marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

search-with-proof: root-no-userns isolation mode for gVisor

Browse Source 
The kube-ax probe showed bwrap cannot map uids in gVisor as an unprivileged user.
As root (gVisor is the outer boundary) the sandbox uses pid/ipc/uts/net/mount
namespaces without a user namespace and drops the artefact to its own uid via
setpriv; the mode is recorded. The probe reports each namespace kind separately.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
Marius Ciepluch
2026-10-05 15:00:25 +02:00
co-authored by Claude Opus 5.5
parent e6871fef9a
commit 03857c9bec
9 changed files with 308 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/test_search_image.py
+3
View File
@@ -10,6 +10,9 @@ def test_image_matches_runner_and_publishes_digest():
assert runner in engine and runner in image
for package in ("python3", "nodejs", "node-typescript", "php-cli", "sqlite3", "bubblewrap", "util-linux", "chromium"):
assert package in image
assert image.rsplit("USER ", 1)[1].startswith("root\n")
assert "--uid 10001 --gid 10001 search" in image
assert "setpriv --version" in image
assert "17-jdk" in image and "--no-install-recommends" in image
assert "rm -rf /var/lib/apt/lists/" in image
workflow_text = Path(".github/workflows/engine-image.yml").read_text()