host
1e4623c61c
Inner codex sandbox stays danger-full-access by choice (bwrap path is a separate decision); this hardens everything around it: - DockerExecutor: --security-opt plumbing (repeatable, dedups no-new-privileges), --pids-limit (CLI default 512, fork-bomb guard), per-call extra_env (-e NAME=VALUE, non-secrets only, e.g. proxy URLs; the model key still goes by -e NAME only). - Worker: --egress-proxy-port (0 = off). When on, Docker task containers get HTTP(S)_PROXY pointing at the host filtering proxy via their network gateway IP (tenant network gateway or default bridge gateway). Gateway unresolvable => the attempt fails instead of running unproxied (fail closed, same rule as tenant network creation failure). - AppArmor profile deploy/apparmor/docker-codex: docker-default base + deny network raw/packet, deny ptrace, deny mount/ umount/pivot_root, deny dangerous capabilities, deny writes to /proc/sys, /sys, /proc/keys. Deliberately NO userns rule (that would enable the bwrap path, not this one). File rules mirror docker-default (broad + sensitive denies); a strict file allowlist would need profiling codex's file access set and is not claimed here. - Egress proxy deploy/egress/: Tinyproxy with FilterDefaultDeny + anchored domain allowlist (relay, github, pypi, npm). Anchoring matters: an unanchored 'github.com' regex would also match 'evilgithub.com'. - Seccomp honesty (README): Docker default seccomp already enforces on all task containers; no new stricter allowlist is claimed in this change (building one from memory risks silently breaking the toolchain; it needs syscall profiling first). Tests: 3 outer-hardening tests (security-opt dedup, pids limit, proxy env without leaking the key value, gateway parse/fail, proxy fail-closed). Full suites pass.
79 lines
2.2 KiB
Plaintext
79 lines
2.2 KiB
Plaintext
# AppArmor profile for codex task containers (outer hardening).
|
|
#
|
|
# Based on Docker's default container profile, with stricter denies:
|
|
# - deny network raw: no raw sockets (ping/scan/sniff tricks)
|
|
# - deny ptrace: no process injection / debugging other processes
|
|
# - deny mount/umount: containers must never mount (bwrap path is
|
|
# NOT enabled here; inner sandbox stays danger-full-access by
|
|
# choice, so mount inside the container is pure attack surface)
|
|
# - deny dangerous capabilities (defense in depth; containers also
|
|
# run with --cap-drop=ALL, so these are a second lock, not the
|
|
# only one)
|
|
# - deny writes to /proc/sys, /sys, /proc/keys (kernel tunables)
|
|
#
|
|
# Deliberately NOT included: `userns` (that would enable the bwrap
|
|
# inner-sandbox path, which is a separate decision, not this one).
|
|
#
|
|
# Install: cp to /etc/apparmor.d/docker-codex, then
|
|
# apparmor_parser -r /etc/apparmor.d/docker-codex
|
|
# Use: docker --security-opt apparmor=docker-codex
|
|
# (worker flag: --docker-security-opt apparmor=docker-codex)
|
|
# Verify: docker inspect <container> shows
|
|
# "AppArmorProfile": "docker-codex" (not "docker-default").
|
|
|
|
#include <tunables/global>
|
|
|
|
profile docker-codex flags=(attach_disconnected,mediate_deleted) {
|
|
#include <abstractions/base>
|
|
|
|
network inet tcp,
|
|
network inet udp,
|
|
network inet icmp,
|
|
network inet6 tcp,
|
|
network inet6 udp,
|
|
network inet6 icmp,
|
|
deny network raw,
|
|
deny network packet,
|
|
|
|
capability chown,
|
|
capability dac_override,
|
|
capability fsetid,
|
|
capability fowner,
|
|
capability mknod,
|
|
capability net_bind_service,
|
|
capability setfcap,
|
|
capability setgid,
|
|
capability setpcap,
|
|
capability setuid,
|
|
capability sys_chroot,
|
|
deny capability sys_admin,
|
|
deny capability sys_ptrace,
|
|
deny capability net_admin,
|
|
deny capability net_raw,
|
|
deny capability sys_module,
|
|
deny capability sys_rawio,
|
|
deny capability sys_boot,
|
|
deny capability sys_time,
|
|
deny capability mac_admin,
|
|
deny capability mac_override,
|
|
|
|
deny mount,
|
|
deny umount,
|
|
deny pivot_root,
|
|
deny ptrace,
|
|
|
|
file,
|
|
deny @{PROC}/sys/** w,
|
|
deny @{PROC}/sysrq-trigger rw,
|
|
deny @{PROC}/keys/** rw,
|
|
deny @{PROC}/kcore rw,
|
|
deny /sys/** w,
|
|
deny /etc/shadow rw,
|
|
deny /etc/gshadow rw,
|
|
|
|
signal,
|
|
unix,
|
|
dbus,
|
|
ptrace (readby),
|
|
}
|