fix(jailer): unblock the default sandbox (drop host-side Landlock + bind box/bin)

[G4614]

deny landlock permanently

and add the bin path inside binding

add up to #652

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

Landlock enforcement is refactored from an in-process LandlockSandbox stage into a new boxlite-landlock workspace crate compiled as both rlib and cdylib. Bwrap serializes Landlock rules as environment variables; the preload library's .init_array constructor enforces them before main() runs. Pre-exec FD handling switches from closing to marking close-on-exec. SDK SecurityOptions constructors become secure-by-default.

Changes

Landlock LD_PRELOAD migration + FD hardening + secure defaults

Layer / File(s)	Summary
New boxlite-landlock crate: types, serialization, and enforcement src/landlock/Cargo.toml, src/landlock/src/lib.rs	New workspace crate defines PathAccess, LandlockError, JSON serialization helpers, fail-closed network-flag parsing, Linux ruleset builder with system-path whitelisting and current-exe parent augmentation, unsafe restrict_self_raw, and apply_rules_from_env() with an .init_array preload constructor gated by SEAL_MARKER_ENV; non-Linux builds export a no-op stub; unit tests cover network-flag parsing and round-trip.
Jailer landlock module: host-side env serialization only src/boxlite/src/jailer/landlock.rs	Replaces in-file ruleset construction and enforcement with a thin host-side module; re-exports constants and helpers from boxlite_landlock; adds SEAL_PRELOAD_LIB constant and serialize_rules_for_env error-mapping wrapper; prunes prior enforcement tests to focused JSON and network-flag encoding tests.
FD close-on-exec helper and pre_exec refactor src/boxlite/src/jailer/common/fd.rs, src/boxlite/src/jailer/pre_exec.rs	Adds cloexec_fds_from (Linux close_range CLOEXEC with fcntl fallback, macOS fixed-bound fallback, ENOSYS elsewhere); switches add_pre_exec_hook closure from closing inherited FDs to marking close-on-exec; adds fork-based FD_CLOEXEC validation test and PID-file write test.
Bwrap: LD_LIBRARY_PATH + Landlock env injection + LD_PRELOAD seal src/boxlite/src/jailer/sandbox/bwrap.rs	Extends BwrapSandbox::apply() to set shim-directory-first LD_LIBRARY_PATH, serialize Landlock rules into env vars (fail-closed sentinel on error), locate libboxlite_landlock.so beside the wrapped binary, and set LD_PRELOAD+SEAL_MARKER_ENV when present; fails closed with a nonexistent exec path when the library is absent.
Sandbox path policy: PID writability, shim-dir access, LD_LIBRARY_PATH ordering src/boxlite/src/jailer/mod.rs, src/boxlite/src/jailer/bwrap.rs	Grants shim.pid as writable in build_path_access and pre-creates it in Jailer::command(); adds conditional read-only grant for effective_binary parent directory; updates build_shim_command to use shim-dir-first LD_LIBRARY_PATH via ld_library_path_for_shim; adds writability and ordering tests.
Remove LandlockSandbox, update composite sandbox and public API src/boxlite/src/jailer/sandbox/mod.rs, src/boxlite/src/jailer/sandbox/composite.rs, src/boxlite/src/jailer/mod.rs, src/shim/src/main.rs	Removes LandlockSandbox type and all re-exports; replaces local PathAccess with boxlite_landlock::PathAccess re-export; updates CompositeSandbox::platform_new() to build Linux default with only BwrapSandbox; updates docs to describe bwrap+LD_PRELOAD handoff; adds test asserting default composite name is "bwrap".
Build system: workspace crate, runtime assembly, artifact embedding Cargo.toml, src/boxlite/Cargo.toml, scripts/build/build-runtime.sh, src/boxlite/build.rs, src/boxlite/src/jailer/shim_copy.rs	Adds src/landlock workspace member and boxlite-landlock workspace dependency; replaces direct landlock = "0.4" dependency; adds build_seal() to build script with both assemble_runtime() copy paths; embeds libboxlite_landlock.so in the runtime manifest; copy_shim_to_box copies the preload library alongside the shim.
SDK secure-by-default SecurityOptions sdks/python/src/advanced_options.rs, sdks/python/tests/test_security_options.py, sdks/node/src/advanced_options.rs, sdks/c/src/tests.rs	Updates PySecurityOptions::new defaults to enable jailer/seccomp and set non-None resource limits; adds Rust, Python, Node, and C tests asserting secure defaults and opt-out paths (development(), explicit jailer_enabled=False).

