XYZ/CST-agent
1
0
Fork 0
forked from WHC/Hermit
Code Pull Requests Activity

v0.7.1: allow network inside the run_shell sandbox

Browse Source 
Landlock no longer handles TCP, the Seatbelt profile drops (deny network*),
and the seccomp filter stops refusing IPv4/IPv6 sockets. Sandboxed commands
run without asking in auto mode on every backend (Low-IL no longer asks for
network commands), and connection errors are not treated as sandbox blocks.
This commit is contained in:
WHC
2026-10-08 21:05:14 +08:00
parent 895b47274c
commit 32b4afd772
8 changed files with 36 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/agent_loop.c
+6 -12
View File
@@ -259,7 +259,7 @@ static void put_safety(cst_buf_t *b, const cst_agent_config_t *cfg) {
"the task requires it. Never print secrets or API keys.\n");
if (tool_on(cfg, "run_shell"))
cst_buf_puts(b, "- run_shell may run in a sandbox (writes only inside the "
"workspace and temp dir, no network). If a command is "
"workspace and temp dir; the network works). If a command is "
"blocked the user is asked whether to rerun it outside; "
"do not try to work around the sandbox.\n");
}
@@ -827,13 +827,9 @@ static void sandbox_escalate(turn_t *t, cst_tool_ctx_t *ctx,
}
if (ans == CST_PERM_DENY) {
const char *note =
cst_sandbox_probe() == CST_SANDBOX_LOWIL
? "\n[cst: blocked by the sandbox (writes are limited to the "
"workspace and temp dir); the user did not allow running it "
"outside]\n"
: "\n[cst: blocked by the sandbox (writes are limited to "
"the workspace and temp dir, no network); the user did "
"not allow running it outside]\n";
"\n[cst: blocked by the sandbox (writes are limited to the "
"workspace and temp dir); the user did not allow running it "
"outside]\n";
cst_buf_t b = {0};
if (tr->out)
cst_buf_append(&b, tr->out, tr->out_len);
@@ -989,11 +985,9 @@ static void exec_begin(turn_t *t, pcall_t *pc, exec_t *x) {
if (def->perm == CST_TP_WRITE) {
ask = 0;
} else if (def->perm == CST_TP_SHELL) {
int sb = cst_sandbox_probe();
if (sb != CST_SANDBOX_NONE) {
if (cst_sandbox_probe() != CST_SANDBOX_NONE) {
ctx->sandbox = 1;
/* the Low-IL sandbox does not stop network access */
ask = sb == CST_SANDBOX_LOWIL && cmd && cst_shell_uses_network(cmd);
ask = 0;
} else if (cmd && cst_shell_is_safe(cmd)) {
ask = 0;
}