From 1c8338ea666c09dbfb85a4ea0879dfa73cffb546 Mon Sep 17 00:00:00 2001 From: linkst <2024023709@m.scnu.edu.cn> Date: Fri, 31 Jul 2026 17:08:51 +0800 Subject: [PATCH 1/4] refactor(sandbox): extract unshare mapping probe into cached helper No behavior change. Move the inline probe out of unshare_user_namespace_works into a reusable unshare_probe helper and a cached working_unshare_mapping() that picks the first working candidate from UNSHARE_MAPPING_CANDIDATES, so the launcher and the capability probe share one code path. --- rust/crates/runtime/src/sandbox.rs | 38 ++++++++++++++++++++++++------ 1 file changed, 31 insertions(+), 7 deletions(-) diff --git a/rust/crates/runtime/src/sandbox.rs b/rust/crates/runtime/src/sandbox.rs index 2df08791e3..354cbfaced 100644 --- a/rust/crates/runtime/src/sandbox.rs +++ b/rust/crates/runtime/src/sandbox.rs @@ -282,6 +282,36 @@ fn command_exists(command: &str) -> bool { .is_some_and(|paths| env::split_paths(&paths).any(|path| path.join(command).exists())) } +/// Candidate `unshare` user-namespace mapping options, in preference order. +const UNSHARE_MAPPING_CANDIDATES: &[&[&str]] = &[&["--user", "--map-root-user"]]; + +/// Probe a candidate `unshare` mapping invocation with a trivial program. +fn unshare_probe(args: &[&str]) -> bool { + std::process::Command::new("unshare") + .args(args) + .arg("true") + .stdin(std::process::Stdio::null()) + .stdout(std::process::Stdio::null()) + .stderr(std::process::Stdio::null()) + .status() + .is_ok_and(|status| status.success()) +} + +/// The first mapping option set that works on this machine, if any. +/// +/// Probes are cached for the process lifetime; a missing `unshare` binary or a +/// kernel that refuses every mapping yields `None`. +fn working_unshare_mapping() -> Option<&'static [&'static str]> { + use std::sync::OnceLock; + static MAPPING: OnceLock> = OnceLock::new(); + *MAPPING.get_or_init(|| { + UNSHARE_MAPPING_CANDIDATES + .iter() + .copied() + .find(|args| unshare_probe(args)) + }) +} + /// Check whether `unshare --user` actually works on this system. /// On some CI environments (e.g. GitHub Actions), the binary exists but /// user namespaces are restricted, causing silent failures. @@ -292,13 +322,7 @@ fn unshare_user_namespace_works() -> bool { if !command_exists("unshare") { return false; } - std::process::Command::new("unshare") - .args(["--user", "--map-root-user", "true"]) - .stdin(std::process::Stdio::null()) - .stdout(std::process::Stdio::null()) - .stderr(std::process::Stdio::null()) - .status() - .is_ok_and(|status| status.success()) + working_unshare_mapping().is_some() }) } From 277fdda89433b28f451ed9acea3012541eafba2a Mon Sep 17 00:00:00 2001 From: linkst <2024023709@m.scnu.edu.cn> Date: Fri, 31 Jul 2026 17:09:00 +0800 Subject: [PATCH 2/4] fix(sandbox): fall back to --map-auto when root-user mapping is restricted Plain `unshare --user --map-root-user` fails on kernels and containers that block unprivileged writes to /proc/self/uid_map (e.g. GitHub Actions, restricted AppArmor profiles). On those systems util-linux delegates to the setuid newuidmap/newgidmap helpers when --map-auto is also present. Add the combined form as a fallback candidate and build the launcher args from the probed mapping, so systems without newuidmap/newgidmap or a /etc/subuid range keep using the plain form. --- rust/crates/runtime/src/sandbox.rs | 37 ++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 5 deletions(-) diff --git a/rust/crates/runtime/src/sandbox.rs b/rust/crates/runtime/src/sandbox.rs index 354cbfaced..4eaaaf360b 100644 --- a/rust/crates/runtime/src/sandbox.rs +++ b/rust/crates/runtime/src/sandbox.rs @@ -220,15 +220,18 @@ pub fn build_linux_sandbox_command( return None; } - let mut args = vec![ - "--user".to_string(), - "--map-root-user".to_string(), + let mut args: Vec = working_unshare_mapping() + .unwrap_or(UNSHARE_MAPPING_CANDIDATES[0]) + .iter() + .map(|arg| arg.to_string()) + .collect(); + args.extend([ "--mount".to_string(), "--ipc".to_string(), "--pid".to_string(), "--uts".to_string(), "--fork".to_string(), - ]; + ]); if status.network_active { args.push("--net".to_string()); } @@ -283,7 +286,16 @@ fn command_exists(command: &str) -> bool { } /// Candidate `unshare` user-namespace mapping options, in preference order. -const UNSHARE_MAPPING_CANDIDATES: &[&[&str]] = &[&["--user", "--map-root-user"]]; +/// +/// Most