roboticus-agent 0.10.0

//! Cross-platform filesystem confinement for skill execution.
//!
//! - **Linux 5.13+**: Landlock LSM restricts filesystem access to allowed paths.
//! - **macOS**: `sandbox-exec` profiles (implemented in `script_runner.rs`).
//! - **Windows**: Job Objects with process/memory limits + path validation.
//!   Kernel-level FS confinement requires Windows Sandbox or AppContainer;
//!   Job Objects provide resource limits while `script_allowed_paths` validation
//!   handles filesystem boundary enforcement.
//!
//! On unsupported platforms or older kernels, confinement is a no-op with a warning.

/// Landlock confinement configuration.
#[derive(Debug, Clone)]
pub struct LandlockConfig {
    /// Directories the confined process can read.
    pub read_paths: Vec<std::path::PathBuf>,
    /// Directories the confined process can read and write.
    pub write_paths: Vec<std::path::PathBuf>,
}

impl LandlockConfig {
    /// Create a config allowing read+write to workspace and read-only to skills_dir.
    pub fn for_skill_execution(workspace: &std::path::Path, skills_dir: &std::path::Path) -> Self {
        Self {
            read_paths: vec![skills_dir.to_path_buf(), workspace.to_path_buf()],
            write_paths: vec![workspace.to_path_buf()],
        }
    }

    /// Build a config for `ScriptRunner` that mirrors the macOS sandbox-exec
    /// profile: skills_dir (read-only), workspace (read-write), /tmp (read-write),
    /// plus any user-configured `script_allowed_paths` (read-only).
    pub fn for_script_runner(
        skills_dir: &std::path::Path,
        workspace_dir: Option<&std::path::Path>,
        extra_read_paths: &[std::path::PathBuf],
    ) -> Self {
        let mut read_paths = vec![skills_dir.to_path_buf()];
        read_paths.extend(extra_read_paths.iter().cloned());
        let mut write_paths = vec![std::path::PathBuf::from("/tmp")];
        if let Some(ws) = workspace_dir {
            read_paths.push(ws.to_path_buf());
            write_paths.push(ws.to_path_buf());
        }
        Self {
            read_paths,
            write_paths,
        }
    }
}

/// Create a Landlock ruleset file descriptor for use in `pre_exec`.
///
/// This builds the full ruleset (with all path rules) in the **parent** process
/// and returns the raw fd. The caller should then use raw `libc::syscall` calls
/// in `pre_exec` to apply it to the forked child:
///
/// ```ignore
/// // In pre_exec (async-signal-safe context):
/// libc::prctl(libc::PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
/// libc::syscall(libc::SYS_landlock_restrict_self, ruleset_fd, 0u32);
/// libc::close(ruleset_fd);
/// ```
///
/// Returns `Ok(Some(fd))` if the ruleset was created, `Ok(None)` if Landlock
/// is not available, or `Err` on failure.
pub fn create_landlock_fd(_config: &LandlockConfig) -> Result<Option<i32>, String> {
    #[cfg(target_os = "linux")]
    {
        use landlock::{
            ABI, Access, AccessFs, PathBeneath, PathFd, Ruleset, RulesetAttr, RulesetCreatedAttr,
        };
        let abi = ABI::V1;
        let read_access = AccessFs::from_read(abi);
        let write_access = AccessFs::from_all(abi);

        let mut ruleset = match Ruleset::default()
            .handle_access(write_access)
            .map_err(|e| format!("Landlock ruleset creation failed: {e}"))?
            .create()
        {
            Ok(rs) => rs,
            Err(e) => {
                tracing::warn!(error = %e, "Landlock not supported on this kernel");
                return Ok(None);
            }
        };

        for path in &_config.read_paths {
            match PathFd::new(path) {
                Ok(fd) => {
                    ruleset = ruleset
                        .add_rule(PathBeneath::new(fd, read_access))
                        .map_err(|e| {
                            format!("Landlock read rule failed for {}: {e}", path.display())
                        })?;
                }
                Err(e) => {
                    tracing::warn!(
                        path = %path.display(),
                        error = %e,
                        "Landlock: skipping unreadable path"
                    );
                }
            }
        }

        for path in &_config.write_paths {
            match PathFd::new(path) {
                Ok(fd) => {
                    ruleset = ruleset
                        .add_rule(PathBeneath::new(fd, write_access))
                        .map_err(|e| {
                            format!("Landlock write rule failed for {}: {e}", path.display())
                        })?;
                }
                Err(e) => {
                    tracing::warn!(
                        path = %path.display(),
                        error = %e,
                        "Landlock: skipping unwritable path"
                    );
                }
            }
        }

