vtcode_safety/sandboxing/
child_spawn.rs

1//! Child process spawning with sandbox-aware environment handling.
2//!
3//! Implements patterns from the Codex sandbox model:
4//! - Environment variable sanitization (remove sensitive vars)
5//! - Parent death signal (PR_SET_PDEATHSIG on Linux)
6//! - Sandbox identification markers for downstream tools
7
8use hashbrown::HashMap;
9use std::path::Path;
10
11/// Environment variables that should be filtered from sandboxed processes.
12///
13/// Following the field guide: "Completely clear the environment and rebuild it
14/// with only the variables you actually want."
15pub const FILTERED_ENV_VARS: &[&str] = &[
16    // API keys and tokens
17    "OPENAI_API_KEY",
18    "ANTHROPIC_API_KEY",
19    "GEMINI_API_KEY",
20    "XAI_API_KEY",
21    "DEEPSEEK_API_KEY",
22    "META_API_KEY",
23    "MODEL_API_KEY",
24    "OPENROUTER_API_KEY",
25    "GROQ_API_KEY",
26    "MISTRAL_API_KEY",
27    "COHERE_API_KEY",
28    "AZURE_OPENAI_API_KEY",
29    "HUGGINGFACE_API_KEY",
30    "HF_TOKEN",
31    // Cloud provider credentials
32    "AWS_ACCESS_KEY_ID",
33    "AWS_SECRET_ACCESS_KEY",
34    "AWS_SESSION_TOKEN",
35    "GOOGLE_APPLICATION_CREDENTIALS",
36    "GOOGLE_CLOUD_PROJECT",
37    "AZURE_CLIENT_ID",
38    "AZURE_CLIENT_SECRET",
39    "AZURE_TENANT_ID",
40    "AZURE_SUBSCRIPTION_ID",
41    // GitHub tokens
42    "GITHUB_TOKEN",
43    "GH_TOKEN",
44    "GITHUB_PAT",
45    // NPM/Package registry tokens
46    "NPM_TOKEN",
47    "NPM_AUTH_TOKEN",
48    "CARGO_REGISTRY_TOKEN",
49    "PYPI_TOKEN",
50    // Database credentials
51    "DATABASE_URL",
52    "DB_PASSWORD",
53    "PGPASSWORD",
54    "MYSQL_PWD",
55    "REDIS_PASSWORD",
56    "MONGO_PASSWORD",
57    // SSH/GPG
58    "SSH_AUTH_SOCK",
59    "GPG_AGENT_INFO",
60    // Dynamic linker vars (security risk)
61    "LD_PRELOAD",
62    "LD_LIBRARY_PATH",
63    "LD_AUDIT",
64    "LD_DEBUG",
65    "LD_PROFILE",
66    "DYLD_INSERT_LIBRARIES",
67    "DYLD_LIBRARY_PATH",
68    "DYLD_FRAMEWORK_PATH",
69    "DYLD_FALLBACK_LIBRARY_PATH",
70    // Other sensitive vars
71    "VAULT_TOKEN",
72    "CONSUL_HTTP_TOKEN",
73    "DOCKER_AUTH_CONFIG",
74    "KUBECONFIG",
75    "KUBE_TOKEN",
76    "SLACK_TOKEN",
77    "SLACK_BOT_TOKEN",
78    "DISCORD_TOKEN",
79    "TELEGRAM_BOT_TOKEN",
80];
81
82/// Environment variables that should always be preserved.
