packages feed

gargamelle-sandbox (empty) → 0.1.0.0

raw patch · 7 files changed

+718/−0 lines, 7 filesdep +basedep +directorydep +filepath

Dependencies added: base, directory, filepath, gargamelle-core, gargamelle-sandbox, hspec, polytropos-core, process, text

Files

+ CHANGELOG.md view
@@ -0,0 +1,7 @@+# Changelog for gargamelle-sandbox++## 0.1.0.0 — Initial Release++- Bubblewrap namespace sandboxing and resource limit enforcement.+- Isolated filesystem views and network unsharing.+- Fallback subprocess execution runners.
+ LICENSE view
@@ -0,0 +1,189 @@+EUROPEAN UNION PUBLIC LICENCE v. 1.2+EUPL © the European Union 2007, 2016++This European Union Public Licence (the ‘EUPL’) applies to the Work (as defined below) which is provided under the+terms of this Licence. Any use of the Work, other than as authorised under this Licence is prohibited (to the extent such+use is covered by a right of the copyright holder of the Work).+The Work is provided under the terms of this Licence when the Licensor (as defined below) has placed the following+notice immediately following the copyright notice for the Work:+                          Licensed under the EUPL+or has expressed by any other means his willingness to license under the EUPL.++1.Definitions+In this Licence, the following terms have the following meaning:+— ‘The Licence’:this Licence.+— ‘The Original Work’:the work or software distributed or communicated by the Licensor under this Licence, available+as Source Code and also as Executable Code as the case may be.+— ‘Derivative Works’:the works or software that could be created by the Licensee, based upon the Original Work or+modifications thereof. This Licence does not define the extent of modification or dependence on the Original Work+required in order to classify a work as a Derivative Work; this extent is determined by copyright law applicable in+the country mentioned in Article 15.+— ‘The Work’:the Original Work or its Derivative Works.+— ‘The Source Code’:the human-readable form of the Work which is the most convenient for people to study and+modify.+— ‘The Executable Code’:any code which has generally been compiled and which is meant to be interpreted by+a computer as a program.+— ‘The Licensor’:the natural or legal person that distributes or communicates the Work under the Licence.+— ‘Contributor(s)’:any natural or legal person who modifies the Work under the Licence, or otherwise contributes to+the creation of a Derivative Work.+— ‘The Licensee’ or ‘You’:any natural or legal person who makes any usage of the Work under the terms of the+Licence.+— ‘Distribution’ or ‘Communication’:any act of selling, giving, lending, renting, distributing, communicating,+transmitting, or otherwise making available, online or offline, copies of the Work or providing access to its essential+functionalities at the disposal of any other natural or legal person.++2.Scope of the rights granted by the Licence+The Licensor hereby grants You a worldwide, royalty-free, non-exclusive, sublicensable licence to do the following, for+the duration of copyright vested in the Original Work:+— use the Work in any circumstance and for all usage,+— reproduce the Work,+— modify the Work, and make Derivative Works based upon the Work,+— communicate to the public, including the right to make available or display the Work or copies thereof to the public+and perform publicly, as the case may be, the Work,+— distribute the Work or copies thereof,+— lend and rent the Work or copies thereof,+— sublicense rights in the Work or copies thereof.+Those rights can be exercised on any media, supports and formats, whether now known or later invented, as far as the+applicable law permits so.+In the countries where moral rights apply, the Licensor waives his right to exercise his moral right to the extent allowed+by law in order to make effective the licence of the economic rights here above listed.+The Licensor grants to the Licensee royalty-free, non-exclusive usage rights to any patents held by the Licensor, to the+extent necessary to make use of the rights granted on the Work under this Licence.++3.Communication of the Source Code+The Licensor may provide the Work either in its Source Code form, or as Executable Code. If the Work is provided as+Executable Code, the Licensor provides in addition a machine-readable copy of the Source Code of the Work along with+each copy of the Work that the Licensor distributes or indicates, in a notice following the copyright notice attached to+the Work, a repository where the Source Code is easily and freely accessible for as long as the Licensor continues to+distribute or communicate the Work.++4.Limitations on copyright+Nothing in this Licence is intended to deprive the Licensee of the benefits from any exception or limitation to the+exclusive rights of the rights owners in the Work, of the exhaustion of those rights or of other applicable limitations+thereto.