systems accept `--map-root-user` alone. On kernels or containers that +/// block unprivileged writes to `/proc/self/uid_map` (e.g. GitHub Actions, +/// restricted AppArmor profiles), util-linux instead delegates to the setuid +/// `newuidmap`/`newgidmap` helpers when `--map-auto` is also present; that +/// requires the current user to have a range in `/etc/subuid`/`/etc/subgid`. +const UNSHARE_MAPPING_CANDIDATES: &[&[&str]] = &[ + &["--user", "--map-root-user"], + &["--user", "--map-root-user", "--map-auto"], +]; /// Probe a candidate `unshare` mapping invocation with a trivial program. fn unshare_probe(args: &[&str]) -> bool { @@ -383,6 +395,21 @@ mod tests { assert_eq!(request.allowed_mounts, vec!["tmp"]); } + #[test] + fn mapping_candidates_prefer_plain_root_mapping() { + assert!(!super::UNSHARE_MAPPING_CANDIDATES.is_empty()); + for candidate in super::UNSHARE_MAPPING_CANDIDATES { + assert!(candidate.contains(&"--user")); + assert!(candidate.contains(&"--map-root-user")); + } + // The plain form must be tried first; `--map-auto` is only a fallback + // for kernels/containers that block unprivileged uid_map writes. + assert_eq!( + super::UNSHARE_MAPPING_CANDIDATES[0], + &["--user", "--map-root-user"] + ); + } + #[test] fn builds_linux_launcher_with_network_flag_when_requested() { let config = SandboxConfig::default(); From 9cbe6d9a8c4e40a2d57f787c0a1d006f00d83bc1 Mon Sep 17 00:00:00 2001 From: linkst <2024023709@m.scnu.edu.cn> Date: Sat, 1 Aug 2026 15:21:56 +0800 Subject: [PATCH 3/4] docs(sandbox): document newuidmap/newgidmap dependency for --map-auto fallback The fallback candidate relies on the setuid newuidmap/newgidmap helpers (uidmap package) plus a subuid/subgid range for the current user. Note in the candidate docs that the startup probe rejects the candidate when those are missing, so the plain --map-root-user form is used instead. --- rust/crates/runtime/src/sandbox.rs | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/rust/crates/runtime/src/sandbox.rs b/rust/crates/runtime/src/sandbox.rs index 4eaaaf360b..9bf5b0f215 100644 --- a/rust/crates/runtime/src/sandbox.rs +++ b/rust/crates/runtime/src/sandbox.rs @@ -290,8 +290,12 @@ fn command_exists(command: &str) -> bool { /// Most systems accept `--map-root-user` alone. On kernels or containers that /// block unprivileged writes to `/proc/self/uid_map` (e.g. GitHub Actions, /// restricted AppArmor profiles), util-linux instead delegates to the setuid -/// `newuidmap`/`newgidmap` helpers when `--map-auto` is also present; that -/// requires the current user to have a range in `/etc/subuid`/`/etc/subgid`. +/// `newuidmap`/`newgidmap` helpers when `--map-auto` is also present. +/// +/// That fallback therefore depends on the setuid helpers (the `uidmap` +/// package on Debian/Ubuntu) and on the current user having a range in +/// `/etc/subuid` and `/etc/subgid`. When either is missing, `--map-auto` +/// fails and the startup probe rejects the candidate, keeping the plain form. const UNSHARE_MAPPING_CANDIDATES: &[&[&str]] = &[ &["--user", "--map-root-user"], &["--user", "--map-root-user", "--map-auto"], From 525035b51b686e592d81bec8d34a58c74d68f0a9 Mon Sep 17 00:00:00 2001 From: code-yeongyu Date: Thu, 6 Aug 2026 19:17:47 +0900 Subject: [PATCH 4/4] fix(sandbox): probe the full launcher shape, not just the mapping The startup probe validated only the mapping flags against the trivial program `true`, but the real launcher always adds --mount --ipc --pid --uts --fork. On environments where the user namespace is created but mount propagation inside it is restricted (e.g. AppArmor-restricted CI runners), the fallback mapping passed the probe and the sandbox activated, yet every sandboxed command died with "cannot change root filesystem propagation: Permission denied", silently returning empty tool output and breaking the mock parity suite. The candidates now define the complete static launcher shape (mapping flags + namespace flags), so probe success implies launch success; the launcher reuses the candidate instead of re-appending the namespace flags, keeping probe and launch as one source of truth. The order-guarding test asserts the namespace flags are present in every candidate. Co-authored-by: linkst <2024023709@m.scnu.edu.cn> --- rust/crates/runtime/src/sandbox.rs | 88 +++++++++++++++++++++++++----- 1 file changed, 74 