Repository navigation
fix(openshell): check sandbox policy settings at controller startup - #3499
Merged
Merged
Conversation
The OpenShell Gateway refuses a process identity other than sandbox or 1..4294967294 and relative, root or traversing filesystem paths only in CreateSandbox, and the driver refused non-object Agent resources and a read-write grant on a read-only data mount only while building the Sandbox spec. A dedicated deploy reaches both after its predecessors have stopped. Startup now applies the same rules and names the setting: process identities, filesystem paths (one shared rule with provisioning), the read-only data mount, unknown filesystem keys and the Agent resource shapes. Findings 2331-2333.
Contributor
|
🦞👀 Pull request received. I will update this pull request when review starts. ClawSweeper review in progressClawSweeper is reviewing this revision. This supersedes any previous blocked status. |
This was referenced Oct 24, 2026
clawsweeper
Bot
added
clawsweeper:intake:bug
…pellings Review follow-ups: policy.process and its two identities are required by the schema, so an omitted block is a REQUIRED refusal instead of a TypeError; the tests pin the '+5' and '007' spellings the gateway's u32 parser accepts, a NUL path and a writable data mount in readWrite; the notice no longer claims every refused value failed deploys (a slash-only readOnly path did not).
This was referenced Oct 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The OpenShell Sandbox Driver accepted several settings at controller startup that fail only when a dedicated deploy creates its Sandbox, after the deploy has stopped its predecessors and written the runtime profile and provider to the Gateway:
policy.process.runAsUser/runAsGroupwere checked for being nonempty only."root","0"or"users"loaded, and the pinned Gateway's CreateSandbox then refused them (validate_policy_safety->is_valid_sandbox_identity:sandboxor a numeric ID from 1 to u32::MAX-1) with INVALID_ARGUMENT.policy.filesystemwas never read at startup. Relative paths,/, and a read-write grant on a read-onlysandboxDataMountwere refused only insidesandboxSpecwhile provisioning;/usr/../etcand//passed that check too and were refused by the Gateway (validate_filesystem_paths). An unknown key underpolicy.filesystem(for examplereadwrite) was silently ignored.kubernetes.agentResources.requests/limitsthat were not objects ("1",["x"]) threw only insandboxSpec.Findings 2331, 2332, 2333.
Change
validateOptionsruns a newvalidatePolicySettings: process identities use the Gateway's rule; filesystem paths use one shared rule (isFilesystemPolicyPath), which provisioning'svalidateFilesystemPolicyPathnow also uses, so it refuses..segments and slash-only paths as well; a read-only data mount listed inreadWriteis refused. Each refusal is aConfigurationValidationErrorthat names the setting.policy.processwith both identities (an omitted block is aREQUIREDrefusal, not a crash) and declarespolicy.filesystem(strict:includeWorkdirboolean,readOnly/readWritestring arrays, no other keys) andkubernetes.agentResources.requests/limitsas objects.docs/guides/deploy/breaking-changes.md. No values a working Installation can use are refused: each refused value already failed every dedicated deploy.Verification
tests/integration/sandbox-driver-startup.test.mjs("startup refuses OpenShell process identities the gateway refuses", "... filesystem paths before any Sandbox is created", "... Agent resources that are not objects") fail on main (missing rejection / wrong path) and pass with the fix; control cases loadsandboxand4294967294.+5and007, which the Gateway's u32 parser accepts, and a writable data mount inreadWrite; a NUL path and an omittedpolicy.process/runAsGroupare refused.runtime-logs-sandbox,workspace-setup-api,static-egress,protected-driver-registration,repository-credentials-admission.tsc --build tsconfig.jsonclean; eslint and prettier clean on touched files.crates/openshell-policy/src/lib.rsis_valid_sandbox_identity,validate_filesystem_paths;crates/openshell-server/src/grpc/sandbox.rsCreateSandbox).Risks
//inreadOnly(earlier builds refused only/there); the notice says so. The path rule is slightly narrower than the Gateway's only where OCE already was (OCE refuses/inreadOnlytoo, as before). Path count (256) and length (4096) limits are not mirrored.apps/controller/src/drivers/sandbox/openshell.tsvalidateOptions/schema only; merge-tree against open PRs perf(openshell): end the Sandbox startup wait once a new Codex Harness answers #3054, fix(openshell): verify released preview readiness over authenticated WebSocket #3345, fix(openshell): fail Pod-label refusals permanently and check the allowlist #2643, feat(runtime): apply Gateway tool policy to dedicated OCE deployments #2633 shows no new conflicted files.