++5.Obligations of the Licensee+The grant of the rights mentioned above is subject to some restrictions and obligations imposed on the Licensee. Those+obligations are the following:++Attribution right: The Licensee shall keep intact all copyright, patent or trademarks notices and all notices that refer to+the Licence and to the disclaimer of warranties. The Licensee must include a copy of such notices and a copy of the+Licence with every copy of the Work he/she distributes or communicates. The Licensee must cause any Derivative Work+to carry prominent notices stating that the Work has been modified and the date of modification.++Copyleft clause: If the Licensee distributes or communicates copies of the Original Works or Derivative Works, this+Distribution or Communication will be done under the terms of this Licence or of a later version of this Licence unless+the Original Work is expressly distributed only under this version of the Licence — for example by communicating+‘EUPL v. 1.2 only’. The Licensee (becoming Licensor) cannot offer or impose any additional terms or conditions on the+Work or Derivative Work that alter or restrict the terms of the Licence.++Compatibility clause: If the Licensee Distributes or Communicates Derivative Works or copies thereof based upon both+the Work and another work licensed under a Compatible Licence, this Distribution or Communication can be done+under the terms of this Compatible Licence. For the sake of this clause, ‘Compatible Licence’ refers to the licences listed+in the appendix attached to this Licence. Should the Licensee's obligations under the Compatible Licence conflict with+his/her obligations under this Licence, the obligations of the Compatible Licence shall prevail.++Provision of Source Code: When distributing or communicating copies of the Work, the Licensee will provide+a machine-readable copy of the Source Code or indicate a repository where this Source will be easily and freely available+for as long as the Licensee continues to distribute or communicate the Work.+Legal Protection: This Licence does not grant permission to use the trade names, trademarks, service marks, or names+of the Licensor, except as required for reasonable and customary use in describing the origin of the Work and+reproducing the content of the copyright notice.++6.Chain of Authorship+The original Licensor warrants that the copyright in the Original Work granted hereunder is owned by him/her or+licensed to him/her and that he/she has the power and authority to grant the Licence.+Each Contributor warrants that the copyright in the modifications he/she brings to the Work are owned by him/her or+licensed to him/her and that he/she has the power and authority to grant the Licence.+Each time You accept the Licence, the original Licensor and subsequent Contributors grant You a licence to their contributions+to the Work, under the terms of this Licence.++7.Disclaimer of Warranty+The Work is a work in progress, which is continuously improved by numerous Contributors. It is not a finished work+and may therefore contain defects or ‘bugs’ inherent to this type of development.+For the above reason, the Work is provided under the Licence on an ‘as is’ basis and without warranties of any kind+concerning the Work, including without limitation merchantability, fitness for a particular purpose, absence of defects or+errors, accuracy, non-infringement of intellectual property rights other than copyright as stated in Article 6 of this+Licence.+This disclaimer of warranty is an essential part of the Licence and a condition for the grant of any rights to the Work.++8.Disclaimer of Liability+Except in the cases of wilful misconduct or damages directly caused to natural persons, the Licensor will in no event be+liable for any direct or indirect, material or moral, damages of any kind, arising out of the Licence or of the use of the+Work, including without limitation, damages for loss of goodwill, work stoppage, computer failure or malfunction, loss+of data or any commercial damage, even if the Licensor has been advised of the possibility of such damage. However,+the Licensor will be liable under statutory product liability laws as far such laws apply to the Work.++9.Additional agreements+While distributing the Work, You may choose to conclude an additional agreement, defining obligations or services+consistent with this Licence. However, if accepting obligations, You may act only on your own behalf and on your sole+responsibility, not on behalf of the original Licensor or any other Contributor, and only if You agree to indemnify,+defend, and hold each Contributor harmless for any liability incurred by, or claims asserted against such Contributor by+the fact You have accepted any warranty or additional liability.