dirs_read_write() {
|
|
let writable = tempfile::tempdir().unwrap();
|
|
let args = build_bwrap_args(
|
|
&[writable.path()],
|
|
&[],
|
|
SandboxPermissions::default(),
|
|
Some(writable.path()),
|
|
None,
|
|
);
|
|
|
|
assert!(windows_contains(&args, &["--ro-bind", "/", "/"]));
|
|
// The writable dir is bound verbatim at the exact path given (never
|
|
// re-canonicalized, which would reopen the bind-source TOCTOU gap).
|
|
let writable_str = writable.path().to_string_lossy().into_owned();
|
|
assert!(windows_contains(
|
|
&args,
|
|
&["--bind", &writable_str, &writable_str]
|
|
));
|
|
assert!(windows_contains(&args, &["--tmpfs", "/tmp"]));
|
|
assert!(args.iter().any(|arg| arg == "--chdir"));
|
|
assert!(args.iter().any(|arg| arg == "--unshare-net"));
|
|
}
|
|
|
|
#[test]
|
|
fn test_build_bwrap_args_network_namespace_follows_permission() {
|
|
let denied = build_bwrap_args(&[], &[], SandboxPermissions::default(), None, None);
|
|
assert!(denied.iter().any(|arg| arg == "--unshare-net"));
|
|
|
|
let allowed = build_bwrap_args(
|
|
&[],
|
|
&[],
|
|
SandboxPermissions {
|
|
network: NetworkAccess::All,
|
|
allow_fs_write: false,
|
|
},
|
|
None,
|
|
None,
|
|
);
|
|
assert!(!allowed.iter().any(|arg| arg == "--unshare-net"));
|
|
|
|
let socket = PathBuf::from("/tmp/zed-proxy.sock");
|
|
let restricted = build_bwrap_args(
|
|
&[],
|
|
&[],
|
|
SandboxPermissions {
|
|
network: NetworkAccess::LocalhostPort(8080),
|
|
allow_fs_write: false,
|
|
},
|
|
None,
|
|
Some(socket.as_path()),
|
|
);
|
|
assert!(restricted.iter().any(|arg| arg == "--unshare-net"));
|
|
let sandbox_destination = proxy_socket_bind_destination(&restricted)
|
|
.expect("restricted run should bind the proxy socket into the sandbox");
|
|
assert!(sandbox_destination.starts_with(PROXY_SOCKET_SANDBOX_PATH_PREFIX));
|
|
}
|
|
|
|
#[test]
|
|
fn test_build_bwrap_args_allow_fs_write_binds_root_read_write() {
|
|
let permissions = SandboxPermissions {
|
|
network: NetworkAccess::None,
|
|
allow_fs_write: true,
|
|
};
|
|
let protected = Path::new("/tmp");
|
|
let args = build_bwrap_args(&[], &[protected], permissions, None, None);
|
|
assert!(windows_contains(&args, &["--bind", "/", "/"]));
|
|
assert!(!windows_contains(&args, &["--ro-bind", "/", "/"]));
|
|
assert!(windows_contains(&args, &["--ro-bind", "/tmp", "/tmp"]));
|
|
assert!(!windows_contains(&args, &["--tmpfs", "/tmp"]));
|
|
}
|
|
|
|
#[test]
|
|
fn test_launcher_args_round_trip_bridge_and_validation() {
|
|
let bridge_socket = "/tmp/zed-sandbox-1234-0.sock";
|
|
let validate_socket = "/tmp/zed-sandbox-validate-1234-0.sock";
|
|
let argv = launcher_argv(
|
|
"/path/to/zed",
|
|
vec![
|
|
LAUNCHER_FLAG,
|
|
validate_socket,
|
|
bridge_socket,
|
|
"8080",
|
|
"2",
|
|
"/work/a",
|
|
"/work/b",
|
|
"--",
|
|
"/bin/sh",
|
|
"-c",
|
|
"echo hi there",
|
|
],
|
|
);
|
|
|
|
let decoded = parse_launcher_args(argv)
|
|
.expect("should be recognized as launcher invocation")
|
|
.expect("should decode successfully");
|
|
|
|
assert_eq!(
|
|
decoded.validation_socket,
|
|
Some(PathBuf::from(validate_socket))
|
|
);
|
|
assert_eq!(
|
|
decoded.validation_paths,
|
|
vec![PathBuf::from("/work/a"), PathBuf::from("/work/b")]
|
|
);
|
|
assert_eq!(
|
|
decoded.bridge,
|
|
Some((PathBuf::from(bridge_socket), 8080u16))
