more strict bubblewrap sandbox, tweak specs

Author: leafo

runner/bubblewrap_linux.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 )
 
@@ -77,6 +78,7 @@ func (br *bubblewrapRunner) Run() error {
 	if xdgRuntimeDir == "" {
 		xdgRuntimeDir = os.Getenv("XDG_RUNTIME_DIR")
 	}
+	createdSandboxDirs := make(map[string]struct{})
 
 	// X11
 	if _, err := os.Stat("/tmp/.X11-unix"); err == nil {
@@ -92,24 +94,24 @@ func (br *bubblewrapRunner) Run() error {
 		if waylandDisplay != "" {
 			socketPath := xdgRuntimeDir + "/" + waylandDisplay
 			if _, err := os.Stat(socketPath); err == nil {
+				ensureSandboxParentDirs(&args, createdSandboxDirs, socketPath)
 				args = append(args, "--ro-bind", socketPath, socketPath)
 			}
 		}
 
 		// PulseAudio
 		pulsePath := xdgRuntimeDir + "/pulse"
 		if _, err := os.Stat(pulsePath); err == nil {
+			ensureSandboxParentDirs(&args, createdSandboxDirs, pulsePath)
 			args = append(args, "--ro-bind", pulsePath, pulsePath)
 		}
 
 		// PipeWire
 		pipewirePath := xdgRuntimeDir + "/pipewire-0"
 		if _, err := os.Stat(pipewirePath); err == nil {
+			ensureSandboxParentDirs(&args, createdSandboxDirs, pipewirePath)
 			args = append(args, "--ro-bind", pipewirePath, pipewirePath)
 		}
-
-		// Bind XDG_RUNTIME_DIR itself as tmpfs so paths under it work
-		args = append(args, "--bind", xdgRuntimeDir, xdgRuntimeDir)
 	}
 
 	// Namespace isolation (keep network shared)
@@ -185,3 +187,28 @@ func envLookup(env []string, key string) string {
 	}
 	return ""
 }
+
+func ensureSandboxParentDirs(args *[]string, seen map[string]struct{}, path string) {
+	cleanPath := filepath.Clean(path)
+	if cleanPath == "" || cleanPath == "." || !filepath.IsAbs(cleanPath) {
+		return
+	}
+
+	parent := filepath.Dir(cleanPath)
+	if parent == "" || parent == "." || parent == "/" {
+		return
+	}
+
+	current := "/"
+	for _, part := range strings.Split(strings.TrimPrefix(parent, "/"), "/") {
+		if part == "" {
+			continue
+		}
+		current = filepath.Join(current, part)
+		if _, ok := seen[current]; ok {
+			continue
+		}
+		*args = append(*args, "--dir", current)
+		seen[current] = struct{}{}
+	}
+}

runner/bubblewrap_linux_test.go

@@ -0,0 +1,35 @@
+//go:build linux
+
+package runner
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestEnsureSandboxParentDirs(t *testing.T) {
+	var args []string
+	seen := make(map[string]struct{})
+
+	ensureSandboxParentDirs(&args, seen, "/run/user/1000/wayland-0")
+	assert.Equal(t, []string{
+		"--dir", "/run",
+		"--dir", "/run/user",
+		"--dir", "/run/user/1000",
+	}, args)
+
+	ensureSandboxParentDirs(&args, seen, "/run/user/1000/pipewire-0")
+	assert.Equal(t, []string{
+		"--dir", "/run",
+		"--dir", "/run/user",
+		"--dir", "/run/user/1000",
+	}, args)
+
+	ensureSandboxParentDirs(&args, seen, "relative/path.sock")
+	assert.Equal(t, []string{
+		"--dir", "/run",
+		"--dir", "/run/user",
+		"--dir", "/run/user/1000",
+	}, args)
+}