++10.Acceptance of the Licence+The provisions of this Licence can be accepted by clicking on an icon ‘I agree’ placed under the bottom of a window+displaying the text of this Licence or by affirming consent in any other similar way, in accordance with the rules of+applicable law. Clicking on that icon indicates your clear and irrevocable acceptance of this Licence and all of its terms+and conditions.+Similarly, you irrevocably accept this Licence and all of its terms and conditions by exercising any rights granted to You+by Article 2 of this Licence, such as the use of the Work, the creation by You of a Derivative Work or the Distribution+or Communication by You of the Work or copies thereof.++11.Information to the public+In case of any Distribution or Communication of the Work by means of electronic communication by You (for example,+by offering to download the Work from a remote location) the distribution channel or media (for example, a website)+must at least provide to the public the information requested by the applicable law regarding the Licensor, the Licence+and the way it may be accessible, concluded, stored and reproduced by the Licensee.++12.Termination of the Licence+The Licence and the rights granted hereunder will terminate automatically upon any breach by the Licensee of the terms+of the Licence.+Such a termination will not terminate the licences of any person who has received the Work from the Licensee under+the Licence, provided such persons remain in full compliance with the Licence.++13.Miscellaneous+Without prejudice of Article 9 above, the Licence represents the complete agreement between the Parties as to the+Work.+If any provision of the Licence is invalid or unenforceable under applicable law, this will not affect the validity or+enforceability of the Licence as a whole. Such provision will be construed or reformed so as necessary to make it valid+and enforceable.+The European Commission may publish other linguistic versions or new versions of this Licence or updated versions of+the Appendix, so far this is required and reasonable, without reducing the scope of the rights granted by the Licence.+New versions of the Licence will be published with a unique version number.+All linguistic versions of this Licence, approved by the European Commission, have identical value. Parties can take+advantage of the linguistic version of their choice.++14.Jurisdiction+Without prejudice to specific agreement between parties,+— any litigation resulting from the interpretation of this License, arising between the European Union institutions,+bodies, offices or agencies, as a Licensor, and any Licensee, will be subject to the jurisdiction of the Court of Justice+of the European Union, as laid down in article 272 of the Treaty on the Functioning of the European Union,+— any litigation arising between other parties and resulting from the interpretation of this License, will be subject to+the exclusive jurisdiction of the competent court where the Licensor resides or conducts its primary business.++15.Applicable Law+Without prejudice to specific agreement between parties,+— this Licence shall be governed by the law of the European Union Member State where the Licensor has his seat,+resides or has his registered office,+— this licence shall be governed by Belgian law if the Licensor has no seat, residence or registered office inside+a European Union Member State.++Appendix++‘Compatible Licences’ according to Article 5 EUPL are:+— GNU General Public License (GPL) v. 2, v. 3+— GNU Affero General Public License (AGPL) v. 3+— Open Software License (OSL) v. 2.1, v. 3.0+— Eclipse Public License (EPL) v. 1.0+— CeCILL v. 2.0, v. 2.1+— Mozilla Public Licence (MPL) v. 2+— GNU Lesser General Public Licence (LGPL) v. 2.1, v. 3+— Creative Commons Attribution-ShareAlike v. 3.0 Unported (CC BY-SA 3.0) for works other than software+— European Union Public Licence (EUPL) v. 1.1, v. 1.2+— Québec Free and Open-Source Licence — Reciprocity (LiLiQ-R) or Strong Reciprocity (LiLiQ-R+).++The European Commission may update this Appendix to later versions of the above licences without producing+a new version of the EUPL, as long as they provide the rights granted in Article 2 of this Licence and protect the+covered Source Code from exclusive appropriation.+All other changes or additions to this Appendix require the production of a new EUPL version.
+ README.md view
