feat(sandbox): Windows sandbox principals (foundation for #662, does not close it)

internal/cli/sandbox.go

@@ -22,7 +22,7 @@ const permissionProfileScopeNote = "permissionProfile is derived from this proce
 
 func runSandbox(args []string, stdout io.Writer, stderr io.Writer, deps appDeps) int {
 	if len(args) == 0 {
-		return writeExecUsageError(stderr, "sandbox subcommand required. Use `zero sandbox policy` or `zero sandbox grants list`.")
+		return writeExecUsageError(stderr, "sandbox subcommand required. Use `zero sandbox policy`, `zero sandbox exec`, or `zero sandbox grants list`.")
 	}
 	switch args[0] {
 	case "-h", "--help", "help":
@@ -36,6 +36,8 @@ func runSandbox(args []string, stdout io.Writer, stderr io.Writer, deps appDeps)
 		return runSandboxSetup(args[1:], stdout, stderr, deps)
 	case "check":
 		return runSandboxCheck(args[1:], stdout, stderr, deps)
+	case "exec":
+		return runSandboxExec(args[1:], stdout, stderr, deps)
 	case "grants":
 		return runSandboxGrants(args[1:], stdout, stderr, deps)
 	default:
@@ -174,10 +176,17 @@ func runSandboxSetup(args []string, stdout io.Writer, stderr io.Writer, deps app
 	if !setupHelper.Available() {
 		return writeAppError(stderr, "Windows sandbox setup helper is not available", exitProvider)
 	}
+	// Resolved here, in the shell the user typed `zero sandbox setup` into, and
+	// carried in the args. The helper may be launched elevated, and an elevated
+	// process does not inherit this shell's environment. Stated explicitly rather
+	// than left nil (which resolves the same way) because this is the call site
+	// the opt-in is about.
+	principalOptIn := zeroSandbox.WindowsSandboxPrincipalOptIn(nil)
 	setupArgs, err := zeroSandbox.BuildWindowsSandboxSetupArgs(zeroSandbox.WindowsSandboxSetupArgsOptions{
 		CommandCWD:        workspaceRoot,
 		WorkspaceRoots:    []string{workspaceRoot},
 		PermissionProfile: profile,
+		PrincipalOptIn:    &principalOptIn,
 	})
 	if err != nil {
 		return writeAppError(stderr, err.Error(), exitCrash)
@@ -646,6 +655,7 @@ Commands:
   policy      Inspect active sandbox policy and platform backend
   setup       Run native platform sandbox setup
   check       Evaluate the sandbox decision for a hypothetical tool action
+  exec        Run one command through the real sandbox
   grants      Manage persistent sandbox grants
 
 `)

