Repository navigation
fix(sandbox): hide host secrets from sandboxed shell commands - #109
Draft
cursor[bot] wants to merge 1 commit into
Draft
cursor[bot] wants to merge 1 commit into
cursor[bot] wants to merge 1 commit into
Conversation
The command child inherited the agent environment, so printenv inside sh -c returned provider API keys and bot tokens on the tool stdout channel. Replace that environment with PATH, locale, and workspace HOME before execl. Co-authored-by: esadrianno <esadrianno@gmail.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bug and impact
With
[sandbox] enabled = true(the example config),sandbox_execransh -cwith the agent process environment. Provider keys and channel tokens are loaded from that environment (ANTHROPIC_API_KEY,OPENAI_API_KEY,TAVILY_API_KEY, Telegram and Discord tokens).printenvis not on the shell blocklist, and Landlock plus the network namespace do not hideenviron. A prompt-injected or untrusted channel message that asks the agent to runprintenvreceives those secrets on the tool stdout, which is then sent back to the model and can be echoed to the chat.Root cause
sandbox_execcalledexecl("/bin/sh", "sh", "-c", cmd)without replacing the environment inherited acrossfork.Fix
Immediately before
execl, the command child replaces its environment. It keepsPATH,LANG,LC_ALL,LC_CTYPE,TERM, andTZ, and setsHOMEto the workspace when one is configured. API keys, bot tokens, andLD_*variables are not passed through.Validation
test_command_does_not_inherit_host_secrets. It failed on the old binary (printenvprintedleaked_via_env) and passes after the fix, including/proc/1/environ.make test_sandboxandmake test_shellpassed.Sandbox-off shell execution is unchanged. That path is documented as not a security boundary.