Harden sandbox bind source validation

mmaps · mmaps · commit 5441c032b1e5 · 2026-06-09T18:04:15.000Z
diff --git a/src/agents/sandbox-create-args.test.ts b/src/agents/sandbox-create-args.test.ts
@@ -253,6 +253,12 @@ describe("buildSandboxCreateArgs", () => {
       cfg: createSandboxConfig({}, ["/run:/run"]),
       expected: /blocked path/,
     },
+    {
+      name: "bind source covering Docker socket directory",
+      containerName: "openclaw-sbx-covers-docker-socket-dir",
+      cfg: createSandboxConfig({}, ["/var:/var"]),
+      expected: /covers blocked path/,
+    },
     {
       name: "network host mode",
       containerName: "openclaw-sbx-host",
diff --git a/src/agents/sandbox/validate-sandbox-security.test.ts b/src/agents/sandbox/validate-sandbox-security.test.ts
@@ -36,8 +36,22 @@ describe("getBlockedBindReason", () => {
     expectBlockedTargetReason("/var/run:/var/run:ro");
   });
 
-  it("does not block /var by default", () => {
-    expect(getBlockedBindReason("/var:/var")).toBeNull();
+  it("blocks parent sources that cover blocked descendants", () => {
+    const reason = getBlockedBindReason("/var:/var");
+    expect(reason).toMatchObject({
+      kind: "covers",
+      blockedPath: "/var/run",
+    });
+  });
+
+  it("blocks home parent sources that cover credential descendants", () => {
+    withEnv({ HOME: "/home/tester" }, () => {
+      const reason = getBlockedBindReason("/home/tester:/mnt/home:ro");
+      expect(reason).toMatchObject({
+        kind: "covers",
+        blockedPath: "/home/tester/.aws",
+      });
+    });
   });
 
   it("blocks sensitive home credential paths", () => {
@@ -165,8 +179,24 @@ describe("validateBindMounts", () => {
     }
   });
 
-  it("allows parent mounts that are not blocked", () => {
-    expect(validateBindMounts(["/var:/var"])).toBeUndefined();
+  it("allows parent mounts that do not cover blocked descendants", () => {
+    expect(validateBindMounts(["/var/data:/data"])).toBeUndefined();
+  });
+
+  it("blocks allowed source roots that cover blocked descendants", () => {
+    expect(() =>
+      validateBindMounts(["/var:/var"], {
+        allowedSourceRoots: ["/var"],
+      }),
+    ).toThrow(/covers blocked path "\/var\/run"/);
+
+    withEnv({ HOME: "/home/tester" }, () => {
+      expect(() =>
+        validateBindMounts(["/home/tester:/mnt/home:ro"], {
+          allowedSourceRoots: ["/home/tester"],
+        }),
+      ).toThrow(/covers blocked path "\/home\/tester\/\.aws"/);
+    });
   });
 
   it("blocks sensitive home credential binds", () => {
diff --git a/src/agents/sandbox/validate-sandbox-security.ts b/src/agents/sandbox/validate-sandbox-security.ts
@@ -143,12 +143,15 @@ function getBlockedReasonForSourcePath(
   if (sourceNormalized === "/") {
     return { kind: "covers", blockedPath: "/" };
   }
-  const sourceKey = getSandboxHostPathPolicyKey(sourceNormalized);
   for (const blocked of blockedHostPaths) {
-    const blockedKey = getSandboxHostPathPolicyKey(blocked);
-    if (sourceKey === blockedKey || sourceKey.startsWith(`${blockedKey}/`)) {
+    if (isPathInsidePolicyPath(blocked, sourceNormalized)) {
       return { kind: "targets", blockedPath: blocked };
     }
+    // Parent mounts can expose blocked descendants such as HOME credentials or
+    // the Docker socket directory even when the source root itself is allowed.
+    if (isPathInsidePolicyPath(sourceNormalized, blocked)) {
+      return { kind: "covers", blockedPath: blocked };
+    }
   }
 
   return null;
@@ -217,13 +220,14 @@ function normalizeAllowedRoots(roots: string[] | undefined): string[] {
   return [...expanded];
 }
 
-function isPathInsidePosix(root: string, target: string): boolean {
-  if (root === "/") {
-    return true;
-  }
+function isPathInsidePolicyPath(root: string, target: string): boolean {
   const rootKey = getSandboxHostPathPolicyKey(root);
   const targetKey = getSandboxHostPathPolicyKey(target);
-  return targetKey === rootKey || targetKey.startsWith(`${rootKey}/`);
+  if (rootKey === "/") {
+    return true;
+  }
+  const rootPrefix = rootKey.endsWith("/") ? rootKey : `${rootKey}/`;
+  return targetKey === rootKey || targetKey.startsWith(rootPrefix);
 }
 
 function getOutsideAllowedRootsReason(
@@ -234,7 +238,7 @@ function getOutsideAllowedRootsReason(
     return null;
   }
   for (const root of allowedRoots) {
-    if (isPathInsidePosix(root, sourceNormalized)) {
+    if (isPathInsidePolicyPath(root, sourceNormalized)) {
       return null;
     }
   }
@@ -252,7 +256,7 @@ function getReservedTargetReason(bind: string): BlockedBindReason | null {
   }
   const target = normalizeHostPath(targetRaw);
   for (const reserved of RESERVED_CONTAINER_TARGET_PATHS) {
-    if (isPathInsidePosix(reserved, target)) {
+    if (isPathInsidePolicyPath(reserved, target)) {
       return {
         kind: "reserved_target",
         targetPath: target,