internal/cli/sandbox_exec_cancel_test.go

@@ -0,0 +1,78 @@
+package cli
+
+import (
+	"context"
+	"io"
+	"os"
+	"runtime"
+	"testing"
+	"time"
+
+	zeroSandbox "github.com/Gitlawb/zero/internal/sandbox"
+)
+
+// longLivedPlan returns a plan whose child outlives the test unless something
+// terminates it.
+func longLivedPlan(t *testing.T) zeroSandbox.CommandPlan {
+	t.Helper()
+	plan := zeroSandbox.CommandPlan{Dir: t.TempDir()}
+	if runtime.GOOS == "windows" {
+		plan.Name = "cmd.exe"
+		plan.Args = []string{"/c", "ping -n 120 127.0.0.1 >NUL"}
+		return plan
+	}
+	plan.Name = "/bin/sh"
+	plan.Args = []string{"-c", "sleep 120"}
+	return plan
+}
+
+// CANCELLING THE WRAPPER HAS TO REACH THE COMMAND.
+//
+// The sandboxed command was started with a bare exec.Command().Run(): no
+// context, no forwarding, no shutdown path. A terminal masks that, because it
+// signals the whole foreground process group, but a supervisor or task runner
+// that sends SIGTERM to the wrapper's PID killed only Zero. The command kept
+// running, doing filesystem and network work after the caller considered the
+// task cancelled, and the deferred plan cleanup never ran.
+//
+// Driven with a real long-lived child and a real cancellation, asserting that
+// the call actually returns rather than that a field is set.
+func TestCancellingTheWrapperTerminatesTheSandboxedCommand(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+
+	done := make(chan int, 1)
+	go func() {
+		done <- runSandboxPlannedCommand(ctx, longLivedPlan(t), io.Discard, io.Discard)
+	}()
+
+	// Let the child actually start, or cancelling proves nothing.
+	time.Sleep(300 * time.Millisecond)
+	select {
+	case <-done:
+		t.Fatal("SETUP INVALID: the child exited on its own, so cancellation was not exercised")
+	default:
+	}
+
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(sandboxExecShutdownGrace + 10*time.Second):
+		t.Fatal("cancelling the wrapper did not terminate the sandboxed command; it would keep running after the caller gave up")
+	}
+}
+
+// And an uncancelled command still runs to completion and reports its own
+// status, or the fix above would be "kill everything immediately".
+func TestAnUncancelledSandboxedCommandStillReportsItsStatus(t *testing.T) {
+	plan := zeroSandbox.CommandPlan{Dir: t.TempDir()}
+	if runtime.GOOS == "windows" {
+		plan.Name = "cmd.exe"
+		plan.Args = []string{"/c", "exit 3"}
+	} else {
+		plan.Name = "/bin/sh"
+		plan.Args = []string{"-c", "exit 3"}
+	}
+	if code := runSandboxPlannedCommand(context.Background(), plan, io.Discard, os.Stderr); code != 3 {
+		t.Fatalf("exit code = %d, want the child's own 3", code)
+	}
+}

