mrtoth/agent-sandbox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Keep env values off the bwrap command line

Browse Source
This commit is contained in:
mrtoth
2026-09-17 12:26:01 +02:00
parent d518c3e482
commit 0cb7d68945
6 changed files with 146 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
AGENTS.md
+4
View File
@@ -23,3 +23,7 @@ Later bwrap arguments override earlier ones for the same path. This has caused m
- User `--rw`/`--ro` escape hatches must come **after** mode setup so they can override sandbox restrictions.
Take extreme care when reordering any arguments in `sandbox.rs` or refactor things and test thoroughly.
### Env values must never become bwrap arguments
`/proc/<pid>/cmdline` is world-readable, and the same string is exposed inside every sandbox at `/run/agent-sandbox/bwrap-args`. `--setenv KEY VALUE` therefore publishes every secret the user puts in `env = [...]`. `set_sandbox_env` in `sandbox.rs` sets the whole child environment on the bwrap process instead, and bwrap passes its own environment on. Do not "simplify" it back to `--setenv`; `tests/e2e/env.rs` guards this.