insertions(+), 14 deletions(-) diff --git a/rust/crates/runtime/src/sandbox.rs b/rust/crates/runtime/src/sandbox.rs index 9bf5b0f215..2536a28c20 100644 --- a/rust/crates/runtime/src/sandbox.rs +++ b/rust/crates/runtime/src/sandbox.rs @@ -225,13 +225,9 @@ pub fn build_linux_sandbox_command( .iter() .map(|arg| arg.to_string()) .collect(); - args.extend([ - "--mount".to_string(), - "--ipc".to_string(), - "--pid".to_string(), - "--uts".to_string(), - "--fork".to_string(), - ]); + // The candidates already carry the namespace flags, so the probe and the + // launcher share a single argument shape; only the opt-in `--net` is + // added here. if status.network_active { args.push("--net".to_string()); } @@ -287,18 +283,51 @@ fn command_exists(command: &str) -> bool { /// Candidate `unshare` user-namespace mapping options, in preference order. /// -/// Most systems accept `--map-root-user` alone. On kernels or containers that -/// block unprivileged writes to `/proc/self/uid_map` (e.g. GitHub Actions, -/// restricted AppArmor profiles), util-linux instead delegates to the setuid -/// `newuidmap`/`newgidmap` helpers when `--map-auto` is also present. +/// Most systems accept `--map-root-user` alone. Some hardened containers and +/// seccomp profiles block unprivileged writes to `/proc/self/uid_map`; there, +/// util-linux delegates to the setuid `newuidmap`/`newgidmap` helpers when +/// `--map-auto` is also present. /// /// That fallback therefore depends on the setuid helpers (the `uidmap` /// package on Debian/Ubuntu) and on the current user having a range in /// `/etc/subuid` and `/etc/subgid`. When either is missing, `--map-auto` /// fails and the startup probe rejects the candidate, keeping the plain form. +/// +/// Each candidate is the **complete** static argument shape the launcher +/// uses (see `build_linux_sandbox_command`): mapping flags followed by the +/// namespace flags `--mount --ipc --pid --uts --fork`. The startup probe +/// runs each candidate verbatim (plus a trivial program), so probe success +/// implies launch success: on systems where the mapping works but the +/// namespace flags are denied (e.g. AppArmor-restricted CI runners that +/// block mount propagation in user namespaces), the probe fails and the +/// sandbox stays disabled instead of activating a launcher that always +/// errors. +/// +/// `--net` is intentionally absent: it is appended only when network +/// isolation is active (the non-default path), and probing with it would +/// disable the sandbox on hosts that block network-namespace creation (e.g. +/// Docker's default seccomp profile) even when network isolation is never +/// requested. const UNSHARE_MAPPING_CANDIDATES: &[&[&str]] = &[ - &["--user", "--map-root-user"], - &["--user", "--map-root-user", "--map-auto"], + &[ + "--user", + "--map-root-user", + "--mount", + "--ipc", + "--pid", + "--uts", + "--fork", + ], + &[ + "--user", + "--map-root-user", + "--map-auto", + "--mount", + "--ipc", + "--pid", + "--uts", + "--fork", + ], ]; /// Probe a candidate `unshare` mapping invocation with a trivial program. @@ -403,14 +432,45 @@ mod tests { fn mapping_candidates_prefer_plain_root_mapping() { assert!(!super::UNSHARE_MAPPING_CANDIDATES.is_empty()); for candidate in super::UNSHARE_MAPPING_CANDIDATES { + // Mapping flags. assert!(candidate.contains(&"--user")); assert!(candidate.contains(&"--map-root-user")); + // Namespace flags the real launcher appends — the probe must + // exercise the full invocation shape, not just mapping flags. + assert!(candidate.contains(&"--mount")); + assert!(candidate.contains(&"--ipc")); + assert!(candidate.contains(&"--pid")); + assert!(candidate.contains(&"--uts")); + assert!(candidate.contains(&"--fork")); } // The plain form must be tried first; `--map-auto` is only a fallback // for kernels/containers that block unprivileged uid_map writes. assert_eq!( super::UNSHARE_MAPPING_CANDIDATES[0], - &["--user", "--map-root-user"] + &[ + "--user", + "--map-root-user", + "--mount", + "--ipc", + "--pid", + "--uts", + "--fork", + ] + ); + // The second candidate inserts `--map-auto` in the position util-linux + // expects (after `--map-root-user`, before the namespace flags). + assert_eq!( + super::UNSHARE_MAPPING_CANDIDATES[1], + &[ + "--user", + "--map-root-user", + "--map-auto", + "--mount", + "--ipc", + "--pid", + "--uts", + "--fork", + ] ); }