internal/cli/sandbox_exec_decision_test.go

@@ -0,0 +1,162 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/Gitlawb/zero/internal/config"
+	"github.com/Gitlawb/zero/internal/sandbox"
+)
+
+// governedNestedWorkspace is a workspace inside somebody else's repository: an
+// ancestor carries .git and the workspace itself does not. Setup plans no git
+// carveouts for it, which is why a repository must not be created there.
+func governedNestedWorkspace(t *testing.T) (ancestor, workspace string) {
+	t.Helper()
+	ancestor = t.TempDir()
+	if err := os.MkdirAll(filepath.Join(ancestor, ".git"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	workspace = filepath.Join(ancestor, "packages", "app")
+	if err := os.MkdirAll(filepath.Join(workspace, "sub dir"), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	return ancestor, workspace
+}
+
+func sandboxExecTestDeps(workspace string) appDeps {
+	return appDeps{
+		getwd: func() (string, error) { return workspace, nil },
+		resolveConfig: func(string, config.Overrides) (config.ResolvedConfig, error) {
+			return config.ResolvedConfig{}, nil
+		},
+		// No native runner. A command that got past the decision would run
+		// unwrapped, which is exactly what makes a missing refusal visible on
+		// disk instead of only in a return value.
+		selectSandboxBackend: func(sandbox.BackendOptions) sandbox.Backend {
+			return sandbox.Backend{Name: sandbox.BackendUnavailable, Fallback: true, Message: "no native sandbox in this test"}
+		},
+	}
+}
+
+// `zero sandbox exec` REFUSES WHAT A SESSION WOULD REFUSE.
+//
+// The command is documented as taking the path a shell tool takes. A shell tool
+// is evaluated by the engine and then planned; this went straight to the plan,
+// so nothing that lives in Evaluate applied. In a workspace governed by an
+// ancestor repository that is the nested-repository guard, and that guard is the
+// only thing standing in for the git carveouts setup deliberately does not plan
+// there. `zero sandbox exec -- git init` created the repository, writable config
+// and hooks included.
+//
+// Driven through the real CLI entry point, with a backend that would run the
+// command unwrapped if it were let through, and checked on disk: the refusal has
+// to come with the reason an operator can act on, and no repository may exist
+// afterwards. Reported by @jatmn.
+func TestSandboxExecRefusesToCreateARepositoryInAGovernedWorkspace(t *testing.T) {
+	for _, testCase := range []struct {
+		name string
+		argv []string
+		made []string
+	}{
+		{name: "git init", argv: []string{"git", "init"}, made: []string{".git"}},
+		{name: "git init behind -C and a quoted directory", argv: []string{"git", "-C", "sub dir", "init"}, made: []string{"sub dir/.git"}},
+		{name: "git init behind a shell launcher", argv: []string{"sh", "-c", "git init"}, made: []string{".git"}},
+		{name: "git init behind env", argv: []string{"env", "GIT_TRACE=0", "git", "init"}, made: []string{".git"}},
+		{name: "git clone", argv: []string{"git", "clone", "https://example.invalid/repo.git", "vendored"}, made: []string{"vendored"}},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			_, workspace := governedNestedWorkspace(t)
+			var stdout, stderr bytes.Buffer
+			args := append([]string{"sandbox", "exec", "--"}, testCase.argv...)
+			exitCode := runWithDeps(args, &stdout, &stderr, sandboxExecTestDeps(workspace))
+
+			for _, made := range testCase.made {
+				if _, err := os.Lstat(filepath.Join(workspace, filepath.FromSlash(made))); err == nil {
+					t.Errorf("%s exists after the command: the repository was created under the plain workspace grant", made)
+				}
+			}
+			if exitCode == exitSuccess {
+				t.Errorf("exit = %d for a command a session refuses; stderr:\n%s", exitCode, stderr.String())
+			}
+			if !strings.Contains(stderr.String(), "decision=deny") {
+				t.Errorf("stderr does not report the decision:\n%s", stderr.String())
+			}
+			if !strings.Contains(stderr.String(), "sits inside an existing git repository") {
+				t.Errorf("the refusal does not carry the nested-repository reason and its remedy:\n%s", stderr.String())
+			}
+			if strings.Contains(stderr.String(), "backend=") {
+				t.Errorf("a command plan was built for a refused command:\n%s", stderr.String())
+			}
+		})
+	}
+}
+
+// The decision is the engine's, asked the way a session asks it. These are the
+// controls: what must NOT be refused, so the gate above is not simply refusing
+// git, or refusing this workspace.
+func TestSandboxExecDecisionLeavesOrdinaryCommandsAlone(t *testing.T) {
+	_, governed := governedNestedWorkspace(t)
+	standalone := t.TempDir()
+
+	for _, testCase := range []struct {
+		name      string
+		workspace string
+		argv      []string
+	}{
+		{name: "an ordinary git command in the governed workspace", workspace: governed, argv: []string{"git", "status"}},
+		{name: "the words git init as one argument", workspace: governed, argv: []string{"echo", "git init"}},
+		{name: "git init in a workspace nobody governs", workspace: standalone, argv: []string{"git", "init"}},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			engine := sandbox.NewEngine(sandbox.EngineOptions{
+				WorkspaceRoot: testCase.workspace,
+				Policy:        sandbox.DefaultPolicy(),
+				Backend:       sandbox.Backend{Name: sandbox.BackendUnavailable, Fallback: true},
+			})
+			decision := sandboxExecDecision(context.Background(), engine, testCase.workspace, testCase.argv)
+			if decision.Action == sandbox.ActionDeny {
+				t.Fatalf("%q was refused: %s", strings.Join(testCase.argv, " "), decision.ErrorString())
+			}
+		})
+	}
+}
+
+// ARGV BECOMES COMMAND TEXT WITHOUT CHANGING WHAT IT SAYS. The engine classifies
+// a shell command by parsing its text, so the rendering decides what the
+// classifier sees. One argument has to stay one word, and a payload handed to a
+// shell launcher has to arrive as that payload.
+func TestSandboxExecCommandTextKeepsArgvIntact(t *testing.T) {
+	for _, testCase := range []struct {
+		name    string
+		argv    []string
+		want    string
+		gitInit bool
+	}{
+		{name: "bare words stay bare", argv: []string{"git", "init"}, want: "git init", gitInit: true},
+		{name: "a spaced argument is one word", argv: []string{"echo", "git init"}, want: "echo 'git init'"},
+		{name: "a launcher payload is analysed as a payload", argv: []string{"sh", "-c", "git init"}, want: "sh -c 'git init'", gitInit: true},
+		{name: "a quote inside an argument", argv: []string{"printf", "it's"}, want: `printf 'it'\''s'`},
+		{name: "substitution syntax is inert", argv: []string{"echo", "$(git init)"}, want: "echo '$(git init)'"},
+		{name: "an empty argument survives", argv: []string{"printf", ""}, want: "printf ''"},
+		{name: "a directory with a space", argv: []string{"git", "-C", "sub dir", "init"}, want: "git -C 'sub dir' init", gitInit: true},
+	} {
+		t.Run(testCase.name, func(t *testing.T) {
+			text := sandboxExecCommandText(testCase.argv)
+			if text != testCase.want {
+				t.Fatalf("command text = %q, want %q", text, testCase.want)
+			}
+			analysis := sandbox.AnalyzeCommand(text)
+			if analysis.TooComplex {
+				t.Fatalf("%q does not parse, so the classifier would treat a plain argv as obfuscated", text)
+			}
+			if analysis.GitInit != testCase.gitInit {
+				t.Errorf("%q: GitInit = %v, want %v", text, analysis.GitInit, testCase.gitInit)
+			}
+		})
+	}
+}

