vtcode_safety/sandboxing/
child_spawn.rs

1//! Child process spawning with sandbox-aware environment handling.
2//!
3//! Implements patterns from the Codex sandbox model:
4//! - Environment variable sanitization (remove sensitive vars)
5//! - Parent death signal (PR_SET_PDEATHSIG on Linux)
6//! - Sandbox identification markers for downstream tools
7
8use hashbrown::HashMap;
9use std::path::Path;
10
11/// Environment variables that should be filtered from sandboxed processes.
12///
13/// Following the field guide: "Completely clear the environment and rebuild it
14/// with only the variables you actually want."
15pub const FILTERED_ENV_VARS: &[&str] = &[
16    // API keys and tokens
17    "OPENAI_API_KEY",
18    "ANTHROPIC_API_KEY",
19    "GEMINI_API_KEY",
20    "XAI_API_KEY",
21    "DEEPSEEK_API_KEY",
22    "META_API_KEY",
23    "MODEL_API_KEY",
24    "OPENROUTER_API_KEY",
25    "GROQ_API_KEY",
26    "MISTRAL_API_KEY",
27    "COHERE_API_KEY",
28    "AZURE_OPENAI_API_KEY",
29    "HUGGINGFACE_API_KEY",
30    "HF_TOKEN",
31    // Cloud provider credentials
32    "AWS_ACCESS_KEY_ID",
33    "AWS_SECRET_ACCESS_KEY",
34    "AWS_SESSION_TOKEN",
35    "GOOGLE_APPLICATION_CREDENTIALS",
36    "GOOGLE_CLOUD_PROJECT",
37    "AZURE_CLIENT_ID",
38    "AZURE_CLIENT_SECRET",
39    "AZURE_TENANT_ID",
40    "AZURE_SUBSCRIPTION_ID",
41    // GitHub tokens
42    "GITHUB_TOKEN",
43    "GH_TOKEN",
44    "GITHUB_PAT",
45    // NPM/Package registry tokens
46    "NPM_TOKEN",
47    "NPM_AUTH_TOKEN",
48    "CARGO_REGISTRY_TOKEN",
49    "PYPI_TOKEN",
50    // Database credentials
51    "DATABASE_URL",
52    "DB_PASSWORD",
53    "PGPASSWORD",
54    "MYSQL_PWD",
55    "REDIS_PASSWORD",
56    "MONGO_PASSWORD",
57    // SSH/GPG
58    "SSH_AUTH_SOCK",
59    "GPG_AGENT_INFO",
60    // Dynamic linker vars (security risk)
61    "LD_PRELOAD",
62    "LD_LIBRARY_PATH",
63    "LD_AUDIT",
64    "LD_DEBUG",
65    "LD_PROFILE",
66    "DYLD_INSERT_LIBRARIES",
67    "DYLD_LIBRARY_PATH",
68    "DYLD_FRAMEWORK_PATH",
69    "DYLD_FALLBACK_LIBRARY_PATH",
70    // Other sensitive vars
71    "VAULT_TOKEN",
72    "CONSUL_HTTP_TOKEN",
73    "DOCKER_AUTH_CONFIG",
74    "KUBECONFIG",
75    "KUBE_TOKEN",
76    "SLACK_TOKEN",
77    "SLACK_BOT_TOKEN",
78    "DISCORD_TOKEN",
79    "TELEGRAM_BOT_TOKEN",
80];
81
82/// Environment variables that should always be preserved.
83pub const PRESERVED_ENV_VARS: &[&str] = &[
84    // Basic shell environment
85    "PATH",
86    "HOME",
87    "USER",
88    "SHELL",
89    "TERM",
90    "LANG",
91    "LC_ALL",
92    "LC_CTYPE",
93    "TZ",
94    // XDG directories
95    "XDG_CONFIG_HOME",
96    "XDG_CONFIG_DIRS",
97    "XDG_DATA_HOME",
98    "XDG_DATA_DIRS",
99    "XDG_BIN_HOME",
100    "XDG_STATE_HOME",
101    "XDG_CACHE_HOME",
102    "XDG_RUNTIME_DIR",
103    // VT Code path overrides
104    "VTCODE_CONFIG",
105    "VTCODE_CONFIG_PATH",
106    "VTCODE_DATA",
107    "VTCODE_HOME",
108    // External Codex compatibility root
109    "CODEX_HOME",
110    // Editor preferences (not sensitive)
111    "EDITOR",
112    "VISUAL",
113    "PAGER",
114    // Build tool paths
115    "CARGO_HOME",
116    "RUSTUP_HOME",
117    "GOPATH",
118    "GOROOT",
119    "JAVA_HOME",
120    "PYTHON",
121    "PYTHONPATH",
122    "NODE_PATH",
123    // Terminal capabilities
124    "COLORTERM",
125    "FORCE_COLOR",
126    "NO_COLOR",
127    "CLICOLOR",
128    "CLICOLOR_FORCE",
129    // Temp directories
130    "TMPDIR",
131    "TEMP",
132    "TMP",
133];
134
135/// Sandbox environment markers set for child processes.