@@ -0,0 +1,150 @@+# `gargamelle-sandbox` — Bubblewrap Linux Container Isolation & Resource Limiting Boundaries++[![Haskell](https://img.shields.io/badge/Language-Haskell2010-purple.svg)](https://haskell.org)+[![License: EUPL-1.2](https://img.shields.io/badge/License-EUPL--1.2-blue.svg)](https://spdx.org/licenses/EUPL-1.2.html)+[![Tier 1 Host Integration](https://img.shields.io/badge/Tier-1%20Substrates%20%26%20Host%20Integration-teal.svg)](../../README.md#architectural-tier-map)++---++## 1. Executive Summary & Problem Framing++Counterexample-Guided Inductive Synthesis (CEGIS), automated program generation, and multi-agent repair routines must execute untrusted, dynamically synthesized candidate programs against target test suites. Executing arbitrary candidate code directly on the host machine presents severe security and operational vulnerabilities:+1. **Host Disk Corruption:** Malicious or buggy candidates can overwrite repository files, corrupt build caches, or delete user directories.+2. **Process Contamination & Fork Bombs:** Unchecked candidates can spawn background daemons, kill running developer servers, or exhaust operating system PID tables.+3. **Unbounded Latency & Infinite Loops:** Non-terminating synthesis candidates can hang the synthesis pipeline indefinitely.++`gargamelle-sandbox` provides a robust, defense-in-depth isolation boundary:+- **Unprivileged Linux Container Namespaces:** Leverages Bubblewrap (`/usr/bin/bwrap`) to unshare mount, network, PID, IPC, and UTS namespaces without requiring root permissions or `setuid` binaries.+- **Strict Read-Only Host Filesystems:** Mounts `/` read-only (`--ro-bind / /`), providing candidate binaries access to necessary system libraries while strictly preventing modifications.+- **Ephemeral Writable Sandboxes:** Automatically scopes writable file operations to bracketed temporary directories (`withTempSandboxDir`), guaranteeing cleanup on exit.+- **Deterministic Resource Bounds:** Wraps execution in `/usr/bin/timeout` to enforce timeout and memory constraints deterministically.++---++## 2. Mathematical Foundations & Theoretical Invariants++### 2.1 The Bubblewrap Namespace Isolation Boundary+Bubblewrap establishes an unprivileged Linux container sandbox around the candidate process:++```+┌─────────────────────────────────────────────────────────────┐+│                      Host Linux OS                          │+│                                                             │+│   ┌─────────────────────────────────────────────────────┐   │+│   │        Bubblewrap Namespace Sandbox (bwrap)         │   │+│   │                                                     │   │+│   │  - Mount Namespace:                                 │   │+│   │      /         -> Read-Only Bind (--ro-bind / /)    │   │+│   │      /dev      -> Hermetic Devfs (--dev /dev)       │   │+│   │      /proc     -> Fresh Procfs (--proc /proc)       │   │+│   │      /tmp      -> In-Memory Tmpfs (--tmpfs /tmp)    │   │+│   │      workDir   -> Isolated Writable Bind            │   │+│   │  - PID / IPC / UTS / Net Namespaces: Private        │   │+│   │  - Lifetime: Bound to parent (--die-with-parent)    │   │+│   │                                                     │   │+│   │        ┌───────────────────────────────────┐        │   │+│   │        │   Synthesized Candidate Process   │        │   │+│   │        └───────────────────────────────────┘        │   │+│   └─────────────────────────────────────────────────────┘   │+└─────────────────────────────────────────────────────────────┘+```++1. **Physical Containment:** By mounting `/proc` anew within a private PID namespace, candidate processes cannot inspect, enumerate, or signal host processes.+2. **Hermetic File Mutations:** All scratch file creation occurs inside ephemeral directories or tmpfs mounts; no changes persist to the host.+3. **Guaranteed Cleanup:** `--die-with-parent` ensures the kernel sends `SIGKILL` to child processes if the parent Haskell runtime terminates abruptly.++<!-- See Note [Bubblewrap Namespace Isolation and Resource Limiting Boundaries] [ref:note-sandbox-bwrap-isolation] -->++---++## 3. Module Architecture & Repertoire Breadth++The package exports 2 modules providing declarative effects and production container handlers:++| Module | Primary Types & Typeclasses | Architectural Purpose |+| :--- | :--- | :--- |+| [`Sandbox.Effect`](src/Sandbox/Effect.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Effect.html)) | [`ResourceLimits`](src/Sandbox/Effect.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Effect.html#t:ResourceLimits)), [`defaultLimits`](src/Sandbox/Effect.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Effect.html#v:defaultLimits)), [`SandboxOp`](src/Sandbox/Effect.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Effect.html#t:SandboxOp)) | First-class resource limits (timeout seconds, memory MB) and isolated execution AST operations. |+| [`Sandbox.Handler`](src/Sandbox/Handler.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Handler.html)) | [`executeSandboxed`](src/Sandbox/Handler.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Handler.html#v:executeSandboxed)), [`executeBubblewrapSandboxed`](src/Sandbox/Handler.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Handler.html#v:executeBubblewrapSandboxed)), [`withTempSandboxDir`](src/Sandbox/Handler.