83pub const PRESERVED_ENV_VARS: &[&str] = &[
84    // Basic shell environment
85    "PATH",
86    "SystemRoot",
87    "SYSTEMROOT",
88    "WINDIR",
89    "COMSPEC",
90    "PATHEXT",
91    "USERPROFILE",
92    "HOME",
93    "USER",
94    "SHELL",
95    "TERM",
96    "LANG",
97    "LC_ALL",
98    "LC_CTYPE",
99    "TZ",
100    // XDG directories
101    "XDG_CONFIG_HOME",
102    "XDG_CONFIG_DIRS",
103    "XDG_DATA_HOME",
104    "XDG_DATA_DIRS",
105    "XDG_BIN_HOME",
106    "XDG_STATE_HOME",
107    "XDG_CACHE_HOME",
108    "XDG_RUNTIME_DIR",
109    // VT Code path overrides
110    "VTCODE_CONFIG",
111    "VTCODE_CONFIG_PATH",
112    "VTCODE_DATA",
113    "VTCODE_HOME",
114    // External Codex compatibility root
115    "CODEX_HOME",
116    // Editor preferences (not sensitive)
117    "EDITOR",
118    "VISUAL",
119    "PAGER",
120    "GIT_PAGER",
121    "LESS",
122    "COLUMNS",
123    "LINES",
124    "WORKSPACE_DIR",
125    "CLICOLOR",
126    "CLICOLOR_FORCE",
127    "LS_COLORS",
128    "CARGO_TERM_COLOR",
129    // Build tool paths
130    "CARGO_HOME",
131    "RUSTUP_HOME",
132    "GOPATH",
133    "GOROOT",
134    "JAVA_HOME",
135    "PYTHON",
136    // Terminal capabilities
137    "COLORTERM",
138    "FORCE_COLOR",
139    "NO_COLOR",
140    "CLICOLOR",
141    "CLICOLOR_FORCE",
142    // Temp directories
143    "TMPDIR",
144    "TEMP",
145    "TMP",
146];
147
148/// Sandbox environment markers set for child processes.
149pub const VTCODE_SANDBOX_ACTIVE: &str = "VTCODE_SANDBOX_ACTIVE";
150pub const VTCODE_SANDBOX_NETWORK_DISABLED: &str = "VTCODE_SANDBOX_NETWORK_DISABLED";
151pub const VTCODE_SANDBOX_TYPE: &str = "VTCODE_SANDBOX_TYPE";
152pub const VTCODE_SANDBOX_WRITABLE_ROOTS: &str = "VTCODE_SANDBOX_WRITABLE_ROOTS";
153
154/// Build a sanitized environment for sandboxed child processes.
155///
156/// Implements the Codex pattern: "Completely clear the environment and rebuild it
157/// with only the variables you actually want."
158#[expect(
159    unused_results,
160    reason = "Environment construction intentionally ignores prior values while writing the sanitized snapshot."
161)]
162pub fn build_sanitized_env(
163    current_env: &HashMap<String, String>,
164    sandbox_active: bool,
165    network_disabled: bool,
166    sandbox_type: &str,
167    writable_roots: &[&Path],
168) -> HashMap<String, String> {
169    let mut sanitized = HashMap::new();
170
171    // Copy only preserved environment variables
172    for key in PRESERVED_ENV_VARS {
173        let value = current_env.get(*key).or_else(|| {
174            cfg!(windows)
175                .then(|| current_env.iter().find(|(name, _)| name.eq_ignore_ascii_case(key)))
176                .flatten()
177                .map(|(_, value)| value)
178        });
179        if let Some(value) = value {
180            sanitized.insert(key.to_string(), value.clone());
181        }
182    }
183
184    // Add sandbox markers so downstream tools know what's happening
185    if sandbox_active {
186        sanitized.insert(VTCODE_SANDBOX_ACTIVE.to_string(), "1".to_string());
187        sanitized.insert(VTCODE_SANDBOX_TYPE.to_string(), sandbox_type.to_string());
188
189        if network_disabled {
190            sanitized.insert(VTCODE_SANDBOX_NETWORK_DISABLED.to_string(), "1".to_string());
191        }
192
193        if !writable_roots.is_empty() {
194            let roots: Vec<String> = writable_roots.iter().map(|p| p.display().to_string()).collect();
195            sanitized.insert(VTCODE_SANDBOX_WRITABLE_ROOTS.to_string(), roots.join(":"));
196        }
197    }
198
199    sanitized
200}
201
202/// Check if an environment variable should be filtered.
