vtcode_safety/sandboxing/
child_spawn.rs

1//! Child process spawning with sandbox-aware environment handling.
2//!
3//! Implements patterns from the Codex sandbox model:
4//! - Environment variable sanitization (remove sensitive vars)
5//! - Parent death signal (PR_SET_PDEATHSIG on Linux)
6//! - Sandbox identification markers for downstream tools
7
8use hashbrown::HashMap;
9use std::path::Path;
10
11/// Environment variables that should be filtered from sandboxed processes.
12///
13/// Following the field guide: "Completely clear the environment and rebuild it
14/// with only the variables you actually want."
15pub const FILTERED_ENV_VARS: &[&str] = &[
16    // API keys and tokens
17    "OPENAI_API_KEY",
18    "ANTHROPIC_API_KEY",
19    "GEMINI_API_KEY",
20    "XAI_API_KEY",
21    "DEEPSEEK_API_KEY",
22    "META_API_KEY",
23    "MODEL_API_KEY",
24    "OPENROUTER_API_KEY",
25    "GROQ_API_KEY",
26    "MISTRAL_API_KEY",
27    "COHERE_API_KEY",
28    "AZURE_OPENAI_API_KEY",
29    "HUGGINGFACE_API_KEY",
30    "HF_TOKEN",
31    // Cloud provider credentials
32    "AWS_ACCESS_KEY_ID",
33    "AWS_SECRET_ACCESS_KEY",
34    "AWS_SESSION_TOKEN",
35    "GOOGLE_APPLICATION_CREDENTIALS",
36    "GOOGLE_CLOUD_PROJECT",
37    "AZURE_CLIENT_ID",
38    "AZURE_CLIENT_SECRET",
39    "AZURE_TENANT_ID",
40    "AZURE_SUBSCRIPTION_ID",
41    // GitHub tokens
42    "GITHUB_TOKEN",
43    "GH_TOKEN",
44    "GITHUB_PAT",
45    // NPM/Package registry tokens
46    "NPM_TOKEN",
47    "NPM_AUTH_TOKEN",
48    "CARGO_REGISTRY_TOKEN",
49    "PYPI_TOKEN",
50    // Database credentials
51    "DATABASE_URL",
52    "DB_PASSWORD",
53    "PGPASSWORD",
54    "MYSQL_PWD",
55    "REDIS_PASSWORD",
56    "MONGO_PASSWORD",
57    // SSH/GPG
58    "SSH_AUTH_SOCK",
59    "GPG_AGENT_INFO",
60    // Dynamic linker vars (security risk)
61    "LD_PRELOAD",
62    "LD_LIBRARY_PATH",
63    "LD_AUDIT",
64    "LD_DEBUG",
65    "LD_PROFILE",
66    "DYLD_INSERT_LIBRARIES",
67    "DYLD_LIBRARY_PATH",
68    "DYLD_FRAMEWORK_PATH",
69    "DYLD_FALLBACK_LIBRARY_PATH",
70    // Other sensitive vars
71    "VAULT_TOKEN",
72    "CONSUL_HTTP_TOKEN",
73    "DOCKER_AUTH_CONFIG",
74    "KUBECONFIG",
75    "KUBE_TOKEN",
76    "SLACK_TOKEN",
77    "SLACK_BOT_TOKEN",
78    "DISCORD_TOKEN",
79    "TELEGRAM_BOT_TOKEN",
80];
81
82/// Environment variables that should always be preserved.
83pub const PRESERVED_ENV_VARS: &[&str] = &[
84    // Basic shell environment
85    "PATH",
86    "HOME",
87    "USER",
88    "SHELL",
89    "TERM",
90    "LANG",
91    "LC_ALL",
92    "LC_CTYPE",
93    "TZ",
94    // XDG directories
95    "XDG_CONFIG_HOME",
96    "XDG_CONFIG_DIRS",
97    "XDG_DATA_HOME",
98    "XDG_DATA_DIRS",
99    "XDG_BIN_HOME",
100    "XDG_STATE_HOME",
101    "XDG_CACHE_HOME",
102    "XDG_RUNTIME_DIR",
103    // VT Code path overrides
104    "VTCODE_CONFIG",
105    "VTCODE_CONFIG_PATH",
106    "VTCODE_DATA",
107    "VTCODE_HOME",
108    // External Codex compatibility root
109    "CODEX_HOME",
110    // Editor preferences (not sensitive)
111    "EDITOR",
112    "VISUAL",
113    "PAGER",
114    // Build tool paths
115    "CARGO_HOME",
116    "RUSTUP_HOME",
117    "GOPATH",
118    "GOROOT",
119    "JAVA_HOME",
120    "PYTHON",
121    "PYTHONPATH",
122    "NODE_PATH",
123    // Terminal capabilities
124    "COLORTERM",
125    "FORCE_COLOR",
126    "NO_COLOR",
127    "CLICOLOR",
128    "CLICOLOR_FORCE",
129    // Temp directories
130    "TMPDIR",
131    "TEMP",
132    "TMP",
133];
134
135/// Sandbox environment markers set for child processes.
