tegwick
d79e3fe358
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a06def-6490-7033-8448-2eab2d12ed44
88 lines
3.4 KiB
Python
88 lines
3.4 KiB
Python
#!/usr/bin/env python3
|
|
"""Non-secret local proof for the owner-mediated bwrap execution boundary."""
|
|
|
|
from __future__ import annotations
|
|
|
|
import json
|
|
import tempfile
|
|
from pathlib import Path
|
|
|
|
from sandboxer.core.manager import SandboxManager
|
|
from sandboxer.lifecycle.store import SandboxStore
|
|
from sandboxer.models import ActorType, Consumer, SandboxCreateRequest, SandboxExecRequest
|
|
|
|
|
|
def main() -> int:
|
|
with tempfile.TemporaryDirectory(prefix="sandboxer-bwrap-proof-") as temp_value:
|
|
temp_dir = Path(temp_value)
|
|
source = temp_dir / "source"
|
|
source.mkdir()
|
|
(source / "copied.txt").write_text("copied\n")
|
|
outside_sentinel = temp_dir / "host-source-sentinel"
|
|
outside_sentinel.write_text("must-not-be-visible\n")
|
|
|
|
manager = SandboxManager(store=SandboxStore(path=temp_dir / "sandboxes.json"))
|
|
consumer = Consumer(
|
|
actor=ActorType.AGT,
|
|
project="sand-boxer-smoke",
|
|
session_id="non-secret-proof",
|
|
run_id="non-secret-proof-1",
|
|
)
|
|
status = manager.create(
|
|
SandboxCreateRequest(
|
|
profile="profile.bwrap-local",
|
|
inputs={"repo": str(source)},
|
|
consumer=consumer,
|
|
ttl="5m",
|
|
)
|
|
)
|
|
try:
|
|
proof_code = (
|
|
"import json, os; from pathlib import Path; "
|
|
"p=Path('proof.txt'); p.write_text('inside\\n'); "
|
|
f"outside=Path({str(outside_sentinel)!r}).exists(); "
|
|
"interfaces=[line.split(':',1)[0].strip() for line in "
|
|
"Path('/proc/net/dev').read_text().splitlines()[2:]]; "
|
|
"print(json.dumps({'cwd': str(Path.cwd()), "
|
|
"'copied': Path('copied.txt').is_file(), 'artifact': p.is_file(), "
|
|
"'host_source_visible': outside, "
|
|
"'network_interfaces': interfaces, "
|
|
"'actor': os.environ.get('SANDBOXER_ACTOR'), "
|
|
"'run_id': os.environ.get('SANDBOXER_RUN_ID'), "
|
|
"'credential_refs': os.environ.get('SANDBOXER_CREDENTIAL_ROUTE_REFS')}))"
|
|
)
|
|
result = manager.execute(
|
|
status.sandbox_id,
|
|
SandboxExecRequest(
|
|
command=["/usr/bin/python3", "-c", proof_code],
|
|
consumer=consumer,
|
|
timeout_seconds=30,
|
|
max_output_bytes=65_536,
|
|
),
|
|
)
|
|
payload = result.model_dump(mode="json")
|
|
try:
|
|
proof = json.loads(result.stdout)
|
|
except json.JSONDecodeError:
|
|
proof = None
|
|
payload["proof"] = proof
|
|
destroyed = manager.destroy(status.sandbox_id)
|
|
payload["teardown"] = {
|
|
"state": destroyed.state.value,
|
|
"workspace_removed": not Path(result.workspace_dir).exists(),
|
|
}
|
|
print(json.dumps(payload, indent=2))
|
|
passed = (
|
|
result.exit_code == 0
|
|
and proof is not None
|
|
and not proof["host_source_visible"]
|
|
and proof["network_interfaces"] == ["lo"]
|
|
and payload["teardown"]["workspace_removed"]
|
|
)
|
|
return 0 if passed else 1
|
|
finally:
|
|
manager.destroy(status.sandbox_id)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
raise SystemExit(main())
|