|
|
);
|
|
assert_eq!(decoded.program, OsString::from("/bin/sh"));
|
|
assert_eq!(
|
|
decoded.args,
|
|
vec![OsString::from("-c"), OsString::from("echo hi there")]
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_wsl_helper_args_round_trip() {
|
|
let argv = launcher_argv(
|
|
"/path/to/zed",
|
|
vec![
|
|
WSL_HELPER_FLAG,
|
|
"/usr/bin/bwrap",
|
|
// base bwrap options (3 tokens)
|
|
"3",
|
|
"--ro-bind",
|
|
"/",
|
|
"/",
|
|
// writable binds to validate (1)
|
|
"1",
|
|
"/work/a",
|
|
"--",
|
|
"/bin/sh",
|
|
"-c",
|
|
"echo hi",
|
|
],
|
|
);
|
|
|
|
let decoded = parse_wsl_helper_args(argv)
|
|
.expect("should be recognized as a WSL helper invocation")
|
|
.expect("should decode successfully");
|
|
|
|
assert_eq!(decoded.bwrap_path, PathBuf::from("/usr/bin/bwrap"));
|
|
assert_eq!(
|
|
decoded.base_args,
|
|
vec![
|
|
OsString::from("--ro-bind"),
|
|
OsString::from("/"),
|
|
OsString::from("/")
|
|
]
|
|
);
|
|
assert_eq!(decoded.writable_paths, vec![PathBuf::from("/work/a")]);
|
|
assert_eq!(decoded.program, OsString::from("/bin/sh"));
|
|
assert_eq!(
|
|
decoded.args,
|
|
vec![OsString::from("-c"), OsString::from("echo hi")]
|
|
);
|
|
}
|
|
|
|
#[test]
|
|
fn test_launcher_args_round_trip_no_bridge() {
|
|
let validate_socket = "/tmp/zed-sandbox-validate-1234-0.sock";
|
|
let argv = launcher_argv(
|
|
"/path/to/zed",
|
|
vec![
|
|
LAUNCHER_FLAG,
|
|
validate_socket,
|
|
LAUNCHER_NONE,
|
|
LAUNCHER_NONE,
|
|
"1",
|
|
"/work/a",
|
|
"--",
|
|
"/bin/true",
|
|
],
|
|
);
|
|
|
|
let decoded = parse_launcher_args(argv)
|
|
.expect("should be recognized as launcher invocation")
|
|
.expect("should decode successfully");
|
|
|
|
assert_eq!(
|
|
decoded.validation_socket,
|
|
Some(PathBuf::from(validate_socket))
|
|
);
|
|
assert_eq!(decoded.validation_paths, vec![PathBuf::from("/work/a")]);
|
|
assert_eq!(decoded.bridge, None);
|
|
assert_eq!(decoded.program, OsString::from("/bin/true"));
|
|
assert!(decoded.args.is_empty());
|
|
}
|
|
|
|
#[test]
|
|
fn test_wrap_invocation_uses_bridge_for_restricted_network() {
|
|
let socket = PathBuf::from("/tmp/zed-proxy.sock");
|
|
let permissions = SandboxPermissions {
|
|
network: NetworkAccess::LocalhostPort(8080),
|
|
allow_fs_write: false,
|
|
};
|
|
let args = build_wrapped_args_for_test(
|
|
"/path/to/zed",
|
|
permissions,
|
|
"/bin/sh",
|
|
&["-c".to_string(), "echo hi".to_string()],
|
|
Some(socket.as_path()),
|
|
);
|
|
|
|
// The bind destination inside the sandbox and the path handed to the
|
|
// launcher's bridge fields must be the same unique path. With no writable
|
|
// binds, the validation field is the `-` sentinel and the path count is 0.
|
|
let sandbox_destination = proxy_socket_bind_destination(&args)
|
|
.expect("restricted run should bind the proxy socket into the sandbox");
|
|
assert!(sandbox_destination.starts_with(PROXY_SOCKET_SANDBOX_PATH_PREFIX));
|
|
assert!(windows_contains(
|
|
&args,
|
|
&[
|
|
"/path/to/zed",
|
|
LAUNCHER_FLAG,
|
|
LAUNCHER_NONE,
|
|
&sandbox_destination,
|
|
"8080",
|
|
"0",
|
|
"--",
|
|
]
|
|
));
|
|
}
|
|
|
|
/// Reconstruct the argv `wrap_invocation` would produce for the bridge-only
|
|
/// (no writable binds, no validation socket) case, without needing a real
|
|
/// `bwrap` on the test host.
