landstrip 0.18.1

Sandbox for coding agents with parametrized state
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96

// SPDX-License-Identifier: LGPL-2.1-or-later
// Copyright (c) 2026 Jarkko Sakkinen

//! Linux sandbox platform using Landlock and seccomp.

pub(crate) mod fd;
mod filter;
mod landlock;
mod seccomp;

use crate::engine::error::Error;
use crate::engine::policy::AccessPolicy;
use crate::engine::trap_fd::TrapFd;
use ::landlock::{AccessFs, CompatLevel, Compatible, Ruleset, RulesetAttr};
use anyhow::{Context, Result, bail};
use fd::close_inherited_fds;
use filter::NetworkFilter;
use landlock::enforce_access_policy;
use std::ffi::{OsStr, OsString};
use std::os::unix::process::CommandExt;
use std::path::PathBuf;
use std::process::Command;

pub(crate) fn doctor() -> Result<()> {
    Ruleset::default()
        .set_compatibility(CompatLevel::HardRequirement)
        .handle_access(AccessFs::Execute)
        .context("Landlock execute access is unavailable")?
        .create()
        .context("create a Landlock ruleset")?;

    let actions = std::fs::read_to_string("/proc/sys/kernel/seccomp/actions_avail")
        .context("read seccomp capabilities")?;
    if !actions
        .split_ascii_whitespace()
        .any(|action| action == "user_notif")
    {
        bail!("seccomp user notification is unavailable");
    }
    Ok(())
}
pub(crate) fn execute(
    policy: &AccessPolicy,
    tool: &OsStr,
    args: &[OsString],
    trap_fd: &TrapFd,
) -> Result<i32> {
    let network = &policy.network_access;
    let unrestricted_network = network.is_unrestricted();
    if filter::needs_unix_socket_broker(&network.unix_socket_access) {
        log::debug!("linux: unix socket policy with seccomp enabled");
    }

    let needs_fs_broker = filter::needs_filesystem_broker(policy) || trap_fd.is_enabled();
    let needs_network_broker = !unrestricted_network
        && (network.local_tcp_bind
            || !network.connect_tcp_ports.is_empty()
            || filter::needs_unix_socket_broker(&network.unix_socket_access));

    if needs_network_broker || needs_fs_broker {
        let status = seccomp::run_broker(
            policy,
            tool,
            args,
            needs_network_broker,
            needs_fs_broker,
            trap_fd,
        )?;
        trap_fd.close();
        return Ok(status);
    }

    enforce_access_policy(policy)?;

    if !unrestricted_network {
        let filters = filter::network_filter(
            NetworkFilter {
                notify_bind: false,
                notify_connect: false,
                notify_filesystem: false,
                unix_sockets: filter::unix_socket_filter(&network.unix_socket_access),
            },
            true,
        )?;
        filters.load()?;
    }
    close_inherited_fds(&[]).map_err(|source| Error::SuperviseFailed {
        source: source.into(),
    })?;
    let error = Command::new(tool).args(args).exec();
    Err(Error::LaunchFailed {
        tool: PathBuf::from(tool),
        source: error.into(),
    }
    .into())
}