136pub const VTCODE_SANDBOX_ACTIVE: &str = "VTCODE_SANDBOX_ACTIVE";
137pub const VTCODE_SANDBOX_NETWORK_DISABLED: &str = "VTCODE_SANDBOX_NETWORK_DISABLED";
138pub const VTCODE_SANDBOX_TYPE: &str = "VTCODE_SANDBOX_TYPE";
139pub const VTCODE_SANDBOX_WRITABLE_ROOTS: &str = "VTCODE_SANDBOX_WRITABLE_ROOTS";
140
141/// Build a sanitized environment for sandboxed child processes.
142///
143/// Implements the Codex pattern: "Completely clear the environment and rebuild it
144/// with only the variables you actually want."
145#[expect(
146    unused_results,
147    reason = "Environment construction intentionally ignores prior values while writing the sanitized snapshot."
148)]
149pub fn build_sanitized_env(
150    current_env: &HashMap<String, String>,
151    sandbox_active: bool,
152    network_disabled: bool,
153    sandbox_type: &str,
154    writable_roots: &[&Path],
155) -> HashMap<String, String> {
156    let mut sanitized = HashMap::new();
157
158    // Copy only preserved environment variables
159    for key in PRESERVED_ENV_VARS {
160        if let Some(value) = current_env.get(*key) {
161            sanitized.insert(key.to_string(), value.clone());
162        }
163    }
164
165    // Add sandbox markers so downstream tools know what's happening
166    if sandbox_active {
167        sanitized.insert(VTCODE_SANDBOX_ACTIVE.to_string(), "1".to_string());
168        sanitized.insert(VTCODE_SANDBOX_TYPE.to_string(), sandbox_type.to_string());
169
170        if network_disabled {
171            sanitized.insert(VTCODE_SANDBOX_NETWORK_DISABLED.to_string(), "1".to_string());
172        }
173
174        if !writable_roots.is_empty() {
175            let roots: Vec<String> = writable_roots.iter().map(|p| p.display().to_string()).collect();
176            sanitized.insert(VTCODE_SANDBOX_WRITABLE_ROOTS.to_string(), roots.join(":"));
177        }
178    }
179
180    sanitized
181}
182
183/// Check if an environment variable should be filtered.
184pub fn should_filter_env_var(key: &str) -> bool {
185    let key = key.to_ascii_uppercase();
186    FILTERED_ENV_VARS.contains(&key.as_str())
187        || key.starts_with("AWS_")
188        || key.starts_with("AZURE_")
189        || key.starts_with("GOOGLE_")
190        || key.starts_with("GCP_")
191        || key.starts_with("CLOUDSDK_")
192        || key.starts_with("LD_")
193        || key.starts_with("DYLD_")
194        || matches!(key.as_str(), "TOKEN" | "SECRET" | "PASSWORD" | "PASS" | "PWD" | "CREDENTIALS")
195        || key.ends_with("_TOKEN")
196        || key.ends_with("_KEY")
197        || key.ends_with("_SECRET")
198        || key.ends_with("_PASS")
199        || key.ends_with("_PWD")
200        || key.ends_with("_PASSWORD")
201        || key.ends_with("_CREDENTIALS")
202}
203
204/// Filter sensitive environment variables from an existing map.
205///
206/// Less aggressive than `build_sanitized_env` - preserves most vars but removes known sensitive ones.
207pub fn filter_sensitive_env(env: &HashMap<String, String>) -> HashMap<String, String> {
208    env.iter()
209        .filter(|(k, _)| !should_filter_env_var(k))
210        .map(|(k, v)| (k.clone(), v.clone()))
211        .collect()
212}
213
214/// Set up parent death signal on Linux.
215///
216/// "Ensures sandboxed children die if the main process gets killed -
217/// you don't want orphaned processes running around."
218///
219/// Uses SIGTERM for graceful shutdown. Includes parent PID check to avoid
220/// race condition where parent exits between fork and exec.
221#[cfg(target_os = "linux")]
222pub fn setup_parent_death_signal() -> std::io::Result<()> {
223    setup_parent_death_signal_with_check(nix::unistd::getppid())
224}
225
226/// Set up parent death signal with explicit parent PID check.
227///
228/// This variant should be used in pre_exec hooks where the parent PID
229/// is captured before spawn to avoid race conditions.