internal/cli/sandbox_exec_env_test.go

@@ -0,0 +1,72 @@
+package cli
+
+import (
+	"context"
+	"os"
+	"runtime"
+	"strings"
+	"testing"
+
+	zeroSandbox "github.com/Gitlawb/zero/internal/sandbox"
+)
+
+// envPrinterPlan returns a plan whose child prints its own environment, so the
+// assertion is about what the child received rather than about a field value.
+func envPrinterPlan(t *testing.T, env []string) zeroSandbox.CommandPlan {
+	t.Helper()
+	plan := zeroSandbox.CommandPlan{Dir: t.TempDir(), Env: env}
+	if runtime.GOOS == "windows" {
+		plan.Name = "cmd.exe"
+		plan.Args = []string{"/c", "set"}
+		return plan
+	}
+	plan.Name = "/bin/sh"
+	plan.Args = []string{"-c", "env"}
+	return plan
+}
+
+// A PLAN THAT SPECIFIES NO VARIABLES MUST NOT INHERIT EVERY VARIABLE.
+//
+// exec.Cmd reads a nil Env as "inherit this process's entire environment", which
+// is a different statement from "run with no variables". The plan owns its
+// environment: directCommandEnv and scrubSensitiveEnv return a slice they built,
+// and that slice is non-nil with length zero when every entry was sensitive.
+// Testing its length collapsed the two states and turned the strictest possible
+// answer into the loosest one.
+//
+// Not reachable through `zero sandbox exec` today, because the child environment
+// is os.Environ() and an environment holding only sensitive keys has no
+// %AppData%, so config resolution fails before the planner runs. Pinned anyway,
+// because the next caller that hands the plan a deliberately narrow environment
+// would silently inherit everything instead.
+func TestAnEmptyPlannedEnvironmentDoesNotInherit(t *testing.T) {
+	const marker = "ZZ_SANDBOX_ENV_MARKER"
+	t.Setenv(marker, "leaked-value")
+
+	var out strings.Builder
+	// Specified, and deliberately empty.
+	code := runSandboxPlannedCommand(context.Background(), envPrinterPlan(t, []string{}), &out, os.Stderr)
+	if code != 0 {
+		t.Fatalf("child exited %d: %s", code, out.String())
+	}
+	if strings.Contains(out.String(), marker) {
+		t.Fatalf("a plan specifying no environment leaked the caller's %s to the child:\n%s", marker, out.String())
+	}
+}
+
+// And a nil environment still inherits, which is the meaning the planner relies
+// on when it did not build one. Without this the fix above could be "never pass
+// the environment", which would break every ordinary command.
+func TestANilPlannedEnvironmentStillInherits(t *testing.T) {
+	const marker = "ZZ_SANDBOX_ENV_MARKER"
+	t.Setenv(marker, "inherited-value")
+
+	var out strings.Builder
+	code := runSandboxPlannedCommand(context.Background(), envPrinterPlan(t, nil), &out, os.Stderr)
+	if code != 0 {
+		t.Fatalf("child exited %d: %s", code, out.String())
+	}
+	if !strings.Contains(out.String(), marker) {
+		t.Fatalf("a nil planned environment stopped inheriting, which changes the meaning the planner relies on:\n%s", out.String())
+	}
+}