203pub fn should_filter_env_var(key: &str) -> bool {
204    let key = key.to_ascii_uppercase();
205    FILTERED_ENV_VARS.contains(&key.as_str())
206        || key.starts_with("AWS_")
207        || key.starts_with("AZURE_")
208        || key.starts_with("GOOGLE_")
209        || key.starts_with("GCP_")
210        || key.starts_with("CLOUDSDK_")
211        || key.starts_with("LD_")
212        || key.starts_with("DYLD_")
213        || matches!(key.as_str(), "TOKEN" | "SECRET" | "PASSWORD" | "PASS" | "PWD" | "CREDENTIALS")
214        || key.ends_with("_TOKEN")
215        || key.ends_with("_KEY")
216        || key.ends_with("_SECRET")
217        || key.ends_with("_PASS")
218        || key.ends_with("_PWD")
219        || key.ends_with("_PASSWORD")
220        || key.ends_with("_CREDENTIALS")
221}
222
223/// Filter sensitive environment variables from an existing map.
224///
225/// Less aggressive than `build_sanitized_env` - preserves most vars but removes known sensitive ones.
226pub fn filter_sensitive_env(env: &HashMap<String, String>) -> HashMap<String, String> {
227    env.iter()
228        .filter(|(k, _)| !should_filter_env_var(k))
229        .map(|(k, v)| (k.clone(), v.clone()))
230        .collect()
231}
232
233/// Set up parent death signal on Linux.
234///
235/// "Ensures sandboxed children die if the main process gets killed -
236/// you don't want orphaned processes running around."
237///
238/// Uses SIGTERM for graceful shutdown. Includes parent PID check to avoid
239/// race condition where parent exits between fork and exec.
240#[cfg(target_os = "linux")]
241pub fn setup_parent_death_signal() -> std::io::Result<()> {
242    setup_parent_death_signal_with_check(nix::unistd::getppid())
243}
244
245/// Set up parent death signal with explicit parent PID check.
246///
247/// This variant should be used in pre_exec hooks where the parent PID
248/// is captured before spawn to avoid race conditions.
249#[cfg(target_os = "linux")]
250pub fn setup_parent_death_signal_with_check(expected_parent_pid: nix::unistd::Pid) -> std::io::Result<()> {
251    use nix::sys::prctl;
252    use nix::sys::signal::{Signal, raise};
253    use std::io::Error;
254
255    // Use SIGTERM for graceful shutdown (allows cleanup handlers to run)
256    prctl::set_pdeathsig(Some(Signal::SIGTERM))
257        .map_err(|e| Error::other(format!("prctl(PR_SET_PDEATHSIG) failed: {e}")))?;
258
259    // Re-check parent PID to catch race condition where parent exited between
260    // fork and this prctl call. If parent changed, self-terminate immediately.
261    // Signal delivery here is deliberately best-effort: nothing can recover it.