230#[cfg(target_os = "linux")]
231pub fn setup_parent_death_signal_with_check(expected_parent_pid: nix::unistd::Pid) -> std::io::Result<()> {
232    use nix::sys::prctl;
233    use nix::sys::signal::{Signal, raise};
234    use std::io::Error;
235
236    // Use SIGTERM for graceful shutdown (allows cleanup handlers to run)
237    prctl::set_pdeathsig(Some(Signal::SIGTERM))
238        .map_err(|e| Error::other(format!("prctl(PR_SET_PDEATHSIG) failed: {e}")))?;
239
240    // Re-check parent PID to catch race condition where parent exited between
241    // fork and this prctl call. If parent changed, self-terminate immediately.
242    // Signal delivery here is deliberately best-effort: nothing can recover it.
243    #[allow(
244        clippy::let_underscore_must_use,
245        reason = "best-effort self-signal during pdeathsig race"
246    )]
247    if nix::unistd::getppid() != expected_parent_pid {
248        let _ = raise(Signal::SIGTERM);
249    }
250
251    Ok(())
252}
253
254#[cfg(not(target_os = "linux"))]
255pub fn setup_parent_death_signal() -> std::io::Result<()> {
256    Ok(())
257}
258
259#[cfg(test)]
260mod tests {
261    use super::*;
262
263    const TEST_API_KEY_VALUE: &str = "test-openai-key";
264
265    #[test]
266    fn test_should_filter_sensitive_vars() {
267        assert!(should_filter_env_var("OPENAI_API_KEY"));
268        assert!(should_filter_env_var("META_API_KEY"));
269        assert!(should_filter_env_var("AWS_SECRET_ACCESS_KEY"));
270        assert!(should_filter_env_var("GITHUB_TOKEN"));
271        assert!(should_filter_env_var("LD_PRELOAD"));
272        assert!(should_filter_env_var("DYLD_INSERT_LIBRARIES"));
273        assert!(should_filter_env_var("MY_CUSTOM_TOKEN"));
274        assert!(should_filter_env_var("token"));
275        assert!(should_filter_env_var("CloudSDK_AUTH_CREDENTIAL_FILE_OVERRIDE"));
276        assert!(should_filter_env_var("MY_CUSTOM_PASS"));
277        assert!(should_filter_env_var("MYSQL_PWD"));
278        assert!(should_filter_env_var("DATABASE_PASSWORD"));
279
280        assert!(!should_filter_env_var("PATH"));
281        assert!(!should_filter_env_var("HOME"));
282        assert!(!should_filter_env_var("TERM"));
283    }
284
285    #[test]
286    fn filters_sensitive_names_case_insensitively() {
287        assert!(should_filter_env_var("openai_api_key"));
288        assert!(should_filter_env_var("Aws_SECRET_ACCESS_KEY"));
289        assert!(should_filter_env_var("custom_access_token"));
290        assert!(should_filter_env_var("dyld_insert_libraries"));
291        assert!(!should_filter_env_var("PROJECT_NAME"));
292    }
293
294    #[test]
295    fn test_build_sanitized_env() {
296        let mut current = HashMap::new();
297        drop(current.insert("PATH".to_string(), "/usr/bin".to_string()));
298        drop(current.insert("HOME".to_string(), "/home/user".to_string()));
299        drop(current.insert("OPENAI_API_KEY".to_string(), TEST_API_KEY_VALUE.to_string()));
300        drop(current.insert("RANDOM_VAR".to_string(), "value".to_string()));
301
302        let sanitized = build_sanitized_env(&current, true, true, "MacosSeatbelt", &[]);
303
304        // PATH and HOME should be preserved
305        assert_eq!(sanitized.get("PATH"), Some(&"/usr/bin".to_string()));
306        assert_eq!(sanitized.get("HOME"), Some(&"/home/user".to_string()));
307
308        // API key should NOT be present (not in preserved list)
309        assert!(!sanitized.contains_key("OPENAI_API_KEY"));
310
311        // Random var should NOT be present (not in preserved list)
312        assert!(!sanitized.contains_key("RANDOM_VAR"));
313
314        // Sandbox markers should be set
315        assert_eq!(sanitized.get(VTCODE_SANDBOX_ACTIVE), Some(&"1".to_string()));
316        assert_eq!(sanitized.get(VTCODE_SANDBOX_NETWORK_DISABLED), Some(&"1".to_string()));
317        assert_eq!(sanitized.get(VTCODE_SANDBOX_TYPE), Some(&"MacosSeatbelt".to_string()));
318    }
319
320    #[test]
