Sandbox is a no-op when root is at or above `$HOME`

Open Beginner friendly
#1 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
macos
Domain
security, tooling

Research direction

Start at the sandboxer entry point and read the existing --root and --home validation for absolute paths and directories. Add the missing rejection for roots equal to or above the home directory, then verify that a project below $HOME still remains confined and invalid roots fail before the sandbox is applied.

Written by the indexing model from the issue text.

Description

A root at or above $HOME silently disables confinement.

The profile ends with:

(deny file* (subpath user_home))
(allow file-read-metadata (subpath user_home))
(allow file* (subpath sandbox_root))

SBPL is last-match-wins, so the sandbox_root allow has to come after the user_home deny for the normal case (a project inside $HOME) to work. But that also means a root equal to or above $HOME re-allows all of $HOME.

Repro: run with DUNE_ROOT="$HOME" (or any ancestor, e.g. /Users) and the sandboxed process has full read/write of the home directory. No warning is printed, the sandbox applies successfully and confines nothing.

Reordering the rules is not a fix: putting the root allow first makes the home deny win for every project under $HOME, breaking the common case. The fix is to reject such a root. sandboxer already validates that --root and --home are absolute and are directories, so a containment check could fit alongside those?

Dominant language
Nix
Stars
5
Forks
1
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from nmattia/dune

All issues in nmattia/dune

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.