Sequence Diagram(s)

sequenceDiagram
  rect rgba(70, 130, 180, 0.5)
    note over BwrapSandbox,bwrap: Host side
    BwrapSandbox->>BwrapSandbox: serialize_rules_for_env() → LANDLOCK_RULES_ENV
    BwrapSandbox->>BwrapSandbox: ld_library_path_for_binary() → LD_LIBRARY_PATH
    BwrapSandbox->>BwrapSandbox: locate libboxlite_landlock.so
    BwrapSandbox->>bwrap: launch with --setenv LD_PRELOAD, SEAL_MARKER_ENV, LANDLOCK_RULES_ENV
  end
  rect rgba(34, 139, 34, 0.5)
    note over bwrap,shim: Inside sandbox (post-namespace)
    bwrap->>SEAL_CTOR: .init_array fires (LD_PRELOAD)
    SEAL_CTOR->>apply_rules_from_env: call
    apply_rules_from_env->>build_ruleset: paths + network flag
    build_ruleset-->>restrict_self_raw: ruleset fd
    restrict_self_raw->>restrict_self_raw: PR_SET_NO_NEW_PRIVS + landlock_restrict_self
    restrict_self_raw-->>SEAL_CTOR: Ok or abort()
    SEAL_CTOR-->>shim: return (Landlock active)
    shim->>shim: run_shim()
  end

Loading

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

Possibly related PRs

• boxlite-ai/boxlite#742: Both PRs modify src/boxlite/src/jailer/mod.rs's build_path_access to change sandbox path-access entries (main PR grants shim.pid writability and exec dir reads; #742 addresses socket policy via BoxSockets symlink scheme).

Suggested reviewers

• DorianZheng
• law-chain-hot

Poem

🐇 Hop, hop! The rules now ride the env with care,
A preload lib sneaks in before main() runs there.
No more sandbox child, just bwrap and a seal,
Close-on-exec FDs — a cleaner, safer deal.
The shim wakes up already locked down tight,
This bunny ships Landlock at .init_array light! 🔒

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title accurately summarizes the main change: replacing the host-side Landlock flow to unblock the default sandbox, with related bin mounting/copying work.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[G4614]

Closing in favor of the 4-PR split: #682 → #683 → #684 → #685. Same content, cleaner per-layer review surface.

[coderabbitai]

Actionable comments posted: 4

🧹 Nitpick comments (2)

src/boxlite/build.rs (1)

849-851: 📐 Maintainability & Code Quality | 🔵 Trivial

Executable-name list is duplicated across the build/runtime boundary.

is_runtime_executable in build.rs lists ["boxlite-shim", "boxlite-guest", "bwrap"], and the same set appears as RUNTIME_EXECUTABLES in src/boxlite/src/runtime/embedded.rs (line 24). While they currently match, the lists are maintained separately; if one is updated and the other is not, a newly-embedded executable could be extracted without the exec bit and silently fail to launch. Consider consolidating to a single shared definition (e.g., via include!) to enforce consistency.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/boxlite/build.rs` around lines 849 - 851, The `is_runtime_executable`
function in build.rs and the `RUNTIME_EXECUTABLES` constant in
src/boxlite/src/runtime/embedded.rs maintain duplicate lists of executable names
that could drift out of sync. Consolidate these two lists into a single shared
definition (such as a separate module-level constant or data file) and use the
include! macro or direct module reference to ensure both locations reference the
same authoritative list of executables. This will prevent future inconsistencies
where one list is updated without updating the other.

Source: Coding guidelines

src/boxlite/src/jailer/sandbox/bwrap.rs (1)

171-179: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Share the dir-first LD_LIBRARY_PATH policy helper.

This duplicates ld_library_path_for_shim in src/boxlite/src/jailer/bwrap.rs. Since both encode the same library-resolution policy, move it to one shared helper to avoid ordering drift.

As per coding guidelines, “Use DRY (Don't Repeat Yourself) in Rust when it's the same rule, policy, or transformation.”

