thirdshift setup: check that Security sessions can sandbox target code on this machine #608

Activity

1. JacobStephens2

   added

   enhancementNew feature or requestNew feature or request

   needs-triageMaintainer needs to evaluate this issueMaintainer needs to evaluate this issue

   on Oct 10, 2026
2. JacobStephens2 commented on Oct 10, 2026

   

   JacobStephens2

   on Oct 10, 2026

   OwnerAuthor

   More actions

   This was generated by AI during triage.

   Update: fixed on the thirdshift host (Ubuntu 24.04). Two steps were needed after apt install bubblewrap:

   1. An AppArmor profile at /etc/apparmor.d/bwrap:

      abi <abi/4.0>,
      include <tunables/global>
      profile bwrap /usr/bin/bwrap flags=(unconfined) {
        userns,
        include if exists <local/bwrap>
      }
      

   2. Loading it with sudo apparmor_parser -r /etc/apparmor.d/bwrap.

   Result of the probe bwrap --unshare-all --die-with-parent --ro-bind / / --dev /dev --proc /proc --tmpfs /tmp …:

   • runs (exit 0), with uid mapped;
   • no network (a curl to github.com fails);
   • the host home is read-only (touch gives Read-only file system);
   • the tmpfs /tmp is writable.

   Installing the package alone was not enough, which supports making the setup check a real probe rather than a command -v bwrap. The same probe fits as a suggested check. Note that /sys/class/net inside still lists the host's interfaces because /sys is bind-mounted, so test network isolation by actually trying to connect, not by listing interfaces.
3. JacobStephens2 commented on Oct 21, 2026

   

   JacobStephens2

   on Oct 21, 2026

   OwnerAuthor

   More actions

   This was generated by AI during triage.

   Agent Brief

   Category: enhancement
   Summary: Setup checks, by trying it, that Security sessions can sandbox target code on this machine

   Current behavior:
   The Security audit skill runs target code only inside OS-enforced isolation: no network, writes only to a scratch area, a throwaway HOME. If any control can't be enforced, it doesn't run target code, and reports the missing capability as a blocker. On Ubuntu 24.04, bubblewrap isn't installed by default. Even once installed, AppArmor's restriction on unprivileged user namespaces stops it until a profile grants it userns. Nothing warns the operator before a Security review or Security run ends incomplete. The thirdshift host needed bubblewrap installed and an AppArmor profile for /usr/bin/bwrap with userns, loaded with apparmor_parser -r; this issue's comments give the profile.

   Desired behavior:
   When the User config that Setup writes has security.review or security.fix on, Setup runs a sandbox probe on Linux and prints one result line. The probe starts a real bwrap sandbox and checks, by trying, that:

   • the sandbox starts;
   • a network connection from inside it fails;
   • the host home is read-only inside it;
   • a scratch directory is writable.

   On failure, the line says which check failed. Setup then prints the commands that fix the usual causes, without running them or asking for root: installing bubblewrap, and the AppArmor profile above with its load command. Setup still writes the User config. With both settings off, no probe runs. On macOS, Setup says the probe isn't available there.

   Key interfaces:

   • Setup's flow, after the answers that set security.review and security.fix.
   • The Security audit skill's list of isolation requirements. Keep the probe's checks and that list in one place, or test that they match, so they can't drift apart.

   Acceptance criteria:

   • On a machine where bwrap works, Setup with security.review on prints a passing probe line.
   • With bwrap missing from PATH, or with a stand-in bwrap that fails, Setup names the failed check and prints the fix commands. It then finishes and writes the User config.
   • With both settings off, no probe runs.
   • The probe changes nothing on the host, needs no root, and finishes within seconds. It tests network isolation by connecting, not by listing interfaces.

   Out of scope:

   • Installing or configuring anything.
   • A warning in a Run's preflight.
   • The sandbox runner for Security reviews (Ship a tested sandbox runner for Security review proof-of-concept execution #726) and thirdshift doctor (make thirdshift doctor which can be run to check the health / setup / proper configuration of thirdshift #905).
4. JacobStephens2

   added

   ready-for-agentFully specified, ready for an AFK agentFully specified, ready for an AFK agent

   in-progressA Claim: thirdshift has taken this issueA Claim: thirdshift has taken this issue

   and removed

   needs-triageMaintainer needs to evaluate this issueMaintainer needs to evaluate this issue

   ready-for-agentFully specified, ready for an AFK agentFully specified, ready for an AFK agent

   on Oct 21, 2026
5. JacobStephens2

   closed this as completedin #967on Oct 21, 2026
6. JacobStephens2

   removed

   in-progressA Claim: thirdshift has taken this issueA Claim: thirdshift has taken this issue

   on Oct 21, 2026