JjPHUdZddlmZddlZddlZddlZddlZddlZddlm Z ddl m Z m Z ddl mZmZmZdZded <d Zd ed <d Zd ed<GddZdgZy)z9Linux code execution isolated with Bubblewrap namespaces.) annotationsN)Path)AnyFinal)ENV_WORKSPACES_ROOTensure_workspaces_rootresolve_workspacez/etc/resolv.confz Final[str] RESOLVER_PATHi z Final[int]NETWORK_TMPFS_SIZE_BYTESNETWORK_MAX_PROCESSESc eZdZdZdddddddd d d d dd ZeddZeddZdd d d ddZd d ddZ d d ddZ ddZ y )BubblewrapExecutionProvidera Run Python or shell code in an isolated, disposable Linux filesystem. The sandbox gets read-only access to system runtime directories, a private temporary directory, and one writable workspace mount. Network, process, IPC, and other namespaces are unshared. There is deliberately no unsandboxed fallback when Bubblewrap is unavailable or cannot start. ``allow_network`` is the one profile that changes that, and it changes exactly three things: the network namespace is *shared* with the host instead of unshared, the ``/etc/resolv.conf`` of the host is bound read-only so a target named in the engagement can be resolved at all, and the ``/tmp`` tmpfs gets a size ceiling (with the matching ``RLIMIT_NPROC``). Nothing else about the sandbox differs. Every filesystem, PID, IPC and UTS isolation, the read-only ``/usr``, the disposable ``/tmp`` and the single writable workspace bind stay exactly as they are, and the flag is ``False`` by default, so a caller that does not ask for it gets byte-for-byte the argument vector this class has always produced. It is set only from an authenticated engagement profile (see ``execution_plane.secure_gateway.engagement_profile_allows_network``) and only for the pentest role; it is not a general "let code use the internet" switch, and it says nothing about untrusted code - a process in a shared network namespace is still confined by everything else listed here, and still must not be described as safe to run hostile code. The namespace part of that claim is only true because the vector is ``--unshare-all --share-net`` and not ``--share-net``. bwrap applies no unsharing by default, so omitting ``--unshare-all`` silently shares the host's PID namespace too - which is a credential-exfiltration primitive, not a weaker sandbox. The regression test for this is ``test_the_network_profile_keeps_its_own_pid_namespace`` in ``tests/test_execution_provider.py``, which launches bwrap and reads ``/proc/1/comm``; an argv-string assertion cannot catch this class of bug. The writable workspace is **not** an arbitrary host directory. Because the workspace is bind-mounted read-write, a workspace such as ``/root/.ssh`` would undo every other control in this class: read-only ``/usr``, disposable ``/tmp`` and unshared namespaces all keep their value only if the code cannot reach the rest of the host through the one mount it is given. A workspace is therefore confined to the sanctioned root ``/workspaces`` (:func:`~cyberbrain26.product.local_store.workspaces_root`). The default root is the single source of truth for the data directory, so ``CYBERBRAIN_DATA_DIR`` moves it. Deployments that genuinely need another root pass ``workspaces_root`` explicitly or set ``CYBERBRAIN_WORKSPACES_ROOT``; widening the confinement is