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/boxlite/src/jailer/sandbox/bwrap.rs` around lines 171 - 179, The
ld_library_path_for_binary function duplicates the same library-resolution
policy as ld_library_path_for_shim located elsewhere. Extract the common logic
that constructs a LD_LIBRARY_PATH with the binary directory first followed by
any existing LD_LIBRARY_PATH into a single shared helper function. Update both
ld_library_path_for_binary and ld_library_path_for_shim to call this shared
helper instead of duplicating the logic, ensuring consistent policy enforcement
across the codebase and preventing future ordering drift.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/boxlite/src/jailer/landlock.rs`:
- Around line 220-225: The error handling for Landlock ruleset build failures in
the match expression on the Err(e) branch currently logs a warning and allows
execution to continue, which bypasses security protections. Instead of warning
and continuing when ruleset building fails, change this error case to return or
propagate the error, ensuring the operation fails fast rather than silently
continuing without Landlock enforcement. This aligns with the fail-closed
security principle where a ruleset build error should halt execution rather than
proceed in an unprotected state.
- Around line 195-197: The network enablement logic currently fails open by
defaulting to enabled when BOXLITE_LANDLOCK_NETWORK_ENABLED_ENV is missing or
malformed via the unwrap_or(true) fallback. When BOXLITE_LANDLOCK_RULES is
present, validate that BOXLITE_LANDLOCK_NETWORK_ENABLED exists and contains only
valid values (e.g., "0" or "1"), then return an error if the environment
variable is missing or contains an unexpected value instead of defaulting to
true. This ensures the configuration fails closed on malformed input rather than
silently enabling network access.

In `@src/boxlite/src/jailer/sandbox/bwrap.rs`:
- Around line 126-138: The error handling in the Landlock rules serialization
block (in the Err(e) branch) currently logs a warning and continues, which
allows command construction to proceed without the security layer. Change the
function signature to return a BoxliteResult or appropriate error type, and
propagate the serialization error (the `e` value) instead of just logging it, so
that the entire sandbox application or command construction fails if Landlock
rules cannot be serialized, implementing the fail-closed principle.

In `@src/shim/src/main.rs`:
- Around line 101-104: The Landlock setup block that calls apply_rules_from_env
can fail before the ExitInfo write path is installed, causing errors to bypass
structured exit reporting. Either capture exit_file before the Landlock block so
it remains available if apply_rules_from_env fails, or refactor the Landlock
error handling to use the same error-reporting mechanism as run_shim. Ensure
that any failure during Landlock initialization is properly reported through the
structured exit path rather than returning directly without calling the
exit_file write logic.

---

Nitpick comments:
In `@src/boxlite/build.rs`:
- Around line 849-851: The `is_runtime_executable` function in build.rs and the
`RUNTIME_EXECUTABLES` constant in src/boxlite/src/runtime/embedded.rs maintain
duplicate lists of executable names that could drift out of sync. Consolidate
these two lists into a single shared definition (such as a separate module-level
constant or data file) and use the include! macro or direct module reference to
ensure both locations reference the same authoritative list of executables. This
will prevent future inconsistencies where one list is updated without updating
the other.

In `@src/boxlite/src/jailer/sandbox/bwrap.rs`:
- Around line 171-179: The ld_library_path_for_binary function duplicates the
same library-resolution policy as ld_library_path_for_shim located elsewhere.
Extract the common logic that constructs a LD_LIBRARY_PATH with the binary
directory first followed by any existing LD_LIBRARY_PATH into a single shared
helper function. Update both ld_library_path_for_binary and
ld_library_path_for_shim to call this shared helper instead of duplicating the
logic, ensuring consistent policy enforcement across the codebase and preventing
future ordering drift.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b9743a7d-97b1-4daa-b067-c77733218a28

📥 Commits

Reviewing files that changed from the base of the PR and between 4a52285 and e2d1fd5.

📒 Files selected for processing (12)

• src/boxlite/build.rs
• src/boxlite/src/jailer/bwrap.rs
• src/boxlite/src/jailer/common/fd.rs
• src/boxlite/src/jailer/landlock.rs
• src/boxlite/src/jailer/mod.rs
• src/boxlite/src/jailer/pre_exec.rs
• src/boxlite/src/jailer/sandbox/bwrap.rs
• src/boxlite/src/jailer/sandbox/composite.rs
• src/boxlite/src/jailer/sandbox/mod.rs
• src/boxlite/src/jailer/shim_copy.rs
• src/boxlite/src/runtime/embedded.rs
• src/shim/src/main.rs

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

sdks/python/src/advanced_options.rs (1)

134-152: 🎯 Functional Correctness | 🟡 Minor

seccomp_enabled default diverges from core on non-Linux.

