feat(scripts): enforce build jails on linux by jdx · Pull Request #350 · endevco/aube

jdx · 2026-04-27T20:45:49Z

Summary

add Linux native jailed-build enforcement with Landlock write restrictions and a seccomp network filter
run Linux jail setup in the child process before exec so the parent aube process is not restricted
keep network: true as the package-level escape hatch and fail closed when the Linux jail cannot be fully enforced
update jailed-build docs/settings reference and extend allow-builds BATS coverage to Linux

Validation

cargo check -p aube-scripts
cargo test -p aube-scripts
cargo test -p aube-settings meta::tests::workspace_yaml_keys_deserialize_onto_workspace_config
cargo build -p aube
mise run test:bats test/allow_builds.bats
cargo fmt --check
cargo clippy --all-targets -- -D warnings
git diff --check
AUBE_ENABLE_GLOBAL_VIRTUAL_STORE=false mise run docs:build

Note: plain mise run docs:build failed before VitePress because docs install hit the existing global virtual store missing-index path for @algolia/abtesting@1.16.2; rerunning with the documented per-project install override passed.

Note

Medium Risk
Adds Linux-native sandboxing for dependency lifecycle scripts using landlock and seccomp, which is security-sensitive and could break builds on kernels/architectures that can’t fully enforce the policy.

Overview
Adds Linux-native enforcement for jailBuilds by applying Landlock filesystem rules and a seccomp network filter in the child process via pre_exec, so the parent aube process stays unrestricted and scripts fail closed if the jail can’t be fully enforced.

Updates the jailed-build environment to point TMPDIR/TMP/TEMP at the temporary jail home, wires in new Linux-only deps (landlock, seccompiler, libc), and refreshes docs/settings/tests to treat native jail enforcement as supported on macOS and Linux (including BATS coverage for write/network denial and permission grants).

^{Reviewed by Cursor Bugbot for commit cd29edf. Bugbot is set up for automated code reviews on this repo. Configure here.}

greptile-apps · 2026-04-27T20:50:04Z

Greptile Summary

Implements Linux-native build jail enforcement using Landlock filesystem write restrictions (ABI v2, kernel ≥ 5.19) and a seccomp network filter that blocks socket()/socketpair() for AF_INET/AF_INET6 in the child process via pre_exec before exec. Previously-flagged issues — PR_SET_NO_NEW_PRIVS ordering, ABI V3 blocking LTS kernels, and missing /tmp write access — are all correctly addressed in this revision.

Confidence Score: 5/5

Safe to merge; all previously flagged P1s are resolved and the remaining finding is a minor documentation gap about seccomp coverage scope.

The three P1s from prior review rounds (PR_SET_NO_NEW_PRIVS placement, ABI V3 vs V2, /tmp write access) are all addressed. The only new finding is a P2 about connect/send syscalls being unfiltered — exploitable only via inherited non-O_CLOEXEC socket FDs, which Tokio's O_CLOEXEC discipline makes highly unlikely. P2-only result leaves confidence at 5.

crates/aube-scripts/src/linux_jail.rs — the seccomp filter scope note; no blocking issue.

Important Files Changed

Filename	Overview
crates/aube-scripts/src/linux_jail.rs	New file: implements Landlock ABI V2 write restrictions and a seccomp network filter (socket/socketpair for AF_INET/AF_INET6 only). PR_SET_NO_NEW_PRIVS is correctly set at the top of apply_landlock before restrict_self(). Minor gap: connect/bind/send syscalls are not filtered, leaving a theoretical path for inherited non-O_CLOEXEC socket FDs.
crates/aube-scripts/src/lib.rs	Adds Linux-specific spawn_jailed_shell with pre_exec applying Landlock and seccomp. TMPDIR/TMP/TEMP redirected to jail home in apply_jail_env; std::env::temp_dir() used in Landlock policy to allow writes to the system temp dir for scripts that hardcode /tmp.
Cargo.toml	Adds landlock 0.4, libc 0.2, and seccompiler 0.5 to workspace dependencies; libc is deduplicated from aube/Cargo.toml.
test/allow_builds.bats	Extends macOS-only jail tests to Linux (platform skip guard updated); adds auth-token clearing to the baseline install test to avoid credential leakage in CI.
docs/package-manager/jailed-builds.md	Documents Linux Landlock ABI v2 (kernel ≥ 5.19) and the truncate caveat for kernel ≥ 6.2; accurately describes fail-closed behavior.
crates/aube-settings/settings.toml	Updates jailBuilds and jailBuildPermissions docs to reflect write allowlist working on both macOS and Linux.