then the caller's explicit decision, recorded in configuration, never a silent fallback to the old permissive behaviour. bwrapz/usr/bin/python3z /usr/bin/shg>@i i@BNF) bubblewrap_binarypython_executableshell_executablemax_timeout_seconds max_memory_mbmax_cpu_secondsmax_file_size_mbmax_output_bytesworkspaces_root allow_networkc :|dkr td|dks |dks|dkr td|dkr td||_||_||_||_||_||_||_||_| rt| jnd|_ | |_ y)Nrz$max_timeout_seconds must be positivez resource limits must be positivez!max_output_bytes must be positive) ValueErrorrrrrrrrrr expanduser_workspaces_rootr) selfrrrrrrrrrrs V/home/oem/CyberBrain26-unified/src/cyberbrain26/execution_plane/bubblewrap_provider.py__init__z$BubblewrapExecutionProvider.__init__Us ! #CD D A A!59IQ9N?@ @ q @A A!2!2 0#6 *. 0 0FU_ 5 @ @ B[_*cy)N bubblewrap)r!s r" provider_namez)BubblewrapExecutionProvider.provider_nametsr$c6|j|jjStjj t }|E|j r5t|j jjStS)apReturn the directory a writable workspace must live inside. Precedence: the ``workspaces_root`` constructor argument, then the ``CYBERBRAIN_WORKSPACES_ROOT`` environment variable, then the default sanctioned root under the data directory. The default root is created on demand with owner-only permissions so a fresh installation works; an explicitly configured root is only resolved, never created, because it belongs to the caller. The value is resolved per call rather than at construction time so the root always reflects the current environment. ) r resolveosenvirongetrstriprrr)r! env_values r"allowed_workspaces_rootz3BubblewrapExecutionProvider.allowed_workspaces_rootxst  ,((002 2JJNN#67  Y__%6 )*557??A A%''r$)timeout_seconds workspacerc zK|jxs|}|jj}|dvr!|jddg}|j d} n$|dvr|j d|g}d} nt d|d} |[t|jjd } t| |j } | js t d tj|j} | t!d |jdt#t%||j&} | dkr t d| Ht)j*d5} |j-| || t| | |d{cdddS|j-| || | | |d{S7,#1swY*xYw7w)aExecute code and return captured output and process status. ``allow_network`` mirrors the constructor argument for the one caller that decides per call rather than per provider (``AuthorizedExecutionService``, which derives it from the authenticated engagement profile). The two are combined with ``or``, so a call can grant what the constructor granted but never take a grant away: the narrower of the two is always the default, and neither can widen the sandbox on its own. >pypython-I-utf-8>shshell-cNz unsupported execution language: T)strict)rootz'workspace must be an existing directoryzBubblewrap executable z7 is unavailable; refusing to run code without a sandboxrz timeout_seconds must be positivezcyberbrain26-exec-)prefixr)rr.lowerrencoderrrrr*r r0is_dirshutilwhichr RuntimeErrorminfloatrtempfileTemporaryDirectory_run)r!codelanguager2r3rnetwork_allowed language_keycommandstdinworkspace_pathbinarytimeouttemp_dirs r"executez#BubblewrapExecutionProvider.executes&,,= ~~'--/ + +--tS9GKK(E _ ,,,dD9GE?zJK K '+  !)_779AAANN.T%A%AN"((* !JKKd445 >()?)?(BC99 eO,d.F.FG a<?