Sandbox: seccomp user-notify fallback for Termux and kernels without Landlock

- Child installs a seccomp filter with a listener; a supervisor thread
  resolves the path of write-type syscalls (cwd, dirfd, .., symlinks,
  /proc/self, /dev/stdout, both ends of rename/link) and answers
  CONTINUE or EACCES; IPv4/IPv6 sockets are refused
- Probe order Landlock -> seccomp -> none, checked in a throwaway child;
  CST_SANDBOX=landlock|seccomp|off
- curl connect failures count as sandbox refusals
- test_sandbox runs the detected sandbox and forced seccomp, with escape,
  symlink, rename, link, chmod, stdout, ENOENT, background and network cases
- Docs: platform matrix, limits (not a security boundary, Yama and
  background jobs)

tests/test_sandbox.c

@@ -70,6 +70,9 @@ static void test_blocked(void) {
   CHECK(!cst_sandbox_blocked(b, strlen(b), 1));
   const char *c = "touch: cannot touch 'x': Read-only file system\n";
   CHECK(cst_sandbox_blocked(c, strlen(c), 1));
+  const char *d = "curl: (7) Failed to connect to example.com port 443 after 9 "
+                  "ms: Could not connect to server\n";
+  CHECK(cst_sandbox_blocked(d, strlen(d), 7));
 }
 
 #if !defined(_WIN32)
@@ -112,7 +115,10 @@ static void test_network(const char *ws) {
   if (pid == 0) {
     if (cst_sandbox_enter(&plan) != 0)
       _exit(3);
+    /* Landlock refuses the connect, seccomp already the socket */
     int s = socket(AF_INET, SOCK_STREAM, 0);
+    if (s < 0)
+      _exit(errno == EACCES ? 0 : 2);
     int rc = connect(s, (struct sockaddr *)&a, sizeof(a));
     _exit(rc == 0 ? 1 : errno == EACCES ? 0 : 2);
   }
@@ -123,7 +129,123 @@ static void test_network(const char *ws) {
   CHECK(WIFEXITED(st) && WEXITSTATUS(st) == 0);
 }
 
