Conversation
…rence Replace raw argument-directory inference with a typed launch spec that validates every input/output/restore/logPipe path against the pinned child-root contract ($TMPDIR/ml-child-ipc/<child-id>): rejects relative, root, out-of-root, dot-dot, duplicate, and mutable-symlink/alias paths before any policy is built. Adds the minimized fixed-mount enumeration (narrows /etc to individually justified files, never binds host /proc//sys), a private bounded tmpfs at /tmp, and a purpose-built allowlisted mechanism probe (ml_sandbox_probe) proving allowed IPC access, denied host reads/writes, mount enumeration, and external-egress denial. Validator logic verified standalone on this host (non-Sandbox2 path): compiles clean with -Wall -Wextra, and a driver exercising every V16 rejection case (relative/root/dot-dot/duplicate/aliased/wrong-depth/ child-id-mismatch) plus the valid multi-pipe case all pass. The Sandbox2-gated PolicyBuilder path and the Linux mechanism-probe integration test are unverified in this session (no Linux/Sandbox2 toolchain on this host) and need a devbox or Buildkite pass before V4/V5(policy half)/V7/V16 can be marked closed - see elastic-workspace-3b59.4.
Contributor
Author
This was referenced Sep 9, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacks on #3182 (PR B). PR C of the Sandbox2 clean rebuild plan (see the elastic-workspace harness, docs/projects/mlcpp-sandbox2-pr2873).
Replaces raw argument-directory inference in
CPytorchInferenceSandboxPolicywith a typed launch spec: everyinput/output/restore/logPipepath is validated against the pinned child-root contract ($TMPDIR/ml-child-ipc/<child-id>) before any policy is built. Rejects relative, root-level, dot-dot, out-of-root, wrong-depth, duplicate, mutable-symlink/alias, and cross-option child-id-mismatch paths - never widens a mount to recover a rejected argument.Also minimizes the filesystem policy: enumerates and justifies all seven historically bulk-mounted fixed directories, replaces whole
/etcwith five individually justified files, never binds host/proc//sys(relies on Sandbox2's own namespaced procfs/sysfs), uses a private bounded tmpfs at/tmpinstead of the host's, and consumes the syscall allowlist already shared with the legacy BPF filter instead of hand-duplicating it.Adds a purpose-built allowlisted mechanism probe (
ml_sandbox_probe) proving allowed IPC access, denied host reads, denied external egress, loopback reachability, and mount enumeration, plus a portable validator unit-test suite and a Linux-only mechanism integration test.Verified this session (macOS host, no Sandbox2/Linux toolchain available): the validator compiles clean with
-Wall -Wextraoutside the ml-cpp build system, and a standalone driver exercises every rejection/acceptance path against realmkdtemp/mkdir/symlinkfixtures - all pass. Not yet verified: theSANDBOX2_AVAILABLEbuild, the CMake wiring, and the mechanism-probe integration test itself - needs a Linux CI/devbox pass. Opening as draft for that reason.