bugfix

internal/acp/sandbox/sandbox_uid_linux.go

@@ -0,0 +1,92 @@
+//go:build linux
+
+package sandbox
+
+import (
+	"fmt"
+	"os/exec"
+	"strconv"
+	"syscall"
+)
+
+// uidSandbox confines the agent child to a low-privilege UID/GID and applies OS
+// resource limits, while leaving proc.Group's Setpgid (tree-kill) intact.
+//
+// Tree-kill invariant: we ONLY add Credential to the existing SysProcAttr. We do
+// NOT touch Setpgid (proc.Group sets it after Apply via group.Prepare). The
+// negative-pgid SIGTERM/SIGKILL path keeps working because the new process group
+// leader is the same child — it simply runs as the low-priv uid now.
+//
+// Resource limits are applied by wrapping the real binary in `prlimit(1)`:
+// `prlimit --as=N --nproc=N --cpu=N --fsize=N -- <binary> <args...>`. prlimit
+// sets the limits on the child it execs, so they apply to the agent and (since
+// limits are inherited across fork) its whole subtree — exactly the tree the
+// pgid covers. Wrapping is additive to Credential/Setpgid and does not change
+// the process-group topology (prlimit execs the target in place, becoming the
+// group leader). If prlimit is unavailable, UID drop still applies and we log no
+// rlimits (best-effort; container mode is the hard boundary).
+//
+// Bind-mount masking (CLONE_NEWNS + remount /data with only HomeDir+WorktreeDir
+// visible) is intentionally NOT auto-enabled here: it requires the server to
+// hold CAP_SYS_ADMIN / a user namespace, which the rootless production container
+// (USER app) does not have by default. The robust isolation path is
+// ModeContainer. uidSandbox therefore provides UID drop + rlimits + egress proxy
+// as the minimum viable confinement, and documents that filesystem masking is a
+// container-mode guarantee.
+type uidSandbox struct{}
+
+func (s *uidSandbox) Apply(cmd *exec.Cmd, spec Spec) (func(), error) {
+	if spec.UID <= 0 {
+		return func() {}, fmt.Errorf("sandbox uid: invalid target uid %d", spec.UID)
+	}
+
+	// UID/GID drop — ADDITIVE to whatever proc.Group will set (Setpgid).
+	if cmd.SysProcAttr == nil {
+		cmd.SysProcAttr = &syscall.SysProcAttr{}
+	}
+	gid := spec.GID
+	if gid <= 0 {
+		gid = spec.UID
+	}
+	cmd.SysProcAttr.Credential = &syscall.Credential{
+		Uid: uint32(spec.UID),
+		Gid: uint32(gid),
+	}
+
+	// Resource limits via prlimit wrapper (if available).
+	if prlimit, err := exec.LookPath("prlimit"); err == nil {
+		args := prlimitArgs(spec.Rlimits)
+		if len(args) > 0 {
+			// Re-point the command through prlimit, preserving the original
+			// binary + args after the `--` separator.
+			orig := append([]string{cmd.Path}, cmd.Args[1:]...)
+			cmd.Path = prlimit
+			cmd.Args = append(append([]string{prlimit}, args...), append([]string{"--"}, orig...)...)
+		}
+	}
+
+	// Egress allowlist: inject HTTP(S)_PROXY/NO_PROXY into the stripped child env.
+	injectProxyEnv(cmd, spec)
+
+	// No ephemeral resources to tear down in uid mode (no bind mounts here);
+	// return a no-op cleanup.
+	return func() {}, nil
+}
+
+// prlimitArgs builds the prlimit flags for the non-zero limits in l.
+func prlimitArgs(l Limits) []string {
+	var args []string
+	if l.AddressSpaceBytes > 0 {
+		args = append(args, "--as="+strconv.FormatUint(l.AddressSpaceBytes, 10))
+	}
+	if l.NProc > 0 {
+		args = append(args, "--nproc="+strconv.FormatUint(l.NProc, 10))
+	}
+	if l.CPUSeconds > 0 {
+		args = append(args, "--cpu="+strconv.FormatUint(l.CPUSeconds, 10))
+	}
+	if l.DiskBytes > 0 {
+		args = append(args, "--fsize="+strconv.FormatUint(l.DiskBytes, 10))
+	}
+	return args
+}