262    #[allow(
263        clippy::let_underscore_must_use,
264        reason = "best-effort self-signal during pdeathsig race"
265    )]
266    if nix::unistd::getppid() != expected_parent_pid {
267        let _ = raise(Signal::SIGTERM);
268    }
269
270    Ok(())
271}
272
273#[cfg(not(target_os = "linux"))]
274pub fn setup_parent_death_signal() -> std::io::Result<()> {
275    Ok(())
276}
277
278#[cfg(test)]
279mod tests {
280    use super::*;
281
282    const TEST_API_KEY_VALUE: &str = "test-openai-key";
283
284    #[test]
285    fn test_should_filter_sensitive_vars() {
286        assert!(should_filter_env_var("OPENAI_API_KEY"));
287        assert!(should_filter_env_var("META_API_KEY"));
288        assert!(should_filter_env_var("AWS_SECRET_ACCESS_KEY"));
289        assert!(should_filter_env_var("GITHUB_TOKEN"));
290        assert!(should_filter_env_var("LD_PRELOAD"));
291        assert!(should_filter_env_var("DYLD_INSERT_LIBRARIES"));
292        assert!(should_filter_env_var("MY_CUSTOM_TOKEN"));
293        assert!(should_filter_env_var("token"));
294        assert!(should_filter_env_var("CloudSDK_AUTH_CREDENTIAL_FILE_OVERRIDE"));
295        assert!(should_filter_env_var("MY_CUSTOM_PASS"));
296        assert!(should_filter_env_var("MYSQL_PWD"));
297        assert!(should_filter_env_var("DATABASE_PASSWORD"));
298
299        assert!(!should_filter_env_var("PATH"));
300        assert!(!should_filter_env_var("HOME"));
301        assert!(!should_filter_env_var("TERM"));
302    }
303
304    #[test]
305    fn filters_sensitive_names_case_insensitively() {
306        assert!(should_filter_env_var("openai_api_key"));
307        assert!(should_filter_env_var("Aws_SECRET_ACCESS_KEY"));
308        assert!(should_filter_env_var("custom_access_token"));
309        assert!(should_filter_env_var("dyld_insert_libraries"));
310        assert!(!should_filter_env_var("PROJECT_NAME"));
311    }
312
313    #[test]
314    fn test_build_sanitized_env() {
315        let mut current = HashMap::new();
316        drop(current.insert("PATH".to_string(), "/usr/bin".to_string()));
317        drop(current.insert("HOME".to_string(), "/home/user".to_string()));
318        drop(current.insert("OPENAI_API_KEY".to_string(), TEST_API_KEY_VALUE.to_string()));
319        drop(current.insert("RANDOM_VAR".to_string(), "value".to_string()));
320
321        let sanitized = build_sanitized_env(&current, true, true, "MacosSeatbelt", &[]);
322
323        // PATH and HOME should be preserved
324        assert_eq!(sanitized.get("PATH"), Some(&"/usr/bin".to_string()));
325        assert_eq!(sanitized.get("HOME"), Some(&"/home/user".to_string()));
326
327        // API key should NOT be present (not in preserved list)
328        assert!(!sanitized.contains_key("OPENAI_API_KEY"));
329
330        // Random var should NOT be present (not in preserved list)
331        assert!(!sanitized.contains_key("RANDOM_VAR"));
332
333        // Sandbox markers should be set
334        assert_eq!(sanitized.get(VTCODE_SANDBOX_ACTIVE), Some(&"1".to_string()));
335        assert_eq!(sanitized.get(VTCODE_SANDBOX_NETWORK_DISABLED), Some(&"1".to_string()));
336        assert_eq!(sanitized.get(VTCODE_SANDBOX_TYPE), Some(&"MacosSeatbelt".to_string()));
337    }
338
339    #[test]
340    fn preserves_full_xdg_and_vtcode_path_environment_without_secrets() {
341        let mut current = HashMap::new();
342        for (key, value) in [
343            ("XDG_STATE_HOME", "/state"),
344            ("XDG_CONFIG_DIRS", "/etc/xdg:/opt/xdg"),
345            ("XDG_DATA_DIRS", "/usr/local/share:/usr/share"),
346            ("XDG_BIN_HOME", "/home/user/bin"),