136pub const VTCODE_SANDBOX_ACTIVE: &str = "VTCODE_SANDBOX_ACTIVE";
137pub const VTCODE_SANDBOX_NETWORK_DISABLED: &str = "VTCODE_SANDBOX_NETWORK_DISABLED";
138pub const VTCODE_SANDBOX_TYPE: &str = "VTCODE_SANDBOX_TYPE";
139pub const VTCODE_SANDBOX_WRITABLE_ROOTS: &str = "VTCODE_SANDBOX_WRITABLE_ROOTS";
140
141/// Build a sanitized environment for sandboxed child processes.
142///
143/// Implements the Codex pattern: "Completely clear the environment and rebuild it
144/// with only the variables you actually want."
145#[expect(
146    unused_results,
147    reason = "Environment construction intentionally ignores prior values while writing the sanitized snapshot."
148)]
149pub fn build_sanitized_env(
150    current_env: &HashMap<String, String>,
151    sandbox_active: bool,
152    network_disabled: bool,
153    sandbox_type: &str,
154    writable_roots: &[&Path],
155) -> HashMap<String, String> {
156    let mut sanitized = HashMap::new();
157
158    // Copy only preserved environment variables
159    for key in PRESERVED_ENV_VARS {
160        if let Some(value) = current_env.get(*key) {
161            sanitized.insert(key.to_string(), value.clone());
162        }
163    }
164
165    // Add sandbox markers so downstream tools know what's happening
166    if sandbox_active {
167        sanitized.insert(VTCODE_SANDBOX_ACTIVE.to_string(), "1".to_string());
168        sanitized.insert(VTCODE_SANDBOX_TYPE.to_string(), sandbox_type.to_string());
169
170        if network_disabled {
171            sanitized.insert(VTCODE_SANDBOX_NETWORK_DISABLED.to_string(), "1".to_string());
172        }
173
174        if !writable_roots.is_empty() {
175            let roots: Vec<String> = writable_roots.iter().map(|p| p.display().to_string()).collect();
176            sanitized.insert(VTCODE_SANDBOX_WRITABLE_ROOTS.to_string(), roots.join(":"));
177        }
178    }
179
180    sanitized
181}
182
183/// Check if an environment variable should be filtered.
184pub fn should_filter_env_var(key: &str) -> bool {
185    let key = key.to_ascii_uppercase();
186    FILTERED_ENV_VARS.contains(&key.as_str())
187        || key.starts_with("AWS_")
188        || key.starts_with("AZURE_")
189        || key.starts_with("GOOGLE_")
190        || key.starts_with("GCP_")
191        || key.starts_with("CLOUDSDK_")
192        || key.starts_with("LD_")
193        || key.starts_with("DYLD_")
194        || matches!(key.as_str(), "TOKEN" | "SECRET" | "PASSWORD" | "PASS" | "PWD" | "CREDENTIALS")
195        || key.ends_with("_TOKEN")
196        || key.ends_with("_KEY")
197        || key.ends_with("_SECRET")
198        || key.ends_with("_PASS")
199        || key.ends_with("_PWD")
200        || key.ends_with("_PASSWORD")
201        || key.ends_with("_CREDENTIALS")
202}
203
204/// Filter sensitive environment variables from an existing map.
205///
206/// Less aggressive than `build_sanitized_env` - preserves most vars but removes known sensitive ones.
207pub fn filter_sensitive_env(env: &HashMap<String, String>) -> HashMap<String, String> {
208    env.iter()
209        .filter(|(k, _)| !should_filter_env_var(k))
210        .map(|(k, v)| (k.clone(), v.clone()))
211        .collect()
212}
213
214/// Set up parent death signal on Linux.
215///
216/// "Ensures sandboxed children die if the main process gets killed -
217/// you don't want orphaned processes running around."
218///
219/// Uses SIGTERM for graceful shutdown. Includes parent PID check to avoid
220/// race condition where parent exits between fork and exec.
221#[cfg(target_os = "linux")]
222pub fn setup_parent_death_signal() -> std::io::Result<()> {
223    setup_parent_death_signal_with_check(nix::unistd::getppid())
224}
225
226/// Set up parent death signal with explicit parent PID check.