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Handler.html#v:withTempSandboxDir)), [`pureMockSandboxRun`](src/Sandbox/Handler.hs) ([Hackage](https://hackage.haskell.org/package/gargamelle-sandbox/docs/Sandbox-Handler.html#v:pureMockSandboxRun)) | Production IO handlers executing commands with Bubblewrap isolation, bracketed temp dirs, and test mocks. |++---++## 4. Executable Worked Examples++### 4.1 Running a Command in an Isolated Bubblewrap Sandbox+```haskell+{-# LANGUAGE OverloadedStrings #-}++module ExampleSandbox where++import qualified Data.Text as T+import Sandbox.Effect+import Sandbox.Handler++-- Run candidate binary in an isolated sandbox with custom limits+runCandidate :: FilePath -> [String] -> IO ()+runCandidate bin args = do+  let limits = defaultLimits { limitTimeoutSeconds = 5 }+  res <- withTempSandboxDir "candidate-run" $ \workDir -> do+    (code, stdout, stderr) <- executeBubblewrapSandboxed limits workDir bin args+    if code == 0+      then putStrLn $ "Success: " ++ T.unpack stdout+      else putStrLn $ "Failed (code " ++ show code ++ "): " ++ T.unpack stderr+  case res of+    Right () -> pure ()+    Left err -> putStrLn $ "Sandbox execution error: " ++ T.unpack err+```++### 4.2 Bounded Pure Mock for Unit Tests+```haskell+module ExampleMockSandbox where++import Sandbox.Effect+import Sandbox.Handler++-- Execute deterministic mock without spawning system processes+mockTest :: (Int, String)+mockTest =+  let (code, stdout, _) = pureMockSandboxRun defaultLimits "/bin/test" []+  in (code, show stdout)+```++---++## 5. Integration Points & Subsystem Boundaries++`gargamelle-sandbox` operates at **Tier 1 (Host Integration)** of the architecture:++```+┌────────────────────────────────────────────────────────┐+│               Downstream Consumers                     │+│  - gargamelle-workflow: Grounded CEGIS Execution       │+│  - gargamelle-evidence: Sandboxed Test Run Evidence    │+└──────────────────────────▲─────────────────────────────┘+                           │+                  [gargamelle-sandbox]+                           │+┌──────────────────────────▼─────────────────────────────┐+│               Upstream Substrates                      │+│  - Host OS: /usr/bin/bwrap (Bubblewrap Container)      │+│  - Host OS: /usr/bin/timeout (GNU Coreutils)           │+│  - polytropos-core: Flat Struct Payloads               │+└────────────────────────────────────────────────────────┘+```++---++## 6. Diagnostic & Troubleshooting Guide++### 6.1 Unprivileged User Namespaces Disabled+- **Symptom:** `executeBubblewrapSandboxed` returns error `bwrap: No permissions to create new namespace`.+- **Root Cause:** Some hardened Linux distributions disable unprivileged user namespaces via `sysctl kernel.unprivileged_userns_clone = 0`.+- **Remedy:** Enable unprivileged user namespaces (`sudo sysctl kernel.unprivileged_userns_clone=1`), or install Bubblewrap with setuid bit enabled (`chmod u+s /usr/bin/bwrap`). When disabled, `executeSandboxed` automatically falls back to bounded subprocess execution.++### 6.2 Synthesis Timeout Exceeded+- **Symptom:** `executeSandboxed` returns exit code 124 (GNU timeout standard exit status).+- **Root Cause:** Synthesized program entered an infinite loop or exceeded `limitTimeoutSeconds`.+- **Remedy:** Treat timeout as a non-terminating counterexample witness and feed back to synthesis engine to disallow unbounded recursive structures.++---++*Part of the [Gargamelle Verification Suite](../../README.md).*
+ gargamelle-sandbox.cabal view
@@ -0,0 +1,61 @@+cabal-version: 3.0+name: gargamelle-sandbox+version: 0.1.0.0+synopsis: Bubblewrap namespace sandboxing and resource limit enforcement+description:+  Bubblewrap namespace sandboxing and resource limit enforcement for+  Gargamelle. Provides isolated filesystem views, unshared PID and+  network namespaces, and subprocess fallback execution for safe+  verification.+license: EUPL-1.2+license-file: LICENSE+author: Nadia Yvette Chambers+maintainer: nadia.yvette.chambers@ik.me+category: System+homepage: https://github.com/NadiaYvette/gargamelle+bug-reports: https://github.com/NadiaYvette/gargamelle/issues+extra-doc-files:+  README.md+  CHANGELOG.md+build-type: Simple+tested-with:+  GHC == 9.6.7,+  GHC == 9.8.4,+  GHC == 9.10.3,+  GHC == 9.12.4,+  GHC == 9.14.1++source-repository head+  type: git+  location: https://github.com/NadiaYvette/gargamelle+  subdir: packages/gargamelle-sandbox++library+  exposed-modules:+    Sandbox.Effect+    Sandbox.Handler+  hs-source-dirs: src+  default-language: Haskell2010+  ghc-options: -Wall+  build-depends:+    base >= 4.14 && < 5,+    text >= 2.0 && < 2.2,+    directory >= 1.3 && < 1.4,+    filepath >= 1.4 && < 1.6,+    process >= 1.6 && < 1.7,+    polytropos-core >= 0.1.0.1 && < 0.2,+    gargamelle-core >= 0.1 && < 0.2++test-suite tests+  type: exitcode-stdio-1.0+  main-is: Main.hs+  hs-source-dirs: test+  default-language: Haskell2010+  ghc-options: -Wall+  build-depends:+    base >= 4.14 && < 5,+    gargamelle-sandbox,+    text >= 2.0 && < 2.2,+    directory >= 1.3 && < 1.4,+    filepath >= 1.4 && < 1.6,+    hspec >= 2.10 && < 2.12
+ src/Sandbox/Effect.hs view