|
|
fn build_wrapped_args_for_test(
|
|
bridge_program: &str,
|
|
permissions: SandboxPermissions,
|
|
program: &str,
|
|
program_args: &[String],
|
|
proxy_socket_path: Option<&Path>,
|
|
) -> Vec<String> {
|
|
let proxy_socket_sandbox_path = match permissions.network {
|
|
NetworkAccess::LocalhostPort(_) => Some(unique_proxy_socket_sandbox_path()),
|
|
NetworkAccess::None | NetworkAccess::All => None,
|
|
};
|
|
let mut bwrap_args = build_bwrap_args_with_sandbox_paths(
|
|
&[],
|
|
&[],
|
|
permissions,
|
|
None,
|
|
proxy_socket_path,
|
|
proxy_socket_sandbox_path.as_deref(),
|
|
None,
|
|
None,
|
|
);
|
|
bwrap_args.push("--".to_string());
|
|
if let NetworkAccess::LocalhostPort(port) = permissions.network {
|
|
let proxy_socket_sandbox_path =
|
|
proxy_socket_sandbox_path.expect("restricted network needs a sandbox socket path");
|
|
bwrap_args.push(bridge_program.to_string());
|
|
bwrap_args.push(LAUNCHER_FLAG.to_string());
|
|
bwrap_args.push(LAUNCHER_NONE.to_string());
|
|
bwrap_args.push(proxy_socket_sandbox_path.to_string_lossy().into_owned());
|
|
bwrap_args.push(port.to_string());
|
|
bwrap_args.push("0".to_string());
|
|
bwrap_args.push("--".to_string());
|
|
}
|
|
bwrap_args.push(program.to_string());
|
|
bwrap_args.extend(program_args.iter().cloned());
|
|
bwrap_args
|
|
}
|
|
|
|
/// Returns the in-sandbox destination of the proxy socket `--bind`, if any.
|
|
fn proxy_socket_bind_destination(args: &[String]) -> Option<String> {
|
|
args.windows(3).find_map(|window| {
|
|
if window[0] == "--bind" && window[1] == "/tmp/zed-proxy.sock" {
|
|
Some(window[2].clone())
|
|
} else {
|
|
None
|
|
}
|
|
})
|
|
}
|
|
|
|
fn windows_contains(haystack: &[String], needle: &[&str]) -> bool {
|
|
haystack
|
|
.windows(needle.len())
|
|
.any(|window| window.iter().map(String::as_str).eq(needle.iter().copied()))
|
|
}
|
|
|
|
/// Open an `O_PATH` descriptor to `path`, mirroring how the policy layer
|
|
/// captures a `HostFilesystemLocation`.
|
|
fn open_o_path(path: &Path) -> OwnedFd {
|
|
use std::os::unix::fs::OpenOptionsExt as _;
|
|
let file = std::fs::OpenOptions::new()
|
|
.read(true)
|
|
.custom_flags(libc::O_PATH | libc::O_CLOEXEC)
|
|
.open(path)
|
|
.expect("open O_PATH");
|
|
OwnedFd::from(file)
|
|
}
|
|
|
|
// End-to-end check of the bind validator's core, without a real sandbox:
|
|
// the server hands over the captured fd via SCM_RIGHTS and `validate_binds`
|
|
// compares it against the path it's told was mounted. A matching path passes;
|
|
// a *different* directory (as a redirected bind would produce) is rejected,
|
|
// proving the validator fails closed rather than no-ops.
|
|
//
|
|
// Each `ValidationFdSender` serves a single client and then tears down, so
|
|
// the two cases use separate senders.
|
|
#[test]
|
|
fn test_validate_binds_accepts_match_and_rejects_redirect() {
|
|
let captured = tempfile::tempdir().unwrap();
|
|
let other = tempfile::tempdir().unwrap();
|
|
|
|
// The mounted path is the captured inode -> validation passes.
|
|
let sender = ValidationFdSender::spawn(vec![open_o_path(captured.path())])
|
|
.expect("spawn validation fd sender");
|
|
validate_binds(sender.host_socket_path(), &[captured.path().to_path_buf()])
|
|
.expect("matching bind must validate");
|
|
drop(sender);
|
|
|
|
// The mounted path is a *different* inode (a redirected bind) -> rejected.
|
|
let sender = ValidationFdSender::spawn(vec![open_o_path(captured.path())])
|
|
.expect("spawn validation fd sender");
|
|
let error = validate_binds(sender.host_socket_path(), &[other.path().to_path_buf()])
|
|
.expect_err("a redirected bind must be rejected");
|
|
assert!(
|
|
error.to_string().contains("redirected"),
|
|
"unexpected error: {error:#}"
|
|
);
|
|
}
|
|
|
|
// A wrong fd count from the server (here: zero fds for one path) must fail
|
|
// closed too — the validator never assumes an unvalidated bind is fine.
|
|
#[test]
|
|
fn test_validate_binds_rejects_missing_descriptors() {
|
|
let captured = tempfile::tempdir().unwrap();
|
|
let sender = ValidationFdSender::spawn(Vec::new()).expect("spawn validation fd sender");
|
|
let error = validate_binds(sender.host_socket_path(), &[captured.path().to_path_buf()])
|
|
.expect_err("missing descriptors must be rejected");
|
|
assert!(
|
|
error.to_string().contains("descriptor"),
|
|
"unexpected error: {error:#}"
|
|
);
|
|
}
|
|
|
|
// The filter compiles to a non-empty BPF program on architectures
|
|
// seccompiler can target (the ones we ship). On others it's `None`, which is
|
|
// acceptable — no filter is installed there.
