1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
//! Registry of `W-SEC-*` codes for non-fatal, security-relevant runtime warnings.
//!
//! Mirrors the `E-<CATEGORY>-NNN` convention `murmur-cli`'s `CliError` uses for fatal errors
//! (see `murmur_cli::error`), but for warnings: printed and the session continues. Each code
//! has a matching `#w-sec-nnn` anchor on the diagnostics reference page, so callers can
//! append [`security_warning_link`] to the message instead of re-explaining the issue inline.
/// `capabilities.shell.allow` is non-empty but the host has no kernel-level subprocess
/// sandboxing primitive (Landlock/seccomp are Linux-only) — enforcement is environment-only.
pub const W_SEC_001: &str = "W-SEC-001";
/// `capabilities.shell.allow` is non-empty on a Linux host without Landlock (kernel <5.13) —
/// exec/network are seccomp-enforced, `socket(AF_UNIX)` is refused unless
/// `capabilities.network.unix_sockets` is declared (and `AF_NETLINK`/`AF_PACKET` always are, with
/// no opt-in), and the shell child still drops every Linux capability before `execve` — but
/// filesystem scope is not enforced at all. The socket-domain rule is pure seccomp, so it is
/// identical on this tier and on `W_SEC_005`'s; the fixed capsule device set is the opposite —
/// pure Landlock, so on this tier it does not apply and every device under `/dev` is reachable.
pub const W_SEC_002: &str = "W-SEC-002";
/// `capabilities.shell.allow` includes `"bash"` and `capabilities.network.allow` is non-empty,
/// but nothing on this host constrains bash's own outbound network access.
pub const W_SEC_003: &str = "W-SEC-003";
/// A manifest field that looks credential-shaped (`api_key`, `token`, `secret`, `password`)
/// holds a literal value instead of a `${VAR_NAME}` reference.
pub const W_SEC_004: &str = "W-SEC-004";
/// The host resolved to a Linux kernel-enforcement tier (Landlock/seccomp). Landlock now grants a
/// narrow, derived read+execute scope outside the workdir (the allowlisted binaries, their loader,
/// and their shared libraries — nothing writable), so allowlisted programs can actually run; on top
/// of that it grants a fixed, non-manifest-derived device set — `/dev/null` read+write (the sole
/// writable path outside the workdir), `/dev/zero` and `/dev/urandom` read-only, every other device
/// including `/dev/random` denied; the
/// workdir's own grant withholds character-device, block-device and unix-socket creation, so a
/// capsule cannot `mknod` a raw disk node inside it; a classic seccomp rule on `socket(2)`'s
/// `domain` refuses `AF_UNIX` unless `capabilities.network.unix_sockets` is declared and refuses
/// `AF_NETLINK`/`AF_PACKET` unconditionally, so a capsule cannot reach a host daemon socket such as
/// `/var/run/docker.sock`; and the forked shell child drops every Linux
/// capability and sets `no_new_privs` before `execve`. None of this has yet been verified by the
/// team on real Landlock-capable Linux hardware — treat it as not-yet-confirmed rather than a
/// hardened boundary. Fires on both Linux tiers so the "full" tier is not silently assumed to be
/// confirmed-enforced.
pub const W_SEC_005: &str = "W-SEC-005";
/// A `runtime: hook` artifact entry declares `capabilities.shell`/`.spawn`/`.env`/`.limits`,
/// but a per-hook grant only reads `network` and `filesystem` — the other sub-blocks are
/// structurally accepted and silently inert.
pub const W_SEC_006: &str = "W-SEC-006";
/// A `runtime: tool`/`runtime: driver` artifact entry declares a `capabilities.network.allow`
/// entry the capsule-wide ceiling does not itself allow. Narrowing can only subtract, so the
/// entry is dropped from that artifact's effective grant rather than granted.
pub const W_SEC_007: &str = "W-SEC-007";
/// A `runtime: tool`/`runtime: driver` artifact entry declares `capabilities.shell`/`.spawn`/
/// `.env`/`.limits`, but per-artifact narrowing only reads `network` and `filesystem` — the
/// other sub-blocks are structurally accepted and silently inert.
pub const W_SEC_008: &str = "W-SEC-008";
/// `capabilities.shell.interpreter_runtime` grants an allowlisted binary specific host
/// directories outside the workdir. This couples the capsule to a specific host
/// distro/interpreter-version layout (e.g. `/usr/lib/python3.11` breaks the moment the host
/// ships Python 3.12); the durable fix is the still-unbuilt staged runtime bind-mount, which
/// this grant only bridges until. Fires once per declared grant, at staging.
pub const W_SEC_009: &str = "W-SEC-009";
/// The capsule can spawn native subprocesses on a host where no cgroup v2 scope can exist
/// (macOS, or any non-Linux target). Per-process `rlimit(2)` ceilings still apply, but every
/// *aggregate* bound does not: nothing caps memory, pid count or CPU across the subprocess tree
/// as a whole. `RLIMIT_NPROC` is not a substitute — it is per-**uid**, so a fork bomb of
/// distinct, short-lived processes evades it. Permanent on this platform, like [`W_SEC_001`].
pub const W_SEC_010: &str = "W-SEC-010";
/// `capabilities.filesystem.workdir_exec: true` keeps the Landlock `Execute` right on the session
/// workdir, so anything the capsule writes there can run regardless of `capabilities.shell.allow`.
/// The allowlist is still applied to what the *agent asks* to run, but it stops being an
/// enforceable property of the capsule: a binary compiled, downloaded or renamed inside the workdir
/// executes on its own. Because of that the capsule can never achieve
/// `ContainmentClass::Scoped` — it reports `advisory` on every host, including a Landlock-capable
/// one — and pairing it with `capabilities.containment: scoped` refuses the launch with `E-CAP-003`.
/// Fires once, at staging, only for a capsule that declared it.
pub const W_SEC_011: &str = "W-SEC-011";
/// A `sealed` capsule's `capabilities.shell.allow` names a known compiler driver (`cc`, `gcc`,
/// `g++`, `c++`) whose helper subprocess — `cc1`, `cc1plus`, `as`, `ld`, `collect2` — has no grant
/// carrying the Landlock `Execute` right. The driver forks and execs those helpers itself; they
/// are separate binaries outside its own `DT_NEEDED` closure, so nothing derives them, and they
/// live under the fixed sealed runtime tree (`/usr`, `/bin`, …), which is bind-mounted read-only
/// and granted `list_dir: true, executable: false` — present and readable, but not runnable. The
/// driver therefore starts, answers `--version`, and then fails partway through the first real
/// compile. The fix is an `interpreter_runtime` or `staged_runtime` grant naming the helper's
/// containing directory, both of which carry `Execute`. A warning rather than a refusal because
/// the `<driver> -print-prog-name=<helper>` probe behind it is a heuristic about one driver
/// family: a hard refusal built on it could block a capsule that would in fact have worked. Fires
/// once per uncovered helper, at staging, only under a declared `sealed` floor.
pub const W_SEC_012: &str = "W-SEC-012";
const DIAGNOSTICS_DOC_URL: &str =
"https://docs.murmur.nexus/murmur-nexus/murmur/reference/diagnostics/";
/// Builds the doc link for a `W-SEC-*` code, e.g. `.../diagnostics/#w-sec-001`.