@@ -0,0 +1,41 @@+{-# LANGUAGE DataKinds #-}+{-# LANGUAGE GADTs #-}++-- | Milestone M3: Sandboxing Effect Definitions+--+-- Defines first-class resource-bounded sandboxing strands for executing+-- candidate syntheses in isolated environments.+module Sandbox.Effect+  ( ResourceLimits(..)+  , defaultLimits+  , SandboxOp(..)+  ) where++import Data.Text (Text)++-- | Resource limits for isolated sandbox execution.+--+-- Restricts maximum wall-clock execution time and RAM footprint for candidate synthesis runs.+data ResourceLimits = ResourceLimits+  { limitTimeoutSeconds :: Int+    -- ^ Maximum wall-clock seconds before child processes are terminated by @/usr/bin/timeout@.+  , limitMemoryMB       :: Int+    -- ^ Maximum RAM memory budget in megabytes allocated to the sandboxed container.+  } deriving (Show, Eq)++-- | Default conservative limits: 30 seconds timeout, 1024 MB memory.+defaultLimits :: ResourceLimits+defaultLimits = ResourceLimits+  { limitTimeoutSeconds = 30+  , limitMemoryMB       = 1024+  }++-- | Sandboxed process and filesystem isolation operations.+--+-- Expressed as a GADT suitable for Kernmantle Arrow Rope strand embedding.+data SandboxOp a b where+  -- | Run an external command within Bubblewrap container isolation and timeout enforcement,+  -- returning @(exitCode, stdout, stderr)@.+  RunIsolated :: ResourceLimits -> FilePath -> [String] -> SandboxOp () (Int, Text, Text)+  -- | Acquire an ephemeral, isolated temporary directory with guaranteed cleanup upon completion.+  WithIsolatedDir :: Text -> (FilePath -> IO r) -> SandboxOp () (Either Text r)
+ src/Sandbox/Handler.hs view
@@ -0,0 +1,223 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE ScopedTypeVariables #-}++-- | Milestone M3: Sandbox Handlers+--+-- Provides production IO execution with Bubblewrap container isolation,+-- temporary directory bracketing, and pure mock interpreters for hermetic testing.+module Sandbox.Handler+  ( executeSandboxed+  , executeBubblewrapSandboxed+  , withTempSandboxDir+  , pureMockSandboxRun+  ) where++import Control.Exception (bracket, try, SomeException)+import Data.Text (Text)+import qualified Data.Text as T+import System.Directory (createDirectoryIfMissing, doesFileExist, removeDirectoryRecursive)+import System.Exit (ExitCode(..))+import System.FilePath ((</>))+import System.Process (CreateProcess(..), proc, readCreateProcessWithExitCode, readProcessWithExitCode)+import Sandbox.Effect++{- Note [Bubblewrap Namespace Isolation and Resource Limiting Boundaries]+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+[tag:note-sandbox-bwrap-isolation]+In autonomous program synthesis, counterexample-guided inductive synthesis (CEGIS),+and multi-agent refactoring loops, executing untrusted candidate code directly on the host+developer or build machine introduces severe security and operational hazards:+  1. Filesystem Contamination: Errant synthesis candidates or destructive shell commands+     can delete or overwrite repository files, build caches, or system directories.+  2. Ambient Process Interference: Runaway subprocesses or fork bombs can consume all host+     process slots, exhaust file descriptors, or corrupt running compilation servers.+  3. Indefinite Hangs: Unbounded recursive loops or infinite loops in synthesized candidates+     stall the entire synthesis and verification pipeline.++Bubblewrap Container Boundaries & Defense-in-Depth:+Gargamelle resolves these hazards by enforcing unprivileged Linux container isolation:+  - Unprivileged Namespaces ('--unshare-all'): Creates private mount, UTS, IPC, PID, and+    network namespaces without requiring root privileges or setuid binaries.+  - Read-Only Root Filesystem ('--ro-bind / /'): Mounts the host operating system strictly+    read-only, preventing any accidental mutation of host libraries or toolchains.+  - Hermetic System Mounts ('--dev /dev --proc /proc --tmpfs /tmp'): Spawns fresh, isolated+    pseudo-filesystems so candidate processes cannot inspect or signal host processes.+  - Ephemeral Scoped Directory ('--bind workDir workDir --chdir workDir'): Restricts writable+    disk access exclusively to an isolated temporary directory managed via 'withTempSandboxDir'.+  - Lifetime & Resource Enforcement ('--die-with-parent', '/usr/bin/timeout'): Guarantees+    child processes terminate immediately if the parent Haskell runtime dies or exceeds the+    configured 'limitTimeoutSeconds'.+  - Network Namespace & Loopback Isolation Defense ('--unshare-all --share-net'):+    On modern Linux distributions (e.g. Ubuntu 24.04 with kernel AppArmor restrictions on+    unprivileged user namespaces), netlink address assignment ('RTM_NEWADDR') to configure 'lo'+    in private network namespaces is blocked with EPERM ("bwrap: loopback: Failed RTM_NEWADDR").+    When container setup errors occur ("bwrap:" prefix on stderr), execution transparently+    retries with '--share-net'. This retains host network loopback whilst preserving full filesystem,+    PID, IPC, and mount namespace isolation.