        // Convert the RulesetCreated into an OwnedFd (landlock 0.4 API),
        // then extract the raw fd for pre_exec use.
        use std::os::unix::io::{IntoRawFd, OwnedFd};
        let owned_fd: Option<OwnedFd> = ruleset.into();
        let raw_fd = match owned_fd {
            Some(fd) => fd.into_raw_fd(),
            None => {
                tracing::warn!("Landlock ruleset produced no fd (kernel too old?)");
                return Ok(None);
            }
        };
        tracing::debug!(
            fd = raw_fd,
            read_paths = ?_config.read_paths,
            write_paths = ?_config.write_paths,
            "Landlock ruleset fd created for child confinement"
        );
        Ok(Some(raw_fd))
    }

    #[cfg(not(target_os = "linux"))]
    {
        Ok(None)
    }
}

/// Apply Landlock restrictions to the current process.
///
/// Returns `Ok(true)` if Landlock was applied, `Ok(false)` if not available
/// (non-Linux or kernel too old), or `Err` on failure.
pub fn apply_landlock(_config: &LandlockConfig) -> Result<bool, String> {
    #[cfg(target_os = "linux")]
    {
        use landlock::{
            ABI, Access, AccessFs, PathBeneath, PathFd, Ruleset, RulesetAttr, RulesetCreatedAttr,
            RulesetStatus,
        };

        // Use the best available ABI version (v1 requires kernel 5.13+)
        let abi = ABI::V1;

        let read_access = AccessFs::from_read(abi);
        let write_access = AccessFs::from_all(abi);

        let mut ruleset = match Ruleset::default()
            .handle_access(write_access)
            .map_err(|e| format!("Landlock ruleset creation failed: {e}"))?
            .create()
        {
            Ok(rs) => rs,
            Err(e) => {
                tracing::warn!(error = %e, "Landlock not supported on this kernel");
                return Ok(false);
            }
        };

        // Add read-only rules
        for path in &_config.read_paths {
            match PathFd::new(path) {
                Ok(fd) => {
                    ruleset = ruleset
                        .add_rule(PathBeneath::new(fd, read_access))
                        .map_err(|e| {
                            format!("Landlock read rule failed for {}: {e}", path.display())
                        })?;
                }
                Err(e) => {
                    tracing::warn!(
                        path = %path.display(),
                        error = %e,
                        "Landlock: skipping unreadable path"
                    );
                }
            }
        }

        // Add read+write rules
        for path in &_config.write_paths {
            match PathFd::new(path) {
                Ok(fd) => {
                    ruleset = ruleset
                        .add_rule(PathBeneath::new(fd, write_access))
                        .map_err(|e| {
                            format!("Landlock write rule failed for {}: {e}", path.display())
                        })?;
                }
                Err(e) => {
                    tracing::warn!(
                        path = %path.display(),
                        error = %e,
                        "Landlock: skipping unwritable path"
                    );
                }
            }
        }

        let status = ruleset
            .restrict_self()
            .map_err(|e| format!("Landlock restrict_self failed: {e}"))?;

        match status.ruleset {
            RulesetStatus::FullyEnforced => {
                tracing::info!(
                    read_paths = ?_config.read_paths,
                    write_paths = ?_config.write_paths,
                    "Landlock confinement fully enforced"
                );
                Ok(true)
            }
            RulesetStatus::PartiallyEnforced => {
                tracing::warn!(
                    read_paths = ?_config.read_paths,
                    write_paths = ?_config.write_paths,
                    "Landlock confinement partially enforced (some access rights not handled)"
                );
                Ok(true)
            }
            RulesetStatus::NotEnforced => {
                tracing::warn!("Landlock ruleset not enforced (kernel may be too old)");
                Ok(false)
            }
        }
    }

    #[cfg(not(target_os = "linux"))]
    {
        tracing::debug!("Landlock confinement not available on this platform");
        Ok(false)
    }
}

// ── Windows Job Object confinement ──────────────────────────────────────────

/// Configuration for Windows Job Object confinement.
///
/// Job Objects provide process-count and memory limits. Filesystem confinement
/// on Windows is enforced at the application layer via `script_allowed_paths`
/// validation rather than kernel-level restrictions (which would require
/// AppContainer with SID management).
#[cfg(target_os = "windows")]
#[derive(Debug, Clone)]
pub struct JobObjectConfig {
    /// Maximum number of active processes in the job.
    pub max_active_processes: u32,
    /// Per-process memory limit in bytes (0 = unlimited).
    pub process_memory_limit: usize,
    /// Total job-wide memory limit in bytes (0 = unlimited).
    pub job_memory_limit: usize,
    /// Kill all processes in the job when the handle is closed.
    pub kill_on_close: bool,
}

