Omar SobhandClaude Fable 5
ea5162ac65
tc-sandbox: - SandboxSpec/SandboxDriver + DockerDriver (bollard): uid 10001, cap-drop ALL, no-new-privileges, embedded seccomp deny profile (unshare/ptrace/ bpf/keyctl/mount/...), read-only rootfs with tmpfs /tmp + /home/agent, network=none, mem/cpu/pids limits - agent-base image: non-root, all setuid binaries stripped - 6 kernel-level assertion tests probing from INSIDE real containers: uid + CapEff==0, rootfs read-only, seccomp EPERM on unshare, zero traffic-carrying interfaces + failed egress connect, no setuid + NoNewPrivs=1, lifecycle tc-secrets: - ChaCha20-Poly1305 envelope encryption under a FileKey (generated 0600, AEAD tamper detection tested); secrets table ciphertext-at-rest - teamclaw-broker daemon: length-prefixed JSON over a unix socket; no protocol operation ever returns plaintext; InvokeHttp independently consumes the single-use execution grant against Postgres BEFORE touching any credential, then performs the call itself with the secret injected - Tests over the real socket + real Postgres + a real local HTTP receiver: encrypted at rest, pending approval refused, approved call carries the bearer token exactly once, grant replay refused, non-http URLs rejected 116 Rust + 61 frontend tests + 14 E2E journeys green. Co-Authored-By: Claude Fable 5 <[email protected]>
50 lines
1.1 KiB
JSON
50 lines
1.1 KiB
JSON
{
|
|
"defaultAction": "SCMP_ACT_ALLOW",
|
|
"archMap": [
|
|
{
|
|
"architecture": "SCMP_ARCH_X86_64",
|
|
"subArchitectures": ["SCMP_ARCH_X86", "SCMP_ARCH_X32"]
|
|
},
|
|
{
|
|
"architecture": "SCMP_ARCH_AARCH64",
|
|
"subArchitectures": ["SCMP_ARCH_ARM"]
|
|
}
|
|
],
|
|
"syscalls": [
|
|
{
|
|
"names": [
|
|
"acct",
|
|
"add_key",
|
|
"bpf",
|
|
"clone3",
|
|
"delete_module",
|
|
"finit_module",
|
|
"init_module",
|
|
"kexec_file_load",
|
|
"kexec_load",
|
|
"keyctl",
|
|
"mount",
|
|
"move_mount",
|
|
"open_by_handle_at",
|
|
"perf_event_open",
|
|
"pivot_root",
|
|
"process_vm_readv",
|
|
"process_vm_writev",
|
|
"ptrace",
|
|
"quotactl",
|
|
"reboot",
|
|
"request_key",
|
|
"setns",
|
|
"swapoff",
|
|
"swapon",
|
|
"umount2",
|
|
"unshare",
|
|
"userfaultfd"
|
|
],
|
|
"action": "SCMP_ACT_ERRNO",
|
|
"errnoRet": 1,
|
|
"comment": "Deny list on top of cap-drop ALL: kernel-facing syscalls an agent workload never needs. P6 hardening replaces this with a strict allowlist profile."
|
|
}
|
|
]
|
|
}
|