+  - Graceful Fallback: When '/usr/bin/bwrap' is absent or restricted by host kernel policy,+    'executeSandboxed' gracefully falls back to process execution with timeout and exception bracketing.+-}++-- | Detect whether an exit failure was caused by Bubblewrap container setup itself+-- (e.g. AppArmor unprivileged user namespace or netlink restriction: "bwrap: loopback: Failed RTM_NEWADDR")+-- rather than the candidate process failing inside the sandbox.+isBwrapSetupError :: String -> Bool+isBwrapSetupError errStr = "bwrap:" `T.isInfixOf` T.pack errStr++-- | Production execution of sandboxed commands.+-- Automatically leverages Bubblewrap (/usr/bin/bwrap) and /usr/bin/timeout when present,+-- enforcing physical namespace isolation and resource constraints with transparent+-- '--share-net' fallback when host AppArmor limits unprivileged network namespaces.+--+-- See Note [Bubblewrap Namespace Isolation and Resource Limiting Boundaries] [ref:note-sandbox-bwrap-isolation].+executeSandboxed :: ResourceLimits -> FilePath -> [String] -> IO (Int, Text, Text)+executeSandboxed limits cmd args = do+  hasBwrap <- doesFileExist "/usr/bin/bwrap"+  hasTimeout <- doesFileExist "/usr/bin/timeout"+  let timeoutSecs = show (max 1 (limitTimeoutSeconds limits))+  let runDirect = do+        let (runnerCmd, runnerArgs) =+              if hasTimeout+                then ("/usr/bin/timeout", timeoutSecs : cmd : args)+                else (cmd, args)+        res <- try (readProcessWithExitCode runnerCmd runnerArgs "")+        case res of+          Right (ExitSuccess, stdoutStr, stderrStr) ->+            pure (0, T.pack stdoutStr, T.pack stderrStr)+          Right (ExitFailure code, stdoutStr, stderrStr) ->+            pure (code, T.pack stdoutStr, T.pack stderrStr)+          Left (err :: SomeException) ->+            pure (-1, T.empty, T.pack (show err))++  if not hasBwrap+    then runDirect+    else do+      let runBwrap extraFlags = do+            let bwrapArgs =+                  [ "--ro-bind", "/", "/"+                  , "--dev", "/dev"+                  , "--proc", "/proc"+                  , "--tmpfs", "/tmp"+                  ] ++ extraFlags +++                  [ "--die-with-parent"+                  , "--"+                  , cmd+                  ] ++ args+            let (runnerCmd, runnerArgs) =+                  if hasTimeout+                    then ("/usr/bin/timeout", timeoutSecs : "/usr/bin/bwrap" : bwrapArgs)+                    else ("/usr/bin/bwrap", bwrapArgs)+            (try (readProcessWithExitCode runnerCmd runnerArgs "") :: IO (Either SomeException (ExitCode, String, String)))++      resStrict <- runBwrap ["--unshare-all"]+      case resStrict of+        Right (ExitSuccess, stdoutStr, stderrStr) ->+          pure (0, T.pack stdoutStr, T.pack stderrStr)+        Right (ExitFailure code, stdoutStr, stderrStr)+          | isBwrapSetupError stderrStr -> do+              -- Fallback: retry with --share-net to avoid RTM_NEWADDR EPERM under AppArmor+              resShareNet <- runBwrap ["--unshare-all", "--share-net"]+              case resShareNet of+                Right (ExitSuccess, o, e) ->+                  pure (0, T.pack o, T.pack e)+                Right (ExitFailure c, o, e)+                  | isBwrapSetupError e -> runDirect+                  | otherwise -> pure (c, T.pack o, T.pack e)+                Left _ -> runDirect+          | otherwise ->+              pure (code, T.pack stdoutStr, T.pack stderrStr)+        Left _ -> runDirect++-- | Explicit execution inside an isolated working directory with Bubblewrap writable bind.+-- Automatically handles AppArmor network namespace restrictions via '--share-net'+-- and falls back to timeout-bounded execution if Bubblewrap is unusable on host.+--+-- See Note [Bubblewrap Namespace Isolation and Resource Limiting Boundaries] [ref:note-sandbox-bwrap-isolation].+executeBubblewrapSandboxed :: ResourceLimits -> FilePath -> FilePath -> [String] -> IO (Int, Text, Text)+executeBubblewrapSandboxed limits workDir cmd args = do+  hasBwrap <- doesFileExist "/usr/bin/bwrap"+  hasTimeout <- doesFileExist "/usr/bin/timeout"+  let timeoutSecs = show (max 1 (limitTimeoutSeconds limits))+  let runDirect = do+        let (runnerCmd, runnerArgs) =+              if hasTimeout+                then ("/usr/bin/timeout", timeoutSecs : cmd : args)+                else (cmd, args)+        let cp = (proc runnerCmd runnerArgs) { cwd = Just workDir }+        res <- try (readCreateProcessWithExitCode cp "")+        case res of+          Right (ExitSuccess, stdoutStr, stderrStr) ->+            pure (0, T.pack stdoutStr, T.pack stderrStr)+          Right (ExitFailure code, stdoutStr, stderrStr) ->+            pure (code, T.pack stdoutStr, T.pack stderrStr)+          Left (err :: SomeException) ->+            pure (-1, T.empty, T.pack (show err))++  if not hasBwrap+    then runDirect+    else do+      let runBwrap extraFlags = do+            let bwrapArgs =+                  [ "--ro-bind", "/", "/"+                  , "--dev", "/dev"+                  , "--proc", "/proc"+                  , "--tmpfs", "/tmp"+                  , "--bind", workDir, workDir+                  , "--chdir", workDir+                  ] ++ extraFlags +++                  [ "--die-with-parent"+                  , "--"+                  , cmd+                  ] ++ args+            let (runnerCmd, runnerArgs) =+                  if hasTimeout+                    then ("/usr/bin/timeout", timeoutSecs : "/usr/bin/bwrap" : bwrapArgs)+                    else ("/usr/bin/bwrap", bwrapArgs)+            (try (readProcessWithExitCode runnerCmd runnerArgs "") :: IO (Either SomeException (ExitCode, String, String)))++      resStrict <- runBwrap ["--unshare-all"]+      case resStrict of+        Right (ExitSuccess, stdoutStr, stderrStr) ->+          pure (0, T.pack stdoutStr, T.pack stderrStr)+        Right (ExitFailure code, stdoutStr, stderrStr)+          | isBwrapSetupError stderrStr -> do+              -- Fallback: retry with --share-net to avoid RTM_NEWADDR EPERM under AppArmor+              resShareNet <- runBwrap ["--unshare-all", "--share-net"]+              case resShareNet of+                Right (ExitSuccess, o, e) ->+                  pure (0, T.pack o, T.pack e)+                Right (ExitFailure c, o, e)+                  | isBwrapSetupError e -> runDirect+                  | otherwise -> pure (c, T.pack o, T.pack e)+                Left _ -> runDirect+          | otherwise ->+              pure (code, T.pack stdoutStr, T.pack stderrStr)+        Left _ -> runDirect++-- | Bracketed temporary directory allocation guaranteeing cleanup.+--+-- Safely creates an isolated staging directory under @/tmp/gargamelle-sandbox-<prefix>@,+-- executes the provided callback, and guarantees recursive cleanup even if exceptions occur.+--+-- Parameters:+--   - 'Text': Prefix slug for the directory name.+--   - @(FilePath -> IO r)@: Action to execute with the ephemeral directory path.+withTempSandboxDir :: Text -> (FilePath -> IO r) -> IO (Either Text r)+withTempSandboxDir prefix action = do+  let baseDir = "/tmp" </> ("gargamelle-sandbox-" ++ T.unpack prefix)+  bracket+    (createDirectoryIfMissing True baseDir >> pure baseDir)+    (\dir -> try (removeDirectoryRecursive dir) :: IO (Either SomeException ()))+    (\dir -> do+        res <- try (action dir)+        case res of+          Right val -> pure (Right val)+          Left (err :: SomeException) -> pure (Left (T.pack (show err))))++-- | Deterministic pure mock for sandboxed runs in unit tests and mock interpreters.+--+-- Returns exit code 0, a synthetic stdout payload indicating the executed command+-- and argument count, and empty stderr without invoking OS processes or filesystem calls.+pureMockSandboxRun :: ResourceLimits -> FilePath -> [String] -> (Int, Text, Text)+pureMockSandboxRun _limits cmd args =+  (0, T.pack ("mock-output-for-" ++ cmd ++ "-with-" ++ show (length args) ++ "-args"), T.empty)
+ test/Main.hs view
@@ -0,0 +1,47 @@+{-# LANGUAGE OverloadedStrings #-}+{-# LANGUAGE BlockArguments #-}++module Main (main) where++import Test.Hspec+import Data.IORef (newIORef, readIORef, writeIORef)+import qualified Data.Text as T+import System.Directory (doesDirectoryExist)+import Sandbox.Effect+import Sandbox.Handler++main :: IO ()+main = hspec do+  -- Tested against Note [Bubblewrap Namespace Isolation and Resource Limiting Boundaries] [ref:note-sandbox-bwrap-isolation]+  describe "Bubblewrap & Subprocess Sandbox Isolation" do+    it "configures conservative default resource limits" do+      limitTimeoutSeconds defaultLimits `shouldBe` 30+      limitMemoryMB defaultLimits `shouldBe` 1024++    it "executes deterministic mock sandbox operations" do+      let (code, stdout, stderr) = pureMockSandboxRun defaultLimits "/bin/echo" ["hello"]+      code `shouldBe` 0+      stdout `shouldBe` "mock-output-for-/bin/echo-with-1-args"+      stderr `shouldBe` ""++    it "allocates and reliably cleans up temporary sandbox directories" do+      dirRef <- newIORef ""+      res <- withTempSandboxDir "test-unit" $ \dir -> do+        writeIORef dirRef dir+        doesDirectoryExist dir `shouldReturn` True+        pure (42 :: Int)+      res `shouldBe` Right 42+      dirPath <- readIORef dirRef+      doesDirectoryExist dirPath `shouldReturn` False++    it "executes benign command under sandboxed environment" do+      (code, stdout, _stderr) <- executeSandboxed defaultLimits "echo" ["gargamelle-sandbox-ok"]+      code `shouldBe` 0+      T.strip stdout `shouldBe` "gargamelle-sandbox-ok"++    it "executes command in isolated working directory with Bubblewrap or fallback" do+      res <- withTempSandboxDir "bwrap-unit" $ \workDir -> do+        (code, stdout, _stderr) <- executeBubblewrapSandboxed defaultLimits workDir "echo" ["isolated-ok"]+        code `shouldBe` 0+        pure (T.strip stdout)+      res `shouldBe` Right "isolated-ok"