#[cfg(target_os = "windows")]
impl Default for JobObjectConfig {
    fn default() -> Self {
        Self {
            max_active_processes: 4,
            process_memory_limit: 256 * 1024 * 1024, // 256 MiB per process
            job_memory_limit: 512 * 1024 * 1024,     // 512 MiB total
            kill_on_close: true,
        }
    }
}

#[cfg(target_os = "windows")]
impl JobObjectConfig {
    /// Create a config appropriate for sandboxed skill script execution.
    pub fn for_skill_execution() -> Self {
        Self::default()
    }
}

/// Create a Windows Job Object with resource restrictions.
///
/// Returns `Ok(handle)` with the raw `HANDLE` on success, `Ok(None)` if Job
/// Objects are not available, or `Err` on failure.
///
/// # Safety
///
/// The returned handle must be closed with `CloseHandle` when no longer needed.
/// Assign the child process to the job with `AssignProcessToJobObject` before
/// it starts running.
#[cfg(target_os = "windows")]
pub fn create_job_object(
    config: &JobObjectConfig,
) -> Result<Option<windows_sys::Win32::Foundation::HANDLE>, String> {
    use std::mem::zeroed;
    use windows_sys::Win32::Foundation::{CloseHandle, HANDLE};
    use windows_sys::Win32::System::JobObjects::{
        CreateJobObjectW, JOB_OBJECT_LIMIT_ACTIVE_PROCESS, JOB_OBJECT_LIMIT_JOB_MEMORY,
        JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE, JOB_OBJECT_LIMIT_PROCESS_MEMORY,
        JOBOBJECT_EXTENDED_LIMIT_INFORMATION, JobObjectExtendedLimitInformation,
        SetInformationJobObject,
    };

    // Create an unnamed Job Object.
    let job: HANDLE = unsafe { CreateJobObjectW(std::ptr::null(), std::ptr::null()) };
    if job.is_null() {
        return Err(format!(
            "CreateJobObjectW failed: {}",
            std::io::Error::last_os_error()
        ));
    }

    // Build extended limit information.
    let mut info: JOBOBJECT_EXTENDED_LIMIT_INFORMATION = unsafe { zeroed() };
    let mut limit_flags: u32 = 0;

    // Active process limit.
    if config.max_active_processes > 0 {
        info.BasicLimitInformation.ActiveProcessLimit = config.max_active_processes;
        limit_flags |= JOB_OBJECT_LIMIT_ACTIVE_PROCESS;
    }

    // Per-process memory limit.
    if config.process_memory_limit > 0 {
        info.ProcessMemoryLimit = config.process_memory_limit;
        limit_flags |= JOB_OBJECT_LIMIT_PROCESS_MEMORY;
    }

    // Job-wide memory limit.
    if config.job_memory_limit > 0 {
        info.JobMemoryLimit = config.job_memory_limit;
        limit_flags |= JOB_OBJECT_LIMIT_JOB_MEMORY;
    }

    // Kill all processes when the job handle is closed.
    if config.kill_on_close {
        limit_flags |= JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE;
    }

    info.BasicLimitInformation.LimitFlags = limit_flags;

    let success = unsafe {
        SetInformationJobObject(
            job,
            JobObjectExtendedLimitInformation,
            &info as *const _ as *const _,
            std::mem::size_of::<JOBOBJECT_EXTENDED_LIMIT_INFORMATION>() as u32,
        )
    };

    if success == 0 {
        let err = std::io::Error::last_os_error();
        unsafe { CloseHandle(job) };
        return Err(format!("SetInformationJobObject failed: {err}"));
    }

    tracing::info!(
        max_processes = config.max_active_processes,
        process_memory_mb = config.process_memory_limit / (1024 * 1024),
        job_memory_mb = config.job_memory_limit / (1024 * 1024),
        "Windows Job Object created for skill confinement"
    );

    Ok(Some(job))
}

/// Assign a process to an existing Job Object.
///
/// Call this immediately after spawning the child process.
#[cfg(target_os = "windows")]
pub fn assign_process_to_job(
    job: windows_sys::Win32::Foundation::HANDLE,
    process: windows_sys::Win32::Foundation::HANDLE,
) -> Result<(), String> {
    use windows_sys::Win32::System::JobObjects::AssignProcessToJobObject;

    let success = unsafe { AssignProcessToJobObject(job, process) };
    if success == 0 {
        return Err(format!(
            "AssignProcessToJobObject failed: {}",
            std::io::Error::last_os_error()
        ));
    }
    Ok(())
}

