Repository navigation
Set workers non-dumpable so a sibling cannot read /proc/<pid>/fd #18
Description
Activity
Working on this now.
Closing as not planned. #79 tried the fix proposed here and was closed without merging.
This library exists to reduce blast radius, so that the application cannot be taken down and secrets cannot be exfiltrated. Worker-on-worker attacks are worth addressing eventually, but they are out of scope for v1.0.
The attack is also not well enough understood to fix properly. Making workers non-dumpable leaves the supervisor open to a similar attack, and a tool a worker execs is dumpable again. A non-dumpable process also behaves differently downstream (/proc ownership, ptrace, core dumps) in ways we haven't fully mapped.
Anyone can open a new issue once the attack vector is better understood.
Workers share a uid, so a compromised worker opens
/proc/<sibling>/fd/Nand reaches the descriptors the application passed — not only the staged files under the slot home.docs/DESIGN.md:140-145documents the route, and namesCAP_SETUIDandCAP_SYS_ADMINas the two fixescap-drop ALLremoves.PR_SET_DUMPABLE=0is a third one it does not name. It makes/proc/<pid>root-owned, which closes same-uid access to it, and it needs no capability. OneprctlinSupervisor#become_worker.To settle before doing it:
hotcell-servercarries no dependencies, so this needsfiddlefrom stdlib.verify_ptrace_scope!(supervisor.rb:122), which is the other half of worker memory protection.Found in an adversarial review by Codex, 2026-08-19.