mrtoth/agent-sandbox
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Keep env values off the bwrap command line

Browse Source
This commit is contained in:
mrtoth
2026-09-17 12:26:01 +02:00
parent d518c3e482
commit 0cb7d68945
6 changed files with 146 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+2
View File
@@ -33,6 +33,8 @@ Both modes clamp the environment the child sees so prompt-injected agents can't
Disable the built-in policy entirely with `--no-env-filter` (or `env-filter = false` in the config file) to pass the parent env through unchanged. User `--setenv`/`--unsetenv` escape hatches still apply.
Env values never become `bwrap` arguments. The final environment is set on the `bwrap` process itself, so a secret passed via `env = ["KEY=VALUE"]` stays out of the world-readable `/proc/<pid>/cmdline`, out of `ps` output, and out of the exposed command line below.
## Seccomp
Both modes apply a seccomp-BPF syscall allowlist derived from Podman's default profile. Dangerous syscalls (`mount`, `unshare`, `ptrace`, `bpf`, `perf_event_open`, `io_uring_*`, `keyctl`, `kexec_*`, …) return `ENOSYS`. Disable with `--no-seccomp` or `seccomp = false` in the config file.