_{Reviews (3): Last reviewed commit: "fix(scripts): harden linux build jail pe..." | Re-trigger Greptile}

greptile-apps · 2026-04-27T20:50:09Z

+    pub fn apply_landlock(jail: &ScriptJail, home: &Path) -> Result<(), String> {
+        let abi = ABI::V3;
+        let read_access = AccessFs::from_read(abi);
+        let full_access = read_access | AccessFs::from_write(abi);
+        let mut ruleset = Ruleset::default()
+            .set_compatibility(CompatLevel::HardRequirement)
+            .handle_access(full_access)
+            .map_err(|e| format!("failed to create jail ruleset: {e}"))?
+            .create()
+            .map_err(|e| format!("failed to create jail ruleset: {e}"))?;


Landlock ABI::V3 requires kernel ≥ 6.2, blocking common LTS distros

ABI::V3 was introduced in Linux 6.2 (it added LANDLOCK_ACCESS_FS_TRUNCATE). Combined with CompatLevel::HardRequirement, any kernel between 5.13 and 6.1 will fail the handle_access call, causing all jailed builds to fail-close. This covers widely deployed distributions: Ubuntu 22.04 LTS ships kernel 5.15, Debian 12 ("Bookworm") ships 6.1, RHEL/Rocky/AlmaLinux 9 ship 5.14. Users on those systems who enable jailBuilds: true will see a hard error even though Landlock is fully available and capable of enforcing the meaningful access controls (V1/V2 rights cover almost all of the policy). At minimum the required kernel version (≥ 6.2) should be documented in jailed-builds.md; optionally consider downgrading to ABI::V2 (kernel ≥ 5.19) which is sufficient for the write-restriction goal and covers more of the installed base.

- set PR_SET_NO_NEW_PRIVS before landlock restrict_self() and on every code path so a setuid exec cannot escape, including network: true - add std::env::temp_dir() to the writable allowlist for parity with the macOS Seatbelt /tmp + /private/tmp rules - target Landlock ABI v2 (kernel >= 5.19) so Ubuntu 22.04, Debian 12, RHEL 9 stop fail-closing; v3 only added LANDLOCK_ACCESS_FS_TRUNCATE Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

greptile-apps Bot reviewed Apr 27, 2026

View reviewed changes

feat(scripts): enforce build jails on linux

751729b

jdx force-pushed the codex/linux-jailed-builds branch from 0c83150 to 751729b Compare April 27, 2026 20:51

greptile-apps Bot reviewed Apr 27, 2026

View reviewed changes

Comment thread crates/aube-scripts/src/linux_jail.rs

jdx merged commit 6ff9297 into main Apr 27, 2026
17 checks passed

jdx deleted the codex/linux-jailed-builds branch April 27, 2026 23:01

greptile-apps Bot mentioned this pull request Apr 27, 2026

chore: release v1.4.0 #351

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(scripts): enforce build jails on linux#350

feat(scripts): enforce build jails on linux#350
jdx merged 2 commits intomainfrom
codex/linux-jailed-builds

jdx commented Apr 27, 2026 •

edited by cursor Bot

Loading

Uh oh!

greptile-apps Bot commented Apr 27, 2026 •

edited

Loading

Uh oh!

Uh oh!

greptile-apps Bot Apr 27, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jdx commented Apr 27, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

greptile-apps Bot commented Apr 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

Uh oh!

greptile-apps Bot Apr 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Apr 27, 2026 •

edited by cursor Bot

Loading

greptile-apps Bot commented Apr 27, 2026 •

edited

Loading