227///
228/// This variant should be used in pre_exec hooks where the parent PID
229/// is captured before spawn to avoid race conditions.
230#[cfg(target_os = "linux")]
231pub fn setup_parent_death_signal_with_check(expected_parent_pid: nix::unistd::Pid) -> std::io::Result<()> {
232    use nix::sys::prctl;
233    use nix::sys::signal::{Signal, raise};
234    use std::io::Error;
235
236    // Use SIGTERM for graceful shutdown (allows cleanup handlers to run)
237    prctl::set_pdeathsig(Some(Signal::SIGTERM))
238        .map_err(|e| Error::other(format!("prctl(PR_SET_PDEATHSIG) failed: {e}")))?;
239
240    // Re-check parent PID to catch race condition where parent exited between
241    // fork and this prctl call. If parent changed, self-terminate immediately.
242    if nix::unistd::getppid() != expected_parent_pid {
243        let _ = raise(Signal::SIGTERM);
244    }
245
246    Ok(())
247}
248
249#[cfg(not(target_os = "linux"))]
250pub fn setup_parent_death_signal() -> std::io::Result<()> {
251    Ok(())
252}
253
254#[cfg(test)]
255mod tests {
256    use super::*;
257
258    const TEST_API_KEY_VALUE: &str = "test-openai-key";
259
260    #[test]
261    fn test_should_filter_sensitive_vars() {
262        assert!(should_filter_env_var("OPENAI_API_KEY"));
263        assert!(should_filter_env_var("META_API_KEY"));
264        assert!(should_filter_env_var("AWS_SECRET_ACCESS_KEY"));
265        assert!(should_filter_env_var("GITHUB_TOKEN"));
266        assert!(should_filter_env_var("LD_PRELOAD"));
267        assert!(should_filter_env_var("DYLD_INSERT_LIBRARIES"));
268        assert!(should_filter_env_var("MY_CUSTOM_TOKEN"));
269        assert!(should_filter_env_var("token"));
270        assert!(should_filter_env_var("CloudSDK_AUTH_CREDENTIAL_FILE_OVERRIDE"));
271        assert!(should_filter_env_var("MY_CUSTOM_PASS"));
272        assert!(should_filter_env_var("MYSQL_PWD"));
273        assert!(should_filter_env_var("DATABASE_PASSWORD"));
274
275        assert!(!should_filter_env_var("PATH"));
276        assert!(!should_filter_env_var("HOME"));
277        assert!(!should_filter_env_var("TERM"));
278    }
279
280    #[test]
281    fn filters_sensitive_names_case_insensitively() {
282        assert!(should_filter_env_var("openai_api_key"));
283        assert!(should_filter_env_var("Aws_SECRET_ACCESS_KEY"));
284        assert!(should_filter_env_var("custom_access_token"));
285        assert!(should_filter_env_var("dyld_insert_libraries"));
286        assert!(!should_filter_env_var("PROJECT_NAME"));
287    }
288
289    #[test]
290    fn test_build_sanitized_env() {
291        let mut current = HashMap::new();
292        drop(current.insert("PATH".to_string(), "/usr/bin".to_string()));
293        drop(current.insert("HOME".to_string(), "/home/user".to_string()));
294        drop(current.insert("OPENAI_API_KEY".to_string(), TEST_API_KEY_VALUE.to_string()));
295        drop(current.insert("RANDOM_VAR".to_string(), "value".to_string()));
296
297        let sanitized = build_sanitized_env(&current, true, true, "MacosSeatbelt", &[]);
298
299        // PATH and HOME should be preserved
300        assert_eq!(sanitized.get("PATH"), Some(&"/usr/bin".to_string()));
301        assert_eq!(sanitized.get("HOME"), Some(&"/home/user".to_string()));
302
303        // API key should NOT be present (not in preserved list)
304        assert!(!sanitized.contains_key("OPENAI_API_KEY"));
305
306        // Random var should NOT be present (not in preserved list)
307        assert!(!sanitized.contains_key("RANDOM_VAR"));
308
309        // Sandbox markers should be set
310        assert_eq!(sanitized.get(VTCODE_SANDBOX_ACTIVE), Some(&"1".to_string()));
311        assert_eq!(sanitized.get(VTCODE_SANDBOX_NETWORK_DISABLED), Some(&"1".to_string()));
312        assert_eq!(sanitized.get(VTCODE_SANDBOX_TYPE), Some(&"MacosSeatbelt".to_string()));
313    }
314
315    #[test]
316    fn preserves_full_xdg_and_vtcode_path_environment_without_secrets() {
