Claude/bazel issue 14828 4ms8yp - #30865
Draft
fmeum wants to merge 3 commits into
Draft
Conversation
The sandbox profile generated for block-network spawns denied `network-bind`: it allowed accepting and establishing loopback connections, but binding a socket - what any local test server does first - was still rejected by `(deny network*)`. As a result, tests using e.g. OkHttp MockWebServer or Dropwizard failed on macOS while passing inside the Linux sandbox's network namespace. Allow `network-bind` for any local address: servers commonly bind to the wildcard address (0.0.0.0 or ::), which the "localhost" filter does not match, and a bound socket still cannot exchange traffic with other hosts because inbound and outbound traffic remains restricted to loopback. Also allow local Unix domain sockets, which are filesystem-scoped IPC, in both directions. This matches the behavior of the Linux sandbox, where arbitrary binds succeed but only the loopback interface exists. Adds a regression test that inspects the generated sandbox profile. Fixes bazelbuild#14828 Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QK3qjuij3rTFfNHpeXdvEG
…erage Drops the unit test that merely asserted on the generated sandbox profile text and instead extends bazel_sandboxing_networking_test.sh, which runs on both Linux and macOS, with in-sandbox server coverage for the various kinds of localhost binding: * binding to 127.0.0.1, ::1, and the "localhost" hostname (in addition to the existing wildcard-address coverage via :loopback), * binding and connecting to a Unix domain socket inside the sandbox. testing_server.py gains a --bind_address flag so the test server can bind a specific address instead of the wildcard address. The :loopback target now also carries the tags under test so that the tag-based block-network scenario exercises in-sandbox servers as well. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QK3qjuij3rTFfNHpeXdvEG
The negative direction - blocked spawns must not be able to reach anything beyond loopback, which is the same boundary that keeps out the Internet - was previously only covered when REMOTE_NETWORK_ADDRESS was explicitly set, which CI does not do. Add a hermetic check that does not require Internet connectivity: the existing wildcard-bound test server is also reachable via a non-loopback address of the local machine, so a genrule connecting to that address must succeed when networking is allowed and must fail in all block-network scenarios, on Linux and macOS alike. The check is skipped on machines without a non-loopback address. Co-Authored-By: Claude <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QK3qjuij3rTFfNHpeXdvEG
|
Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA). View this failed invocation of the CLA check for more information. For the most up to date status, view the checks section at the bottom of the pull request. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Motivation
Build API Changes
No
Checklist
Release Notes
RELNOTES: None