/// Close a Job Object handle.
#[cfg(target_os = "windows")]
pub fn close_job_handle(job: windows_sys::Win32::Foundation::HANDLE) {
    unsafe {
        windows_sys::Win32::Foundation::CloseHandle(job);
    }
}

// ── Platform confinement status ─────────────────────────────────────────────

/// Confinement capability for the current platform.
#[derive(Debug, Clone, PartialEq, Eq)]
pub enum ConfinementLevel {
    /// Kernel-enforced filesystem confinement (Landlock, sandbox-exec).
    KernelEnforced,
    /// Resource limits enforced (Job Objects), filesystem via path validation.
    ResourceLimitsOnly,
    /// No confinement available; running unconfined with warning.
    None,
}

/// Report the confinement capability of the current platform.
///
/// Used by the mechanic health check to surface platform limitations.
pub fn platform_confinement_status() -> (ConfinementLevel, &'static str) {
    #[cfg(target_os = "linux")]
    {
        // Check if Landlock is available by probing the kernel.
        // The actual check happens at apply time; here we report capability.
        (
            ConfinementLevel::KernelEnforced,
            "Linux: Landlock LSM available (kernel 5.13+). \
             Filesystem write-denial confinement enforced at kernel level.",
        )
    }

    #[cfg(target_os = "macos")]
    {
        (
            ConfinementLevel::KernelEnforced,
            "macOS: sandbox-exec profiles enforce filesystem write-denial confinement.",
        )
    }

    #[cfg(target_os = "windows")]
    {
        (
            ConfinementLevel::ResourceLimitsOnly,
            "Windows: Job Objects enforce process/memory limits. \
             Filesystem confinement uses application-layer path validation \
             (script_allowed_paths). For kernel-level FS sandboxing, run inside \
             Windows Sandbox or use AppContainer.",
        )
    }

    #[cfg(not(any(target_os = "linux", target_os = "macos", target_os = "windows")))]
    {
        (
            ConfinementLevel::None,
            "Unsupported platform: no filesystem confinement available. \
             Scripts run with the full privileges of the process user.",
        )
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn config_for_skill_execution() {
        let config = LandlockConfig::for_skill_execution(
            std::path::Path::new("/workspace"),
            std::path::Path::new("/skills"),
        );
        assert_eq!(config.read_paths.len(), 2);
        assert_eq!(config.write_paths.len(), 1);
    }

    #[test]
    fn apply_landlock_returns_ok() {
        let config = LandlockConfig::for_skill_execution(
            std::path::Path::new("/tmp/ws"),
            std::path::Path::new("/tmp/skills"),
        );
        let result = apply_landlock(&config);
        assert!(result.is_ok());
    }

    #[test]
    fn config_for_script_runner_basic() {
        let config = LandlockConfig::for_script_runner(
            std::path::Path::new("/skills"),
            Some(std::path::Path::new("/workspace")),
            &[std::path::PathBuf::from("/extra/read")],
        );
        // skills_dir + extra + workspace
        assert_eq!(config.read_paths.len(), 3);
        assert!(
            config
                .read_paths
                .contains(&std::path::PathBuf::from("/skills"))
        );
        assert!(
            config
                .read_paths
                .contains(&std::path::PathBuf::from("/extra/read"))
        );
        assert!(
            config
                .read_paths
                .contains(&std::path::PathBuf::from("/workspace"))
        );
        // /tmp + workspace
        assert_eq!(config.write_paths.len(), 2);
        assert!(
            config
                .write_paths
                .contains(&std::path::PathBuf::from("/tmp"))
        );
        assert!(
            config
                .write_paths
                .contains(&std::path::PathBuf::from("/workspace"))
        );
    }

    #[test]
    fn config_for_script_runner_no_workspace() {
        let config = LandlockConfig::for_script_runner(std::path::Path::new("/skills"), None, &[]);
        assert_eq!(config.read_paths.len(), 1); // skills_dir only
        assert_eq!(config.write_paths.len(), 1); // /tmp only
    }

    #[test]
    fn create_landlock_fd_returns_ok() {
        let config = LandlockConfig::for_script_runner(std::path::Path::new("/tmp"), None, &[]);
        let result = create_landlock_fd(&config);
        assert!(result.is_ok());
        // On non-Linux, should return Ok(None)
        #[cfg(not(target_os = "linux"))]
        assert!(result.unwrap().is_none());
        // On Linux, clean up the fd if we got one
        #[cfg(target_os = "linux")]
        if let Ok(Some(fd)) = result {
            unsafe {
                libc::close(fd);
            }
        }
    }

