fix: the sandbox's last unverified control was the one that wasn't there

[vicenteliu]

ADR-0005 makes the sandbox the real boundary — the approval gate is a heuristic
denylist and says so in its own docstring. #209 made it possible to start a
container for the first time, which made the boundary observable for the first
time. This is what it looks like.

Method: read the kernel's own record of what is applied, from inside —
/proc/self/status, cgroup limits, routes — rather than attempt to break out.
If a limit is not in force, the cost of discovering that by hitting it is paid
by the host.

Seven of eight, in effect

declared	observed
--cap-drop=ALL	CapEff and CapBnd both 0000000000000000
--security-opt=no-new-privileges	NoNewPrivs: 1
--read-only	writing outside /work blocked
--tmpfs=/work:size=64m	dd asked for 80M, wrote exactly 67108864 bytes
--network=none	no routes, only lo addressed, egress fails
--pids-limit=128	pids.max=128
--memory=512m	memory.max=536870912
the project's seccomp profile	never applied

CapBnd being zero matters as much as CapEff: a setuid binary has nothing to
regain. The tmpfs number is #209's fix visible from the other side.

The eighth

_SECCOMP_PROFILE resolved to <repo>/../sandbox/policies/seccomp.template.json
— one level above the repo root, at a directory that has never existed. It is
applied behind if …exists(), so this was not an error, it was a silent
fallback to Docker's default profile. redaction.py, schemas.py and
kb/storage_init.py all resolve docs/specs correctly with an
OPSPILOT_SPECS_DIR override for the installed case; this was the fourth site
and the only wrong one.

Fixing the path alone breaks the sandbox. That is why the profile itself had
never been looked at:

/bin/sh: can't fork: Operation not permitted

Its allowlist has fork and vfork and not clone. libc implements fork()
with clone, and on aarch64 the fork syscall does not exist at all — so
nothing could ever have started a process. The path bug had been hiding a
profile that could not run anything, and shipping the path fix on its own would
have turned a silently-inert control into an outage.

clone is now allowed with the namespace flags masked off, clone3 returns
ENOSYS so libc falls back to it. That is Docker's own arrangement and the only
enforceable one: clone3 passes flags in a struct a filter cannot dereference, so
the mask cannot apply to it.

With the profile genuinely loaded, unshare, chroot and mount are refused
by the filter and not only by the dropped capabilities — 262 allowed syscalls,
deny by default, against Docker's default denylist of ~44.

Why nothing caught any of this

Every sandbox test asserts on the argv we hand docker. Argv is a claim.

tests/test_sandbox_containment.py runs real commands through the real engine
and reads the kernel back. It is requires_docker and self-skips without a
daemon or the image, so CI's selection is unchanged.

One test in it needs no daemon, and it is the one that matters. The
containment probes cannot distinguish our profile from Docker's default — both
deny what they probe, which is exactly why all of them passed for the profile's
entire silent life. I checked: the whole suite is green on the pre-fix code.
test_the_seccomp_policy_is_where_the_code_looks_for_it is the one that fails
there, and it runs everywhere.

Not verified, and left open

• 32-bit sub-architectures. archMap claims SCMP_ARCH_ARM and
  SCMP_ARCH_X86, where modern libc uses clock_gettime64; it was missing and
  is added on that reasoning alone. There is no 32-bit host here. Everything
  else was verified on aarch64 against alpine:3.19.
• The command runs as root inside the container. There is no --user flag,
  though --tmpfs=…,uid=1000 says someone intended one. With no capabilities,
  no new privileges, a read-only root and a deny-by-default filter this is
  heavily defanged — but it is weaker than the argv implies, and adding --user
  could break a diagnostic that expects to read something root-only. A decision,
  not something to slip into this diff.
• _note_default in the profile claimed it "tightens things further on top of
  the default". Docker takes one profile and defaultAction: SCMP_ACT_ERRNO
  replaces the default outright, so a reader would have assumed protections that
  are not there. Corrected.

Verification

pytest -m "not slow and not requires_ollama" — CI's selection — 1372 passed.
-m requires_docker 12 passed. ruff, ruff format, mypy(154) clean.

🤖 Generated with Claude Code