marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-19 04:59:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: root-no-userns isolation mode for gVisor

Browse Source 
The kube-ax probe showed bwrap cannot map uids in gVisor as an unprivileged user.
As root (gVisor is the outer boundary) the sandbox uses pid/ipc/uts/net/mount
namespaces without a user namespace and drops the artefact to its own uid via
setpriv; the mode is recorded. The probe reports each namespace kind separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 15:00:25 +02:00
co-authored by Claude Opus 5.5
parent e6871fef9a
commit 03857c9bec
9 changed files with 308 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/openultrasast/search/worker.py
+14 -3
View File
@@ -251,6 +251,7 @@ class Worker:
scratch_bytes=int(self.limits["disk_bytes"]),
)
return {
"isolation_mode": _sandbox.isolation_mode(),
"exit_code": result.exit_code,
"stdout": result.stdout[:MAX_OUTPUT],
"stderr": result.stderr[:MAX_OUTPUT],
@@ -362,12 +363,22 @@ class Worker:
result = self.explore(task, meter)
else:
raise ValueError("verify requires the trusted verifier executor")
return {"status": "ok", **result, "cost_usd": meter.spent}
return {"status": "ok", **result, "cost_usd": meter.spent, "isolation_mode": _sandbox.isolation_mode()}
except _sandbox.IsolationUnavailable:
return {"status": "instrument_failure", "failure": "sandbox isolation unavailable", "cost_usd": meter.spent}
return {
"status": "instrument_failure",
"failure": "sandbox isolation unavailable",
"cost_usd": meter.spent,
"isolation_mode": _sandbox.isolation_mode(),
}
except Exception as exc:
# Provider exceptions can contain keys/URLs. Never persist their text.
return {"status": "execution_failure", "failure": type(exc).__name__, "cost_usd": meter.spent}
return {
"status": "execution_failure",
"failure": type(exc).__name__,
"cost_usd": meter.spent,
"isolation_mode": _sandbox.isolation_mode(),
}
def main() -> None: