microsandbox 0.5.5

`microsandbox` is the core library for the microsandbox project.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

//! Integration tests for sandbox security profiles.
//!
//! These tests boot real microVMs and verify the default guest-root behavior
//! that Docker-in-Docker and sudo-like workflows depend on. They are
//! `#[ignore]`-gated via `#[msb_test]`; run with:
//!
//!     cargo nextest run -p microsandbox --test security_profile --run-ignored=only

use microsandbox::{Sandbox, sandbox::SecurityProfile};
use test_utils::msb_test;

const IMAGE: &str = "mirror.gcr.io/library/alpine";

//--------------------------------------------------------------------------------------------------
// Tests
//--------------------------------------------------------------------------------------------------

/// Default sandboxes preserve privilege elevation and guest mount semantics,
/// while restricted sandboxes opt into `no_new_privs` and drop mount capability.
#[msb_test]
async fn default_profile_keeps_guest_privileges_restricted_profile_hardens() {
    let default_name = "security-profile-default";
    let restricted_name = "security-profile-restricted";

    let default = Sandbox::builder(default_name)
        .image(IMAGE)
        .cpus(1)
        .memory(256)
        .replace()
        .create()
        .await
        .expect("create default sandbox");

    assert_no_new_privs(&default, "0").await;
    assert_cap_sys_admin(&default, true).await;
    assert_mount_tmpfs(&default, true).await;
    default.stop_and_wait().await.expect("stop default");
    let _ = Sandbox::remove(default_name).await;

    let restricted = Sandbox::builder(restricted_name)
        .image(IMAGE)
        .cpus(1)
        .memory(256)
        .replace()
        .security(SecurityProfile::Restricted)
        .volume("/mnt/msb-restricted-flags", |m| m.tmpfs().size(16))
        .create()
        .await
        .expect("create restricted sandbox");

    assert_no_new_privs(&restricted, "1").await;
    assert_cap_sys_admin(&restricted, false).await;
    assert_mount_has_flags(
        &restricted,
        "/mnt/msb-restricted-flags",
        &["nosuid", "nodev"],
    )
    .await;
    assert_mount_tmpfs(&restricted, false).await;
    restricted.stop_and_wait().await.expect("stop restricted");
    let _ = Sandbox::remove(restricted_name).await;
}

//--------------------------------------------------------------------------------------------------
// Functions
//--------------------------------------------------------------------------------------------------

async fn assert_no_new_privs(sandbox: &Sandbox, expected: &str) {
    let out = sandbox
        .shell("awk '/^NoNewPrivs:/{print $2}' /proc/self/status")
        .await
        .expect("read NoNewPrivs");
    assert_eq!(
        out.stdout().expect("utf8").trim(),
        expected,
        "unexpected NoNewPrivs value"
    );
}

async fn assert_cap_sys_admin(sandbox: &Sandbox, expected: bool) {
    let out = sandbox
        .shell("awk '/^CapEff:/{print $2}' /proc/self/status")
        .await
        .expect("read CapEff");
    let caps =
        u64::from_str_radix(out.stdout().expect("utf8").trim(), 16).expect("parse CapEff hex");
    let has_cap = (caps & (1_u64 << 21)) != 0;
    assert_eq!(has_cap, expected, "unexpected CAP_SYS_ADMIN state");
}

async fn assert_mount_has_flags(sandbox: &Sandbox, path: &str, expected_flags: &[&str]) {
    let script = format!("awk '$5 == \"{path}\" {{print $6}}' /proc/self/mountinfo");
    let out = sandbox.shell(&script).await.expect("read mount options");
    let options = out.stdout().expect("utf8");
    for flag in expected_flags {
        assert!(
            options.trim().split(',').any(|option| option == *flag),
            "expected mount {path} to include {flag}, got `{options}`"
        );
    }
}

async fn assert_mount_tmpfs(sandbox: &Sandbox, should_succeed: bool) {
    let out = sandbox
        .shell("mkdir -p /mnt/msb-security-profile && mount -t tmpfs tmpfs /mnt/msb-security-profile && umount /mnt/msb-security-profile")
        .await
        .expect("run mount probe");
    assert_eq!(
        out.status().success,
        should_succeed,
        "tmpfs mount probe returned stdout=`{}` stderr=`{}`",
        out.stdout().unwrap_or_default(),
        out.stderr().unwrap_or_default()
    );
}