[tappress]

Closes #796

Problem

On Linux, network.allowAllUnixSockets: true is the only way to let a sandboxed command create Unix sockets, and it skips apply-seccomp entirely. Besides allowing AF_UNIX, that also:

• unblocks AF_VSOCK (documented in the option's description);
• unblocks io_uring;
• removes the helper's nested PID namespace, so the command can see bwrap's init, the shell wrapper and socat;
• removes the namespaces filter (--disable-userns still applies where bubblewrap supports it);
• removes write-violation monitoring, because the USER_NOTIF observer is installed by the helper.

The case that needs Unix sockets is a sandbox nested inside srt: srt itself, or Claude Code with its sandbox on. The inner srt has to create the Unix socket it bridges its proxies through. With today's options, an outer srt can only allow that by giving up everything above.

Change

• seccomp-unix-block.c gains a vsock rule set: unix without the AF_UNIX rule.
• apply-seccomp reads SRT_ALLOW_UNIX_SOCKETS once, as it does SRT_ALLOW_NESTED_USERNS.
  • With 1, it installs vsock in place of unix.
  • The variable is removed from the command's environment.
  • Nothing else the helper does changes.
• New option network.allowUnixSocketCreation (Linux only; ignored when allowAllUnixSockets is true).
  • The wrap always sets the variable explicitly in the helper's command prefix.
  • It clears any inherited value with --unsetenv, the same way as SRT_ALLOW_NESTED_USERNS.
• allowAllUnixSockets is unchanged. The README presents it as the way to run without the helper, for example on unsupported architectures.
• README: the Unix socket settings table, the Linux notes and the seccomp limitations paragraph.

Compatibility: with the option off, nothing changes. The generated unix and namespaces filters are byte-for-byte identical to v0.0.81 (checked on x86_64).

Question for maintainers

Would you rather allowAllUnixSockets itself kept the helper? That is arguably what the name promises. I made a separate opt-in because changing it would alter behaviour for existing users, including anyone relying on it to skip the helper.

Testing

All on Ubuntu 24.04 under WSL2 (kernel 6.6), x86_64, Bun 1.4.2. Written against v0.0.81, then rebased onto main (98a4016), where the six related test files pass: 221 tests, 0 failures.

• New tests: test/sandbox/seccomp-unix-socket-creation.test.ts (8 tests) covers:

  • the helper on its own: 1 versus other values, and removal of the variable;
  • the wrap prefix and --unsetenv;
  • an end-to-end run under the wrap;
  • blocked-write reporting with the option on;
  • the option read through SandboxManager in a network-restricted sandbox.

  5 of the 8 fail against the v0.0.81 helper.

• Config validation: a test that the option is a boolean and absent unless given.

• Full suite: 4064 pass, 78 fail. The same 78 tests fail without this change, all in 7 files that don't touch this code: rules-through-links-on-every-runtime, control-fd, credential-mask*, tls-terminate-tunnel-ends, default-write-paths. They look environment-related.

• Nesting: Claude Code (2.1.280) with sandbox.enabled and failIfUnavailable: true, inside srt with allowUnixSocketCreation and allowNestedUserNamespaces.

  • Claude's sandbox starts and enforces its own policy: a write to /tmp, which the outer policy allows, is refused.
  • The outer helper still refuses AF_VSOCK and io_uring.
  • With the outer srt's default policy, Claude reports EPERM ... listen srt-mux-*.sock and refuses to run Bash.

• WSL2: a Windows executable in a writable directory runs on the host through interop under allowAllUnixSockets. Under allowUnixSocketCreation, interop fails at UtilBindVsockAnyPort: socket failed.

Not tested: arm64 (the vsock filter for aarch64 generates, but no arm64 build was run), and macOS (the option is ignored there).

🤖 Generated with Claude Code

[tappress]

@ronleizrowice-ant this follows the SRT_ALLOW_NESTED_USERNS pattern from #588. Would you be the right person to look at it, or is there someone better?