    #[test]
    fn platform_confinement_status_returns_valid() {
        let (level, message) = platform_confinement_status();
        assert!(!message.is_empty());

        #[cfg(target_os = "linux")]
        assert_eq!(level, ConfinementLevel::KernelEnforced);

        #[cfg(target_os = "macos")]
        assert_eq!(level, ConfinementLevel::KernelEnforced);

        #[cfg(target_os = "windows")]
        assert_eq!(level, ConfinementLevel::ResourceLimitsOnly);
    }

    #[cfg(target_os = "windows")]
    #[test]
    fn job_object_config_defaults() {
        let config = JobObjectConfig::for_skill_execution();
        assert_eq!(config.max_active_processes, 4);
        assert!(config.process_memory_limit > 0);
        assert!(config.job_memory_limit > 0);
        assert!(config.kill_on_close);
    }

    #[cfg(target_os = "windows")]
    #[test]
    fn job_object_creation_succeeds() {
        let config = JobObjectConfig::for_skill_execution();
        let result = create_job_object(&config);
        assert!(result.is_ok());
        if let Ok(Some(handle)) = result {
            close_job_handle(handle);
        }
    }

    #[test]
    fn confinement_level_debug_and_clone() {
        let level = ConfinementLevel::KernelEnforced;
        let cloned = level.clone();
        assert_eq!(level, cloned);
        let debug = format!("{:?}", level);
        assert!(debug.contains("KernelEnforced"));
    }

    #[test]
    fn confinement_level_variants_are_distinct() {
        assert_ne!(ConfinementLevel::KernelEnforced, ConfinementLevel::None);
        assert_ne!(
            ConfinementLevel::KernelEnforced,
            ConfinementLevel::ResourceLimitsOnly
        );
        assert_ne!(ConfinementLevel::ResourceLimitsOnly, ConfinementLevel::None);
    }

    #[test]
    fn landlock_config_debug() {
        let config = LandlockConfig {
            read_paths: vec![std::path::PathBuf::from("/a")],
            write_paths: vec![std::path::PathBuf::from("/b")],
        };
        let debug = format!("{:?}", config);
        assert!(debug.contains("/a"));
        assert!(debug.contains("/b"));
    }

    #[test]
    fn config_for_skill_execution_includes_workspace_in_both() {
        let config = LandlockConfig::for_skill_execution(
            std::path::Path::new("/workspace"),
            std::path::Path::new("/skills"),
        );
        // workspace should be in both read and write
        assert!(
            config
                .read_paths
                .contains(&std::path::PathBuf::from("/workspace"))
        );
        assert!(
            config
                .write_paths
                .contains(&std::path::PathBuf::from("/workspace"))
        );
        // skills should be in read only
        assert!(
            config
                .read_paths
                .contains(&std::path::PathBuf::from("/skills"))
        );
        assert!(
            !config
                .write_paths
                .contains(&std::path::PathBuf::from("/skills"))
        );
    }

    #[test]
    fn config_for_script_runner_includes_tmp_in_write() {
        let config = LandlockConfig::for_script_runner(std::path::Path::new("/skills"), None, &[]);
        assert!(
            config
                .write_paths
                .contains(&std::path::PathBuf::from("/tmp"))
        );
    }

    #[test]
    fn config_for_script_runner_multiple_extra_paths() {
        let extras = vec![
            std::path::PathBuf::from("/extra1"),
            std::path::PathBuf::from("/extra2"),
            std::path::PathBuf::from("/extra3"),
        ];
        let config = LandlockConfig::for_script_runner(
            std::path::Path::new("/skills"),
            Some(std::path::Path::new("/ws")),
            &extras,
        );
        // skills + 3 extras + workspace = 5
        assert_eq!(config.read_paths.len(), 5);
        for extra in &extras {
            assert!(config.read_paths.contains(extra));
        }
    }

    #[test]
    fn apply_landlock_non_linux_returns_false() {
        #[cfg(not(target_os = "linux"))]
        {
            let config = LandlockConfig {
                read_paths: vec![],
                write_paths: vec![],
            };
            let result = apply_landlock(&config).unwrap();
            assert!(!result);
        }
    }

    #[test]
    fn create_landlock_fd_non_linux_returns_none() {
        #[cfg(not(target_os = "linux"))]
        {
            let config = LandlockConfig {
                read_paths: vec![],
                write_paths: vec![],
            };
            let result = create_landlock_fd(&config).unwrap();
            assert!(result.is_none());
        }
    }

    #[test]
    fn platform_confinement_message_is_nonempty() {
        let (_, message) = platform_confinement_status();
        assert!(message.len() > 20, "expected descriptive message");
    }
}