The docstring claims this constructor matches SecurityOptions::default(), but the core default gates seccomp with cfg!(target_os = "linux") (false on macOS), whereas this signature defaults it to unconditional true. The sibling presets standard() and maximum() in the core also cfg-gate it. The From impl carries this value straight into the core SecurityOptions, so on macOS a default SecurityOptions() produces seccomp_enabled=true where every other surface yields false — misleading on introspection even though seccomp is Linux-only.

Note the assertion in sdks/python/tests/test_security_options.py (assert opts.seccomp_enabled is True) would need platform-gating if you align with core.

Proposed alignment with core

-        seccomp_enabled=true,
+        seccomp_enabled=cfg!(target_os = "linux"),

The proposed fix using cfg!(target_os = "linux") is valid in pyo3 0.27.1—the macro expands at compile time before pyo3 processes the signature attribute, producing a valid boolean literal.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sdks/python/src/advanced_options.rs` around lines 134 - 152, The
`seccomp_enabled` parameter in the SecurityOptions constructor defaults
unconditionally to `true`, but the core SecurityOptions::default() gates this
with cfg!(target_os = "linux") to default it to `false` on non-Linux platforms.
Change the `seccomp_enabled=true` default in the pyo3 signature to use
`cfg!(target_os = "linux")` to match the core behavior, ensuring the Python SDK
produces `seccomp_enabled=false` on macOS and other non-Linux platforms.
Additionally, the assertion in the test file
(sdks/python/tests/test_security_options.py) that asserts opts.seccomp_enabled
is True will also need to be platform-gated using cfg! to only run on Linux.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In `@sdks/python/src/advanced_options.rs`:
- Around line 134-152: The `seccomp_enabled` parameter in the SecurityOptions
constructor defaults unconditionally to `true`, but the core
SecurityOptions::default() gates this with cfg!(target_os = "linux") to default
it to `false` on non-Linux platforms. Change the `seccomp_enabled=true` default
in the pyo3 signature to use `cfg!(target_os = "linux")` to match the core
behavior, ensuring the Python SDK produces `seccomp_enabled=false` on macOS and
other non-Linux platforms. Additionally, the assertion in the test file
(sdks/python/tests/test_security_options.py) that asserts opts.seccomp_enabled
is True will also need to be platform-gated using cfg! to only run on Linux.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b41ace4-0968-45bd-816d-126470710221

📥 Commits

Reviewing files that changed from the base of the PR and between e2d1fd5 and 21f8db0.

📒 Files selected for processing (2)

• sdks/python/src/advanced_options.rs
• sdks/python/tests/test_security_options.py

[G4614]

Addressed all four fail-open findings in 7994709 (the Landlock handoff must fail closed since the shim is now the only place Landlock is applied):

• landlock.rs:197 — malformed network env → extracted a network_enabled_from_env helper that only accepts the exact "1"/"0" values bwrap emits; missing/empty/garbage now returns an error instead of assuming networking. Unit test network_enabled_from_env_fails_closed_on_bad_value.
• landlock.rs:225 — ruleset build error → Err(e) now propagates (return Err(e)) instead of warn-and-continue. (Ok(None) still degrades gracefully for unsupported kernels, as before.)
• sandbox/bwrap.rs:138 — serialization failure → apply() can't return a Result (Sandbox trait), so on the (effectively impossible) serialize error we now inject a sentinel BOXLITE_LANDLOCK_RULES value that the shim's apply_rules_from_env rejects as invalid JSON → the shim fails closed rather than starting un-sandboxed. (Lighter than plumbing BoxliteResult through the whole sandbox-apply chain; the error is still logged at error level.)
• shim/main.rs:104 — structured exit reporting → moved the Landlock step into run_shim, so a Landlock startup failure flows through the same inspect_err/ExitInfo::Error path as the rest of the shim instead of returning before that path is installed.

clippy --all-targets --all-features + the landlock test suite green.

