Repository navigation
Keep COMPUTER_TOKEN out of reach of the computer's own children - #892
Open
prysthedev wants to merge 1 commit into
Open
prysthedev wants to merge 1 commit into
prysthedev wants to merge 1 commit into
Conversation
A Bot's shell commands are given a scrubbed environment, but they run as the same user as the computer process, and so do Chromium and Xvfb, which Playwright launches with the full process environment. Any of them could read the token back from /proc/<pid>/environ, either the computer's own or the browser's. With the token, a command can call the computer API directly, which bypasses the server's gateway, and on a computer several people share it can act on any seat. The computer now removes COMPUTER_TOKEN from process.env as it reads it, so no child inherits it, and marks itself non-dumpable on Linux (PR_SET_DUMPABLE), so a same-user process without CAP_SYS_PTRACE cannot read its environment or memory. COMPUTER_DUMPABLE=on opts out for debugging; a failure to set it is logged rather than fatal. Not covered: a command that can reach root with CAP_SYS_PTRACE, or the container's environment files (the one-container image's apt sudo rule reaches root). Per-computer tokens in supervisor mode would be the next layer of defence.
prysthedev
requested review from
MikeRyanDev,
davidmckayv,
dustywusty,
guidovizoso,
mxmzb,
samjulien and
tylerslaton
as code owners
October 29, 2026 23:37
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A Bot's shell commands get a scrubbed environment (
shell.ts), but they run as the same user as the computer process, and so do Chromium and Xvfb, which Playwright launches with the full process environment. A command could readCOMPUTER_TOKENback from another process's/proc/<pid>/environ. With it, a command can call the computer API directly, outside the server's gateway, and on a computer several people share, for any seat.Changes:
agent-computer/src/secret-env.ts:takeSecretFromEnvreads the token and deletes it fromprocess.env, so no child started afterwards inherits it.hideProcessFromChildrensetsPR_SET_DUMPABLE=0throughbun:ffion Linux, so a same-user process withoutCAP_SYS_PTRACEcannot read the computer's environment or memory.COMPUTER_DUMPABLE=onopts out; a failure is logged, not fatal.index.tsuses both before anything is spawned.docs/architecture.mdsays what this does and does not cover.Not covered: root with
CAP_SYS_PTRACE, or the container's own environment files (the one-container image's apt sudo rule reaches root). A per-computer token in supervisor mode would be a sensible follow-up.Tests:
agent-computer/tests/secret-env.test.ts.