|
|
#[test]
|
|
fn test_command_seccomp_program_builds() {
|
|
let program = build_command_seccomp_program().expect("build seccomp program");
|
|
if let Some(program) = program {
|
|
assert!(!program.is_empty(), "seccomp program must not be empty");
|
|
}
|
|
}
|
|
|
|
// Actually enforce the filter: in a child process, apply it and confirm that
|
|
// `socket(AF_UNIX)` is denied while `socket(AF_INET)` and
|
|
// `socketpair(AF_UNIX)` still work — the exact guarantee that closes the
|
|
// unix-socket sandbox escape.
|
|
#[test]
|
|
fn test_command_seccomp_filter_blocks_unix_but_allows_ip() {
|
|
// Build in the parent (this allocates); the child only applies the
|
|
// prebuilt program and makes raw syscalls.
|
|
let Some(program) = build_command_seccomp_program().expect("build seccomp program") else {
|
|
return; // unsupported arch: nothing to enforce
|
|
};
|
|
|
|
// SAFETY: after `fork`, the child calls only async-signal-safe
|
|
// libc/`prctl` (via `apply_filter` on a program built before the fork)
|
|
// and `_exit`; it never returns to Rust or allocates.
|
|
let pid = unsafe { libc::fork() };
|
|
assert!(pid >= 0, "fork failed");
|
|
if pid == 0 {
|
|
if seccompiler::apply_filter(&program).is_err() {
|
|
unsafe { libc::_exit(10) };
|
|
}
|
|
// AF_UNIX socket creation must be denied.
|
|
if unsafe { libc::socket(libc::AF_UNIX, libc::SOCK_STREAM, 0) } >= 0 {
|
|
unsafe { libc::_exit(11) };
|
|
}
|
|
// AF_INET socket creation must still work.
|
|
let inet = unsafe { libc::socket(libc::AF_INET, libc::SOCK_STREAM, 0) };
|
|
if inet < 0 {
|
|
unsafe { libc::_exit(12) };
|
|
}
|
|
// AF_UNIX socketpair (process-local) must still work.
|
|
let mut fds = [0i32; 2];
|
|
if unsafe { libc::socketpair(libc::AF_UNIX, libc::SOCK_STREAM, 0, fds.as_mut_ptr()) }
|
|
!= 0
|
|
{
|
|
unsafe { libc::_exit(13) };
|
|
}
|
|
unsafe { libc::_exit(0) };
|
|
}
|
|
|
|
let mut status = 0i32;
|
|
let waited = unsafe { libc::waitpid(pid, &mut status, 0) };
|
|
assert_eq!(waited, pid, "waitpid failed");
|
|
assert!(
|
|
libc::WIFEXITED(status),
|
|
"child did not exit normally: {status:#x}"
|
|
);
|
|
let code = libc::WEXITSTATUS(status);
|
|
assert_eq!(
|
|
code, 0,
|
|
"child reported a seccomp mismatch (exit {code}): 10=apply failed, \
|
|
11=AF_UNIX allowed, 12=AF_INET blocked, 13=socketpair blocked"
|
|
);
|
|
}
|
|
|
|
// A requested writable path that doesn't exist must fail the whole
|
|
// invocation — never be created with the agent's ambient permissions, and
|
|
// never run the command with silently less write access than the agent
|
|
// asked for. This check runs before `resolve_bwrap`, so the test needs no
|
|
// real `bwrap`.
|
|
#[test]
|
|
fn test_wrap_invocation_fails_when_writable_path_cannot_be_provided() {
|
|
let file = tempfile::NamedTempFile::new().unwrap();
|
|
let unbindable = file.path().join("subdir");
|
|
let result = wrap_invocation(
|
|
"/proc/self/exe",
|
|
SandboxPermissions {
|
|
network: NetworkAccess::None,
|
|
allow_fs_write: false,
|
|
},
|
|
&[unbindable.as_path()],
|
|
&[],
|
|
None,
|
|
"/bin/true",
|
|
&[],
|
|
None,
|
|
None,
|
|
);
|
|
let error = result.expect_err("must fail closed when a writable path can't be provided");
|
|
assert!(
|
|
error.to_string().contains("writable sandbox path"),
|
|
"unexpected error: {error:#}"
|
|
);
|
|
assert!(
|
|
!unbindable.exists(),
|
|
"wrap_invocation must never create a missing writable path"
|
|
);
|
|
}
|
|
}
|