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/boxlite/src/jailer/landlock.rs`:
- Line 199: The doc comment around line 199 describing the landlock behavior
still states that unsupported kernels "warn and continue", but this no longer
matches the implementation at line 246 where the Ok(None) branch now degrades
silently without emitting a warning. Update the documentation comment to
accurately reflect the current behavior by removing the reference to "warn" and
instead describe that unsupported kernels degrade silently without warnings.

In `@src/boxlite/src/jailer/sandbox/bwrap.rs`:
- Around line 160-171: The issue is that wrapped_args is built in bwrap.rs to
include "--seal-landlock" followed by the original args, but the
seal_landlock_and_reexec function in main.rs discards these args when performing
the re-exec. Modify the seal_landlock_and_reexec function to accept the original
arguments as a parameter and pass them through when re-execing the shim,
ensuring that any arguments provided to the wrapper are preserved and reach the
final shim process after Landlock enforcement.

In `@src/shim/src/main.rs`:
- Around line 144-155: The seal_landlock_and_reexec() function re-executes the
binary without forwarding the original command-line arguments that were passed
by the wrapper in bwrap.rs. The function currently calls
Command::new(&exe).exec() with no arguments, which silently drops all argv
entries beyond the program name. To fix this, collect the remaining command-line
arguments using std::env::args() (skipping the program name itself and the
--seal-landlock flag that was added by the wrapper), and pass them to the
Command::new(&exe) using the .args() method before calling .exec() to ensure all
arguments are properly forwarded across the exec boundary.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 89fabf3c-73f8-4999-81c0-4499608076c2

📥 Commits

Reviewing files that changed from the base of the PR and between dd8eb12 and 38e8125.

📒 Files selected for processing (8)

• sdks/c/src/tests.rs
• sdks/python/src/advanced_options.rs
• src/boxlite/src/jailer/landlock.rs
• src/boxlite/src/jailer/mod.rs
• src/boxlite/src/jailer/sandbox/bwrap.rs
• src/boxlite/src/jailer/sandbox/landlock.rs
• src/boxlite/src/jailer/sandbox/mod.rs
• src/shim/src/main.rs

💤 Files with no reviewable changes (1)

• src/boxlite/src/jailer/sandbox/landlock.rs

🚧 Files skipped from review as they are similar to previous changes (3)

• sdks/c/src/tests.rs
• sdks/python/src/advanced_options.rs
• src/boxlite/src/jailer/sandbox/mod.rs

[coderabbitai]

Actionable comments posted: 2

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

src/boxlite/src/jailer/sandbox/mod.rs (1)

13-31: 📐 Maintainability & Code Quality | 🟡 Minor

Update module docs to describe the actual stub binary architecture, not the --seal-landlock flag flow.

Lines 28–31 claim bwrap "re-exec's the shim as <shim> --seal-landlock" and that this applies Landlock. The actual implementation (lines 163–184) wraps the shim with a separate boxlite-landlock-seal stub binary: bwrap exec's <boxlite-landlock-seal> <shim> [args]. The stub applies Landlock from environment rules, then exec's the shim—the shim itself never applies Landlock. Reword the composition example to match the stub binary flow and clarify that Landlock is applied by the intermediate stub, not by the shim.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/boxlite/src/jailer/sandbox/mod.rs` around lines 13 - 31, The
documentation comment describing the Linux sandbox composition and Landlock
application flow is inaccurate. Update the doc comment for the module (currently
describing BwrapSandbox and the Landlock flow around lines 28-31) to reflect the
actual implementation where bwrap exec's the boxlite-landlock-seal stub binary
that wraps the shim, rather than claiming bwrap re-exec's the shim with a
--seal-landlock flag. Clarify that the intermediate boxlite-landlock-seal stub
binary is what applies Landlock rules from the environment and then re-exec's
the actual shim, so the shim itself never applies Landlock. Update the
composition example to accurately represent this stub binary architecture flow.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/boxlite/build.rs`:
- Around line 902-907: The copy_prebuilt_binary call for "boxlite-landlock-seal"
silently warns and skips when the binary is absent, which violates the fail-fast
principle for critical components. Replace or wrap this call to explicitly fail
(e.g., error and exit) if the boxlite-landlock-seal binary cannot be found or
copied using Self::find_prebuilt_seal, since Landlock enforcement depends on
this stub being present in the embedded Linux runtime.