317        let mut current = HashMap::new();
318        for (key, value) in [
319            ("XDG_STATE_HOME", "/state"),
320            ("XDG_CONFIG_DIRS", "/etc/xdg:/opt/xdg"),
321            ("XDG_DATA_DIRS", "/usr/local/share:/usr/share"),
322            ("XDG_BIN_HOME", "/home/user/bin"),
323            ("VTCODE_CONFIG", "/config"),
324            ("VTCODE_CONFIG_PATH", "/config/explicit.toml"),
325            ("VTCODE_DATA", "/data"),
326            ("VTCODE_HOME", "/legacy"),
327            ("CODEX_HOME", "/codex"),
328            ("OPENAI_API_KEY", TEST_API_KEY_VALUE),
329            ("DATABASE_PASSWORD", "do-not-copy"),
330        ] {
331            drop(current.insert(key.to_string(), value.to_string()));
332        }
333
334        let sanitized = build_sanitized_env(&current, false, false, "test", &[]);
335
336        for (key, value) in [
337            ("XDG_STATE_HOME", "/state"),
338            ("XDG_CONFIG_DIRS", "/etc/xdg:/opt/xdg"),
339            ("XDG_DATA_DIRS", "/usr/local/share:/usr/share"),
340            ("XDG_BIN_HOME", "/home/user/bin"),
341            ("VTCODE_CONFIG", "/config"),
342            ("VTCODE_CONFIG_PATH", "/config/explicit.toml"),
343            ("VTCODE_DATA", "/data"),
344            ("VTCODE_HOME", "/legacy"),
345            ("CODEX_HOME", "/codex"),
346        ] {
347            assert_eq!(sanitized.get(key), Some(&value.to_string()), "missing {key}");
348        }
349        assert!(!sanitized.contains_key("OPENAI_API_KEY"));
350        assert!(!sanitized.contains_key("DATABASE_PASSWORD"));
351    }
352
353    #[test]
354    fn test_filter_sensitive_env() {
355        let mut env = HashMap::new();
356        drop(env.insert("PATH".to_string(), "/usr/bin".to_string()));
357        drop(env.insert("OPENAI_API_KEY".to_string(), TEST_API_KEY_VALUE.to_string()));
358        drop(env.insert("MY_VAR".to_string(), "value".to_string()));
359        drop(env.insert("AWS_ACCESS_KEY_ID".to_string(), "AKIA...".to_string()));
360        drop(env.insert("CUSTOM_PASS".to_string(), "let-me-in".to_string()));
361        drop(env.insert("SERVICE_PWD".to_string(), "super-secret".to_string()));
362
363        let filtered = filter_sensitive_env(&env);
364
365        assert!(filtered.contains_key("PATH"));
366        assert!(filtered.contains_key("MY_VAR"));
367        assert!(!filtered.contains_key("OPENAI_API_KEY"));
368        assert!(!filtered.contains_key("AWS_ACCESS_KEY_ID"));
369        assert!(!filtered.contains_key("CUSTOM_PASS"));
370        assert!(!filtered.contains_key("SERVICE_PWD"));
371    }
372
373    #[test]
374    fn filters_adversarial_credential_and_loader_names() {
375        let mut env = HashMap::new();
376        for (name, value) in [
377            ("MODEL_API_KEY", "model-secret"),
378            ("META_API_KEY", "meta-secret"),
379            ("INSTRUCTION_SECRET", "prompt-secret"),
380            ("AWS_PROFILE", "production"),
381            ("LD_AUDIT", "audit.so"),
382            ("DYLD_LIBRARY_PATH", "/tmp/injected"),
383            ("SAFE_PROJECT_NAME", "vtcode"),
384        ] {
385            drop(env.insert(name.to_string(), value.to_string()));
386        }
387
388        let filtered = filter_sensitive_env(&env);
389        let rebuilt = build_sanitized_env(&env, true, false, "test", &[]);
390
391        for sensitive in [
392            "MODEL_API_KEY",
393            "META_API_KEY",
394            "INSTRUCTION_SECRET",
395            "AWS_PROFILE",
396            "LD_AUDIT",
397            "DYLD_LIBRARY_PATH",
398        ] {
399            assert!(!filtered.contains_key(sensitive), "sensitive variable survived filtering: {sensitive}");
400            assert!(!rebuilt.contains_key(sensitive), "sensitive variable survived rebuilding: {sensitive}");
401        }
402        assert_eq!(filtered.get("SAFE_PROJECT_NAME"), Some(&"vtcode".to_string()));
403    }
404}
vtcode_safety/sandboxing/child_spawn.rs

vtcode_safety/sandboxing/
child_spawn.rs
