Confine the guest process with seccomp, no-new-privs, and rlimits

[seanwevans]

Why

#267 made backend="process" a real address-space boundary, but a guest that runs native code (ctypes, a hostile wheel) or defeats the Python import guard can still issue raw syscalls from inside the guest process. This PR adds the kernel half of the boundary so those syscalls are stopped by the kernel, not just by Python-level guards. (Builds on #267, now merged.)

What

Before any guest code runs, the child process (runtime/child.py) calls apply_confinement() from the new runtime/confine.py:

• PR_SET_NO_NEW_PRIVS — the guest can never gain privileges, and (unprivileged) can install a seccomp filter. It also makes the filter irremovable.
• seccomp deny-list filter — kills the process with SIGSYS if it issues an unambiguously dangerous syscall: execve/execveat, ptrace, mount/umount2/pivot_root/chroot, setns/unshare, kexec_*, init_module/finit_module/delete_module, bpf, perf_event_open, process_vm_readv/writev, keyring calls, reboot, swapon/off. The filter first checks the audit arch and refuses to run under a non-x86-64 ABI, so the syscall ABI can't be swapped to reach a denied call by a different number. seccomp filters are inherited across fork/clone, so anything the guest spawns stays confined.
• rlimits — RLIMIT_CORE=0 always (no memory-leaking core dumps); RLIMIT_AS from the sandbox's mem_bytes; RLIMIT_CPU available as a knob.

This is a deny-list — a strong, robust reduction of the syscall attack surface that still lets a normal CPython interpreter run — not a proof that only a fixed allow-list of syscalls is reachable. It is x86-64-Linux specific and skips (recorded in the report) elsewhere. Hardened rollout mode passes require_seccomp=True, turning an unsupported platform into a failure rather than a silent skip.

The parent (ProcessSandbox) passes confinement config in the bootstrap frame, records the child's confinement report (wait_confined()), and surfaces an unexpected guest death (e.g. a seccomp kill) as a SandboxError to any waiter instead of hanging.

The boundary, demonstrated

test_real_execve_escape_is_killed_by_the_kernel: the guest walks the object graph to recover the real __import__, imports the real os (defeating the Python guard), and calls os.execv — the kernel kills the guest, and the handle reports returncode == -signal.SIGSYS. Compare with #267, where that escape merely ran in a separate process; here the syscall itself is denied.

A real bug this caught

The seccomp BPF builder initially double-counted the instruction index, producing negative jump offsets that wrapped to 255 in the u8 field. The kernel silently rejected the filter with EINVAL — i.e. no confinement, while a naive smoke test looked like it passed. test_filter_program_has_only_valid_forward_jumps is a regression guard for exactly this.

Testing

• New tests/test_process_confinement.py (7 tests): filter-jump validity, seccomp install + normal-syscall survival, SIGSYS on a denied syscall, core-dump disable, confinement-by-default, the real-execve kill, and a confine-disabled path. Kill tests run in a forked child; seccomp-dependent tests skip off x86-64 Linux.
• Full suite: 428 passed, 2 environment-gated skips; all pre-commit hooks pass.

Follow-ups (later in this series)

Landlock FS enforcement from policy, wiring the eBPF policy maps end-to-end, and reconciling the threat model once the boundary is enforced.

🤖 Generated with Claude Code

https://claude.ai/code/session_01DDSofWX5HwawsrwbN2nSXR

---

Generated by Claude Code