In `@src/boxlite/src/jailer/sandbox/bwrap.rs`:
- Around line 174-185: The Err branch of the find_binary match for SEAL_STUB_BIN
currently falls back to executing the binary directly without Landlock
protection, which is a security fail-open condition. Modify this branch to build
the command against the expected stub path (the path that should exist but
doesn't) rather than using the binary directly, so that bwrap's exec will fail
when attempting to run a non-existent binary. This ensures the box fails to
start rather than silently running without Landlock, making the error handling
consistent with the sentinel path at lines 139-150 and adhering to the
fail-closed principle.

---

Outside diff comments:
In `@src/boxlite/src/jailer/sandbox/mod.rs`:
- Around line 13-31: The documentation comment describing the Linux sandbox
composition and Landlock application flow is inaccurate. Update the doc comment
for the module (currently describing BwrapSandbox and the Landlock flow around
lines 28-31) to reflect the actual implementation where bwrap exec's the
boxlite-landlock-seal stub binary that wraps the shim, rather than claiming
bwrap re-exec's the shim with a --seal-landlock flag. Clarify that the
intermediate boxlite-landlock-seal stub binary is what applies Landlock rules
from the environment and then re-exec's the actual shim, so the shim itself
never applies Landlock. Update the composition example to accurately represent
this stub binary architecture flow.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: b3495853-622b-41db-b89d-de96ce95b461

📥 Commits

Reviewing files that changed from the base of the PR and between 38e8125 and 105baed.

⛔ Files ignored due to path filters (1)

• Cargo.lock is excluded by !**/*.lock

📒 Files selected for processing (12)

• Cargo.toml
• scripts/build/build-runtime.sh
• src/boxlite/Cargo.toml
• src/boxlite/build.rs
• src/boxlite/src/jailer/landlock.rs
• src/boxlite/src/jailer/mod.rs
• src/boxlite/src/jailer/sandbox/bwrap.rs
• src/boxlite/src/jailer/sandbox/mod.rs
• src/landlock/Cargo.toml
• src/landlock/src/bin/seal.rs
• src/landlock/src/lib.rs
• src/shim/src/main.rs

💤 Files with no reviewable changes (1)

• src/boxlite/src/jailer/mod.rs

✅ Files skipped from review due to trivial changes (2)

• src/landlock/Cargo.toml
• src/shim/src/main.rs

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@src/boxlite/src/jailer/sandbox/bwrap.rs`:
- Around line 189-194: The tracing::error! macro call and the bwrap_cmd.build()
method call in the bwrap.rs file have formatting drift that doesn't meet the
repository's formatting standards. Run rustfmt on the
src/boxlite/src/jailer/sandbox/bwrap.rs file to automatically reformat the code
in the affected hunk to comply with the repository's formatting guidelines.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 96a2c4c9-a22d-47f1-b32f-3ab713edd798

📥 Commits

Reviewing files that changed from the base of the PR and between 672717a and 9edc97f.

📒 Files selected for processing (9)

• scripts/build/build-runtime.sh
• src/boxlite/build.rs
• src/boxlite/src/jailer/landlock.rs
• src/boxlite/src/jailer/sandbox/bwrap.rs
• src/boxlite/src/jailer/sandbox/mod.rs
• src/boxlite/src/jailer/shim_copy.rs
• src/landlock/Cargo.toml
• src/landlock/src/lib.rs
• src/shim/src/main.rs

✅ Files skipped from review due to trivial changes (1)

• src/shim/src/main.rs

🚧 Files skipped from review as they are similar to previous changes (5)

• src/boxlite/build.rs
• src/boxlite/src/jailer/landlock.rs
• scripts/build/build-runtime.sh
• src/landlock/src/lib.rs
• src/boxlite/src/jailer/sandbox/mod.rs

[G4614]

Boot-verified on Linux 6.x: with LandlockSandbox dropped from the default stack, the box boots cleanly (alpine 3.24.1, uid=0, exit 0). Filesystem isolation via bwrap; no Landlock applied. cargo test jailer::landlock stays green — 10 passed, 0 failed, 0 ignored (landlock.rs is untouched, so the AccessFs enforcement tests still run).