347            ("VTCODE_CONFIG", "/config"),
348            ("VTCODE_CONFIG_PATH", "/config/explicit.toml"),
349            ("VTCODE_DATA", "/data"),
350            ("VTCODE_HOME", "/legacy"),
351            ("CODEX_HOME", "/codex"),
352            ("OPENAI_API_KEY", TEST_API_KEY_VALUE),
353            ("DATABASE_PASSWORD", "do-not-copy"),
354        ] {
355            drop(current.insert(key.to_string(), value.to_string()));
356        }
357
358        let sanitized = build_sanitized_env(&current, false, false, "test", &[]);
359
360        for (key, value) in [
361            ("XDG_STATE_HOME", "/state"),
362            ("XDG_CONFIG_DIRS", "/etc/xdg:/opt/xdg"),
363            ("XDG_DATA_DIRS", "/usr/local/share:/usr/share"),
364            ("XDG_BIN_HOME", "/home/user/bin"),
365            ("VTCODE_CONFIG", "/config"),
366            ("VTCODE_CONFIG_PATH", "/config/explicit.toml"),
367            ("VTCODE_DATA", "/data"),
368            ("VTCODE_HOME", "/legacy"),
369            ("CODEX_HOME", "/codex"),
370        ] {
371            assert_eq!(sanitized.get(key), Some(&value.to_string()), "missing {key}");
372        }
373        assert!(!sanitized.contains_key("OPENAI_API_KEY"));
374        assert!(!sanitized.contains_key("DATABASE_PASSWORD"));
375    }
376
377    #[test]
378    fn test_filter_sensitive_env() {
379        let mut env = HashMap::new();
380        drop(env.insert("PATH".to_string(), "/usr/bin".to_string()));
381        drop(env.insert("OPENAI_API_KEY".to_string(), TEST_API_KEY_VALUE.to_string()));
382        drop(env.insert("MY_VAR".to_string(), "value".to_string()));
383        drop(env.insert("AWS_ACCESS_KEY_ID".to_string(), "AKIA...".to_string()));
384        drop(env.insert("CUSTOM_PASS".to_string(), "let-me-in".to_string()));
385        drop(env.insert("SERVICE_PWD".to_string(), "super-secret".to_string()));
386
387        let filtered = filter_sensitive_env(&env);
388
389        assert!(filtered.contains_key("PATH"));
390        assert!(filtered.contains_key("MY_VAR"));
391        assert!(!filtered.contains_key("OPENAI_API_KEY"));
392        assert!(!filtered.contains_key("AWS_ACCESS_KEY_ID"));
393        assert!(!filtered.contains_key("CUSTOM_PASS"));
394        assert!(!filtered.contains_key("SERVICE_PWD"));
395    }
396
397    #[test]
398    fn filters_adversarial_credential_and_loader_names() {
399        let mut env = HashMap::new();
400        for (name, value) in [
401            ("MODEL_API_KEY", "model-secret"),
402            ("META_API_KEY", "meta-secret"),
403            ("INSTRUCTION_SECRET", "prompt-secret"),
404            ("AWS_PROFILE", "production"),
405            ("LD_AUDIT", "audit.so"),
406            ("DYLD_LIBRARY_PATH", "/tmp/injected"),
407            ("SAFE_PROJECT_NAME", "vtcode"),
408        ] {
409            drop(env.insert(name.to_string(), value.to_string()));
410        }
411
412        let filtered = filter_sensitive_env(&env);
413        let rebuilt = build_sanitized_env(&env, true, false, "test", &[]);
414
415        for sensitive in [
416            "MODEL_API_KEY",
417            "META_API_KEY",
418            "INSTRUCTION_SECRET",
419            "AWS_PROFILE",
420            "LD_AUDIT",
421            "DYLD_LIBRARY_PATH",
422        ] {
423            assert!(!filtered.contains_key(sensitive), "sensitive variable survived filtering: {sensitive}");
424            assert!(!rebuilt.contains_key(sensitive), "sensitive variable survived rebuilding: {sensitive}");
425        }
426        assert_eq!(filtered.get("SAFE_PROJECT_NAME"), Some(&"vtcode".to_string()));
427    }
428}
vtcode_safety/sandboxing/child_spawn.rs

vtcode_safety/sandboxing/
child_spawn.rs
