Add owner-mediated bwrap execution boundary

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44
2026-09-04 22:12:19 +02:00 · 2026-09-04 22:12:19 +02:00 · d79e3fe358
commit d79e3fe358
parent 877676d1f1
23 changed files with 1321 additions and 86 deletions
--- a/scripts/smoke-bwrap-exec.py
+++ b/scripts/smoke-bwrap-exec.py
@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""Non-secret local proof for the owner-mediated bwrap execution boundary."""
+
+from __future__ import annotations
+
+import json
+import tempfile
+from pathlib import Path
+
+from sandboxer.core.manager import SandboxManager
+from sandboxer.lifecycle.store import SandboxStore
+from sandboxer.models import ActorType, Consumer, SandboxCreateRequest, SandboxExecRequest
+
+
+def main() -> int:
+    with tempfile.TemporaryDirectory(prefix="sandboxer-bwrap-proof-") as temp_value:
+        temp_dir = Path(temp_value)
+        source = temp_dir / "source"
+        source.mkdir()
+        (source / "copied.txt").write_text("copied\n")
+        outside_sentinel = temp_dir / "host-source-sentinel"
+        outside_sentinel.write_text("must-not-be-visible\n")
+
+        manager = SandboxManager(store=SandboxStore(path=temp_dir / "sandboxes.json"))
+        consumer = Consumer(
+            actor=ActorType.AGT,
+            project="sand-boxer-smoke",
+            session_id="non-secret-proof",
+            run_id="non-secret-proof-1",
+        )
+        status = manager.create(
+            SandboxCreateRequest(
+                profile="profile.bwrap-local",
+                inputs={"repo": str(source)},
+                consumer=consumer,
+                ttl="5m",
+            )
+        )
+        try:
+            proof_code = (
+                "import json, os; from pathlib import Path; "
+                "p=Path('proof.txt'); p.write_text('inside\\n'); "
+                f"outside=Path({str(outside_sentinel)!r}).exists(); "
+                "interfaces=[line.split(':',1)[0].strip() for line in "
+                "Path('/proc/net/dev').read_text().splitlines()[2:]]; "
+                "print(json.dumps({'cwd': str(Path.cwd()), "
+                "'copied': Path('copied.txt').is_file(), 'artifact': p.is_file(), "
+                "'host_source_visible': outside, "
+                "'network_interfaces': interfaces, "
+                "'actor': os.environ.get('SANDBOXER_ACTOR'), "
+                "'run_id': os.environ.get('SANDBOXER_RUN_ID'), "
+                "'credential_refs': os.environ.get('SANDBOXER_CREDENTIAL_ROUTE_REFS')}))"
+            )
+            result = manager.execute(
+                status.sandbox_id,
+                SandboxExecRequest(
+                    command=["/usr/bin/python3", "-c", proof_code],
+                    consumer=consumer,
+                    timeout_seconds=30,
+                    max_output_bytes=65_536,
+                ),
+            )
+            payload = result.model_dump(mode="json")
+            try:
+                proof = json.loads(result.stdout)
+            except json.JSONDecodeError:
+                proof = None
+            payload["proof"] = proof
+            destroyed = manager.destroy(status.sandbox_id)
+            payload["teardown"] = {
+                "state": destroyed.state.value,
+                "workspace_removed": not Path(result.workspace_dir).exists(),
+            }
+            print(json.dumps(payload, indent=2))
+            passed = (
+                result.exit_code == 0
+                and proof is not None
+                and not proof["host_source_visible"]
+                and proof["network_interfaces"] == ["lo"]
+                and payload["teardown"]["workspace_removed"]
+            )
+            return 0 if passed else 1
+        finally:
+            manager.destroy(status.sandbox_id)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())