321    fn preserves_full_xdg_and_vtcode_path_environment_without_secrets() {
322        let mut current = HashMap::new();
323        for (key, value) in [
324            ("XDG_STATE_HOME", "/state"),
325            ("XDG_CONFIG_DIRS", "/etc/xdg:/opt/xdg"),
326            ("XDG_DATA_DIRS", "/usr/local/share:/usr/share"),
327            ("XDG_BIN_HOME", "/home/user/bin"),
328            ("VTCODE_CONFIG", "/config"),
329            ("VTCODE_CONFIG_PATH", "/config/explicit.toml"),
330            ("VTCODE_DATA", "/data"),
331            ("VTCODE_HOME", "/legacy"),
332            ("CODEX_HOME", "/codex"),
333            ("OPENAI_API_KEY", TEST_API_KEY_VALUE),
334            ("DATABASE_PASSWORD", "do-not-copy"),
335        ] {
336            drop(current.insert(key.to_string(), value.to_string()));
337        }
338
339        let sanitized = build_sanitized_env(&current, false, false, "test", &[]);
340
341        for (key, value) in [
342            ("XDG_STATE_HOME", "/state"),
343            ("XDG_CONFIG_DIRS", "/etc/xdg:/opt/xdg"),
344            ("XDG_DATA_DIRS", "/usr/local/share:/usr/share"),
345            ("XDG_BIN_HOME", "/home/user/bin"),
346            ("VTCODE_CONFIG", "/config"),
347            ("VTCODE_CONFIG_PATH", "/config/explicit.toml"),
348            ("VTCODE_DATA", "/data"),
349            ("VTCODE_HOME", "/legacy"),
350            ("CODEX_HOME", "/codex"),
351        ] {
352            assert_eq!(sanitized.get(key), Some(&value.to_string()), "missing {key}");
353        }
354        assert!(!sanitized.contains_key("OPENAI_API_KEY"));
355        assert!(!sanitized.contains_key("DATABASE_PASSWORD"));
356    }
357
358    #[test]
359    fn test_filter_sensitive_env() {
360        let mut env = HashMap::new();
361        drop(env.insert("PATH".to_string(), "/usr/bin".to_string()));
362        drop(env.insert("OPENAI_API_KEY".to_string(), TEST_API_KEY_VALUE.to_string()));
363        drop(env.insert("MY_VAR".to_string(), "value".to_string()));
364        drop(env.insert("AWS_ACCESS_KEY_ID".to_string(), "AKIA...".to_string()));
365        drop(env.insert("CUSTOM_PASS".to_string(), "let-me-in".to_string()));
366        drop(env.insert("SERVICE_PWD".to_string(), "super-secret".to_string()));
367
368        let filtered = filter_sensitive_env(&env);
369
370        assert!(filtered.contains_key("PATH"));
371        assert!(filtered.contains_key("MY_VAR"));
372        assert!(!filtered.contains_key("OPENAI_API_KEY"));
373        assert!(!filtered.contains_key("AWS_ACCESS_KEY_ID"));
374        assert!(!filtered.contains_key("CUSTOM_PASS"));
375        assert!(!filtered.contains_key("SERVICE_PWD"));
376    }
377
378    #[test]
379    fn filters_adversarial_credential_and_loader_names() {
380        let mut env = HashMap::new();
381        for (name, value) in [
382            ("MODEL_API_KEY", "model-secret"),
383            ("META_API_KEY", "meta-secret"),
384            ("INSTRUCTION_SECRET", "prompt-secret"),
385            ("AWS_PROFILE", "production"),
386            ("LD_AUDIT", "audit.so"),
387            ("DYLD_LIBRARY_PATH", "/tmp/injected"),
388            ("SAFE_PROJECT_NAME", "vtcode"),
389        ] {
390            drop(env.insert(name.to_string(), value.to_string()));
391        }
392
393        let filtered = filter_sensitive_env(&env);
394        let rebuilt = build_sanitized_env(&env, true, false, "test", &[]);
395
396        for sensitive in [
397            "MODEL_API_KEY",
398            "META_API_KEY",
399            "INSTRUCTION_SECRET",
400            "AWS_PROFILE",
401            "LD_AUDIT",
402            "DYLD_LIBRARY_PATH",
403        ] {
404            assert!(!filtered.contains_key(sensitive), "sensitive variable survived filtering: {sensitive}");
405            assert!(!rebuilt.contains_key(sensitive), "sensitive variable survived rebuilding: {sensitive}");
406        }
407        assert_eq!(filtered.get("SAFE_PROJECT_NAME"), Some(&"vtcode".to_string()));
408    }
409}
vtcode_safety/sandboxing/child_spawn.rs

vtcode_safety/sandboxing/
child_spawn.rs
