marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: root-no-userns isolation mode for gVisor

Browse Source 
The kube-ax probe showed bwrap cannot map uids in gVisor as an unprivileged user.
As root (gVisor is the outer boundary) the sandbox uses pid/ipc/uts/net/mount
namespaces without a user namespace and drops the artefact to its own uid via
setpriv; the mode is recorded. The probe reports each namespace kind separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 15:00:25 +02:00
co-authored by Claude Opus 5.5
parent e6871fef9a
commit 03857c9bec
9 changed files with 308 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
plane/Dockerfile.search-task
+6 -4
View File
@@ -23,8 +23,10 @@ RUN python3 -m venv /venv \
&& /venv/bin/pip install --no-cache-dir . \
&& python3 --version && node --version && tsc --version && php --version \
&& javac -version && sqlite3 --version && bwrap --version \
&& prlimit --version && nsenter --version && chromium --version
# Browser sandbox requires a non-root caller; the AX runner needs no root privileges.
RUN useradd --create-home --uid 10001 search
USER search
&& setpriv --version && prlimit --version && nsenter --version && chromium --version
# Dedicated identity for artefacts, apps and Chromium; the verifier keeps root.
RUN groupadd --gid 10001 search \
&& useradd --create-home --uid 10001 --gid 10001 search
# gVisor is the outer boundary; inner isolation needs root without user namespaces.
USER root
# Do not replace the AX runner's ENTRYPOINT or CMD.