@ @  !,,4HI X!YYGUDNG"1'   YY GUNG)       s<EF;$F->F+?F-$F;&F9'F;+F--F62F;r@c zK|g|rdndddddd}dD]0}t|js|jd||f2|r9ttj r|jdttfdd g} |rd t t dd g} |jd d d dg| dtj|dddddddddd d|j||tj} tj||tjjntjj tjjtjjdd{} | j"J| j$Jtj&|j)| j"} tj&|j)| j$} d} |e| j*J| j*j-|| j*j/d{| j*j1tj2| j5|d{tj<| | d{\\}}\}}|j>|jAdd |jAdd | jB|||tj| z d!S777#t6$r.d}| j9| j5d{7Ytj:$rL| j9| j5d{7tj<| | dd{7wxYw7w)"N) --unshare-allz --share-net)rXz--die-with-parentz --new-sessionz --ro-bindz/usr)z/libz/lib64z--tmpfsz/tmpz--sizez--devz/devz--procz/procz--bindz /workspacez--chdirz --clearenvz--setenvPATHz /usr/bin:/binHOMEz--r@)rQstdoutstderrF)rTT)return_exceptionsr9replace)errors)providerr[r\ return_code timed_outstdout_truncatedstderr_truncatedduration_seconds)"rexistsextendr is_filestrr r+fspath_limited_commandtime monotonicasynciocreate_subprocess_exec subprocessPIPEDEVNULLr[r\ create_task _read_cappedrQwritedrainclosewait_forwait TimeoutErrorkillCancelledErrorgatherr(decode returncode)r!rSrPrQr3rTr bwrap_args runtime_path tmpfs_argsstartedprocess stdout_task stderr_taskrbr[rcr\rds r"rKz BubblewrapExecutionProvider._runs  $!1'' * + , - . / . / ."(/ 2/ MLL!((*!!; l"KL M T-088:   {M=I J"+F 3  #C(@$A9fUJ'   ))I. 1=    (    # %4  # %+  &&wm&L  .."66 -2->'$$))GDVDVD^D^%%**%%**    ~~)))~~)))))$*;*;GNN*KL ))$*;*;GNN*KL    }}000 ##E*mm))+++ ##%""7<<>7C C CHO~~ H B >"!$>V-=**mmGIm>mmGIm>"--" 0 0 $ 07 :  ? , C !I LLN,,. %%  LLN,,. ..kTR R R    B s2N;EN; L A>N; AL!LAL!LL!N;6N87A$N;L!L!!.N5MN5N;5N5 N N5-N0.N55N;c d}|r |dtdz }|dz }|jdd|t|jt|jdzdzt|j dzdz|dg|d d S) aApply CPU, address-space, and output-file limits before exec. With ``allow_network`` False - the default - the source string below is byte-for-byte the one this method has always passed to ``-c``. The only difference in the other profile is the extra ``RLIMIT_NPROC`` block spliced into that same source text, never an extra argv element: an extra slot would shift ``sys.argv[4]`` and make the limiter exec itself instead of the requested program. aVimport os, resource, sys cpu, memory, file_size = map(int, sys.argv[1:4]) for key, limit in ((resource.RLIMIT_CPU, cpu), (resource.RLIMIT_AS, memory), (resource.RLIMIT_FSIZE, file_size)): _, hard = resource.getrlimit(key) if hard != resource.RLIM_INFINITY: limit = min(limit, hard) resource.setrlimit(key, (limit, limit)) znproc = a? _, hard = resource.getrlimit(resource.RLIMIT_NPROC) if hard != resource.RLIM_INFINITY: nproc = min(nproc, hard) try: resource.setrlimit(resource.RLIMIT_NPROC, (nproc, nproc)) except (OSError, ValueError) as exc: sys.stderr.write('RLIMIT_NPROC: ' + str(exc) + '\n') sys.stderr.flush() os._exit(126) zKexecutable = sys.argv[4] os.execv(executable, [executable, *sys.argv[5:]]) r7r<irN)r rrirrr)r!rPrlimiters r"rkz,BubblewrapExecutionProvider._limited_commandHs <   01 2& & G  B   " "    $$ % ""T)D0 1 %%,t3 4 AJ  QR[  r$cVKg}d}d}|jdd{x}rn|j|z }|dkDr$|d|}|j||t|z }t|t |dkDrd}|jdd{x}rndj ||fS77w)NrFiTr$)readrappendlenmaxjoin)r!streamchunksretained truncatedchunk remainingkepts r"rtz(BubblewrapExecutionProvider._read_capped{s  #[[///e/--8I1}Zi( d#CI%5zC 1-- $[[///e/xx**0/s(B)B%A,B) B' B)B)'B))rrirrirrirrHrintrrrrrrrzstr | Path | NonerboolreturnNone)rri)rr) rLrirMrir2rr3z str | Nonerrrdict[str, Any])rSrirP list[str]rQz bytes | Noner3rrTrHrrrr)rPrrrrr)rzasyncio.StreamReaderrztuple[bytes, bool]) __name__ __module__ __qualname____doc__r#propertyr(r0rVrKrkrtr'r$r"rr$s.f")!3 -%) ! " )-1#++ +  + # ++++++++ +>((2 " $#> > >  >  > >  > P$y y y  y  y  y y  y xrsg?"  / z. (9*8 %(z'c+c+L ) )r$