-static void test_landlock(void) {
+static int blocked(const os_run_result_t *r) {
+  if (!cst_sandbox_blocked(r->out, r->out_len, r->exit_code)) {
+    fprintf(stderr, "expected a sandbox refusal (exit %d): %s\n", r->exit_code,
+            r->out ? r->out : "");
+    return 0;
+  }
+  return 1;
+}
+
+static char *slurp(const char *path) {
+  FILE *fp = fopen(path, "r");
+  if (!fp)
+    return NULL;
+  static char buf[256];
+  size_t n = fread(buf, 1, sizeof(buf) - 1, fp);
+  buf[n] = 0;
+  fclose(fp);
+  return buf;
+}
+
+/* Path tricks the seccomp supervisor has to resolve itself. */
+static void test_seccomp_paths(const char *ws, const char *out) {
+  char cmd[3 * OS_PATH_MAX], p[OS_PATH_MAX + 64], q[OS_PATH_MAX + 64];
+  char readme[OS_PATH_MAX + 64];
+  os_run_result_t r;
+  snprintf(readme, sizeof(readme), "%s/readme.txt", out);
+
+  /* ../ out of the workspace */
+  const char *outname = strrchr(out, '/') + 1;
+  snprintf(cmd, sizeof(cmd), "echo x > '../%s/e1'", outname);
+  snprintf(p, sizeof(p), "%s/e1", out);
+  CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && !exists(p));
+  os_run_result_free(&r);
+
+  /* a symlink inside may be created, but not written through */
+  snprintf(cmd, sizeof(cmd), "ln -s '%s' link && echo x > link/e2", out);
+  snprintf(p, sizeof(p), "%s/e2", out);
+  snprintf(q, sizeof(q), "%s/link", ws);
+  CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && !exists(p));
+  struct stat st;
+  CHECK(lstat(q, &st) == 0 && S_ISLNK(st.st_mode));
+  os_run_result_free(&r);
+  snprintf(cmd, sizeof(cmd), "ln -s '%s' rl && echo x >> rl", readme);
+  CHECK(run(ws, cmd, &r) != 0 && blocked(&r));
+  CHECK(strcmp(slurp(readme), "outside-content\n") == 0);
+  os_run_result_free(&r);
+
+  /* moving, hard-linking or chmod-ing an outside file */
+  snprintf(cmd, sizeof(cmd), "mv '%s' ./moved", readme);
+  CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && exists(readme));
+  os_run_result_free(&r);
+  snprintf(cmd, sizeof(cmd), "ln '%s' hard", readme);
+  snprintf(p, sizeof(p), "%s/hard", ws);
+  CHECK(run(ws, cmd, &r) != 0 && blocked(&r) && !exists(p));
+  os_run_result_free(&r);
+  snprintf(cmd, sizeof(cmd), "chmod 600 '%s'", readme);
+  CHECK(run(ws, cmd, &r) != 0 && blocked(&r));
+  os_run_result_free(&r);
+
+  /* the command's own stdout/stderr */
+  CHECK(run(ws, "echo hi > /dev/stdout && echo e > /dev/stderr && "
+                "echo fd > /proc/self/fd/1",
+            &r) == 0);
+  CHECK(strstr(r.out, "hi") && strstr(r.out, "fd"));
+  os_run_result_free(&r);
+
+  /* ordinary tree work inside */
+  CHECK(run(ws, "mkdir -p a/b/c && touch a/b/c/f && mv a/b/c/f a/g && "
+                "ln -s g a/s && chmod 600 a/g && rm -r a",
+            &r) == 0);
+  os_run_result_free(&r);
+
+  /* a missing parent stays ENOENT, not a sandbox refusal */
+  CHECK(run(ws, "touch nodir/x", &r) != 0);
+  CHECK(!cst_sandbox_blocked(r.out, r.out_len, r.exit_code));
+  os_run_result_free(&r);
+
+  /* many checked writes */
+  double t0 = os_now_ms();
+  CHECK(run(ws, "i=0; while [ $i -lt 300 ]; do echo $i > f$i; "
+                "i=$((i+1)); done; ls | grep -c '^f[0-9]'",
+            &r) == 0);
+  CHECK(strstr(r.out, "300") != NULL);
+  printf("test_sandbox: 300 checked writes in %.0f ms\n", os_now_ms() - t0);
+  os_run_result_free(&r);
+
+  /* background jobs: one still holding the pipe is served (unless Yama
+   * hides the orphaned job's memory from the supervisor), one detached
+   * does not hang the run */
+  snprintf(p, sizeof(p), "%s/bg.txt", ws);
+  CHECK(run(ws, "(sleep 0.2; echo late > bg.txt) & echo started", &r) == 0);
+  FILE *yf = fopen("/proc/sys/kernel/yama/ptrace_scope", "r");
+  int yama = 0;
+  if (yf) {
+    if (fscanf(yf, "%d", &yama) != 1)
+      yama = 0;
+    fclose(yf);
+  }
+  CHECK(yama > 0 || exists(p));
+  os_run_result_free(&r);
+  t0 = os_now_ms();
+  CHECK(run(ws, "(sleep 0.3; echo late > bg2.txt) >/dev/null 2>&1 &", &r) ==
+        0);
+  CHECK(os_now_ms() - t0 < 3000);
+  os_run_result_free(&r);
+
+  /* the workspace root itself cannot be removed */
+  char cwd[OS_PATH_MAX], ws2[OS_PATH_MAX + 32];
+  CHECK(getcwd(cwd, sizeof(cwd)) != NULL);
+  snprintf(ws2, sizeof(ws2), "%s/tests/sbx_ws2_XXXXXX", cwd);
+  CHECK(mkdtemp(ws2));
+  CHECK(run(ws2, "rmdir \"$PWD\"", &r) != 0 && blocked(&r) && exists(ws2));
+  os_run_result_free(&r);
+  CHECK(rmdir(ws2) == 0);
+}
+
+static void test_confined(int kind) {
   char cwd[OS_PATH_MAX], ws[OS_PATH_MAX + 32], out[OS_PATH_MAX + 32];
   char cmd[3 * OS_PATH_MAX];
   CHECK(getcwd(cwd, sizeof(cwd)) != NULL);
@@ -170,12 +292,15 @@ static void test_landlock(void) {
   CHECK(run(ws, cmd, &r) == 0);
   os_run_result_free(&r);
 
+  if (kind == CST_SANDBOX_SECCOMP)
+    test_seccomp_paths(ws, out);
+
   /* the parent itself stays unconfined */
   fp = fopen(outfile, "w");
   CHECK(fp);
   fclose(fp);
 
-  if (cst_sandbox_landlock_abi() >= 4)
+  if (kind == CST_SANDBOX_SECCOMP || cst_sandbox_landlock_abi() >= 4)
     test_network(ws);
   else
     printf("test_sandbox: landlock ABI %d < 4, network rule not tested\n",
@@ -192,8 +317,26 @@ int main(void) {
   int kind = cst_sandbox_probe();
   printf("test_sandbox: sandbox %s\n", cst_sandbox_name(kind));
 #if !defined(_WIN32)
-  if (kind == CST_SANDBOX_LANDLOCK)
-    test_landlock();
+  if (kind == CST_SANDBOX_LANDLOCK || kind == CST_SANDBOX_SECCOMP)
+    test_confined(kind);
+  if (kind != CST_SANDBOX_SECCOMP) {
+    const char *was = getenv("CST_SANDBOX");
+    char saved[32] = "";
+    if (was)
+      snprintf(saved, sizeof(saved), "%s", was);
+    setenv("CST_SANDBOX", "seccomp", 1);
+    if (cst_sandbox_reprobe() == CST_SANDBOX_SECCOMP) {
+      printf("test_sandbox: forced seccomp\n");
+      test_confined(CST_SANDBOX_SECCOMP);
+    } else {
+      printf("test_sandbox: seccomp not available here\n");
+    }
+    if (was)
+      setenv("CST_SANDBOX", saved, 1);
+    else
+      unsetenv("CST_SANDBOX");
+    CHECK(cst_sandbox_reprobe() == kind);
+  }
 #endif
   puts("test_sandbox: ok");
   return 0;