fix(interface): refuse container-runtime dirs and docker.sock mounts

[SashaMIT]

Summary

Fixes #1058.

check_mountable_dir already refuses system trees and credential directory names (including .docker), but still admitted:

• /run, /var/run, and Darwin /private/var/run ( /var is exact-root only)
• common container data roots under /var/lib/{docker,containers,containerd}
• directories whose direct children include docker.sock / podman.sock / containerd.sock / crio.sock

Those paths are bind-mounted writable into the sandbox. Mounting a host Docker/Podman API socket is classic host control from inside the sandbox.

Attacker model

An operator (or poisoned target list) points --target at /var/run or a directory that contains docker.sock. The sandbox already has shell and elevated network caps, so the socket becomes host Docker API access.

Threat-model note

This tightens an admission control the product already claims to enforce for system mounts. Distinct from #1054 / #1055 (workspace mounts skipping admission).

Test plan

• test_check_mountable_dir_rejects_var_run
• test_check_mountable_dir_rejects_runtime_socket_dir
• Full tests/test_local_sources.py green locally (28 passed)
• Revert-tested: removing the new denylist entries fails the two new tests

Made with Cursor

[greptile-apps]

Greptile Summary

This PR strengthens local-target admission to reject container-runtime directories and directories containing recognized runtime socket names.

• Adds /run, platform runtime directories, and common container data roots to the forbidden mount trees.
• Inspects direct children for recognized Docker, Podman, containerd, and CRI-O socket names.
• Adds tests for /var/run and direct-child runtime socket rejection.

Confidence Score: 3/5

This PR should not merge until directory-inspection failures reject the mount rather than allowing a potentially privileged runtime socket into the sandbox.

The new socket guard silently accepts directories when enumeration raises OSError, after which the accepted source is mounted writable into the sandbox.

Files Needing Attention: strix/interface/utils.py

Security Review

The socket inspection fails open on directory-enumeration errors, so an unlistable directory can still expose a container-runtime socket through the writable sandbox bind mount.

Important Files Changed

Filename	Overview
strix/interface/utils.py	Adds container-runtime path and socket admission checks, but enumeration errors bypass the new socket protection.
tests/test_local_sources.py	Covers forbidden runtime trees and readable direct-child socket files, but not the fail-open enumeration-error path.

Prompt To Fix All With AI

### Issue 1
strix/interface/utils.py:1444-1445
**Socket inspection fails open**

If a target directory outside the forbidden trees contains a runtime socket but directory enumeration raises `OSError`, this branch treats the failed inspection as if no socket exists. The accepted directory is then mounted writable into the sandbox, exposing the host container-runtime API. **How this was verified:** The enumeration error is converted to `socket_child = None`, while accepted local sources become writable bind mounts.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(interface): refuse container-runtime..." | Re-trigger Greptile}

[greptile-apps]

Socket inspection fails open

If a target directory outside the forbidden trees contains a runtime socket but directory enumeration raises OSError, this branch treats the failed inspection as if no socket exists. The accepted directory is then mounted writable into the sandbox, exposing the host container-runtime API. How this was verified: The enumeration error is converted to socket_child = None, while accepted local sources become writable bind mounts.

Knowledge Base Used: CLI and Runner: from strix invocation to a running scan

Prompt To Fix With AI

This is a comment left during a code review.
Path: strix/interface/utils.py
Line: 1444-1445

Comment:
**Socket inspection fails open**

If a target directory outside the forbidden trees contains a runtime socket but directory enumeration raises `OSError`, this branch treats the failed inspection as if no socket exists. The accepted directory is then mounted writable into the sandbox, exposing the host container-runtime API. **How this was verified:** The enumeration error is converted to `socket_child = None`, while accepted local sources become writable bind mounts.

**Knowledge Base Used:** [CLI and Runner: from `strix` invocation to a running scan](https://app.greptile.com/strix-org-3/-/custom-context/knowledge-base/usestrix/strix/-/docs/cli-and-runner.md)

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.