runner/runner_test.go

@@ -209,19 +209,34 @@ func TestContextCancellation(t *testing.T) {
 	}
 }
 
-func skipIfNoBubblewrap(t *testing.T) {
+func skipIfNoBubblewrap(t *testing.T) string {
 	t.Helper()
 	if runtime.GOOS != "linux" {
 		t.Skip("bubblewrap tests only run on Linux")
 	}
-	if _, err := exec.LookPath("bwrap"); err != nil {
+	bwrapPath, err := exec.LookPath("bwrap")
+	if err != nil {
 		t.Skip("bwrap not found in PATH")
 	}
+
+	// Bubblewrap can be present but unusable in restricted environments.
+	probeCtx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
+	defer cancel()
+	probeCmd := exec.CommandContext(probeCtx, bwrapPath, "--unshare-user", "--ro-bind", "/", "/", "--", "true")
+	out, err := probeCmd.CombinedOutput()
+	if err != nil {
+		msg := strings.TrimSpace(string(out))
+		if msg == "" {
+			msg = err.Error()
+		}
+		t.Skipf("bwrap found but unusable in this environment: %s", msg)
+	}
+
+	return bwrapPath
 }
 
-func newBubblewrapParams(t *testing.T, args ...string) runner.RunnerParams {
+func newBubblewrapParams(t *testing.T, bwrapPath string, args ...string) runner.RunnerParams {
 	t.Helper()
-	bwrapPath, _ := exec.LookPath("bwrap")
 	params := newTestParams(t, args...)
 	params.Sandbox = true
 	params.BubblewrapParams = runner.BubblewrapParams{
@@ -231,10 +246,10 @@ func newBubblewrapParams(t *testing.T, args ...string) runner.RunnerParams {
 }
 
 func TestBubblewrapBasicExecution(t *testing.T) {
-	skipIfNoBubblewrap(t)
+	bwrapPath := skipIfNoBubblewrap(t)
 
 	var stdout bytes.Buffer
-	params := newBubblewrapParams(t, "echo", "hello")
+	params := newBubblewrapParams(t, bwrapPath, "echo", "hello")
 	params.Stdout = &stdout
 
 	r, err := runner.GetRunner(params)
@@ -246,10 +261,10 @@ func TestBubblewrapBasicExecution(t *testing.T) {
 }
 
 func TestBubblewrapArgumentPassing(t *testing.T) {
-	skipIfNoBubblewrap(t)
+	bwrapPath := skipIfNoBubblewrap(t)
 
 	var stdout bytes.Buffer
-	params := newBubblewrapParams(t, "echo", "hello world", "foo\tbar", "baz\"qux")
+	params := newBubblewrapParams(t, bwrapPath, "echo", "hello world", "foo\tbar", "baz\"qux")
 	params.Stdout = &stdout
 
 	r, err := runner.GetRunner(params)
@@ -265,10 +280,10 @@ func TestBubblewrapArgumentPassing(t *testing.T) {
 }
 
 func TestBubblewrapStdoutStderr(t *testing.T) {
-	skipIfNoBubblewrap(t)
+	bwrapPath := skipIfNoBubblewrap(t)
 
 	var stdout, stderr bytes.Buffer
-	params := newBubblewrapParams(t, "output", "stdout", "out-msg", "stderr", "err-msg")
+	params := newBubblewrapParams(t, bwrapPath, "output", "stdout", "out-msg", "stderr", "err-msg")
 	params.Stdout = &stdout
 	params.Stderr = &stderr
 
@@ -282,12 +297,12 @@ func TestBubblewrapStdoutStderr(t *testing.T) {
 }
 
 func TestBubblewrapContextCancellation(t *testing.T) {
-	skipIfNoBubblewrap(t)
+	bwrapPath := skipIfNoBubblewrap(t)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
 
-	params := newBubblewrapParams(t, "sleep", "30000")
+	params := newBubblewrapParams(t, bwrapPath, "sleep", "30000")
 	params.Ctx = ctx
 
 	r, err := runner.GetRunner(params)
@@ -303,8 +318,9 @@ func TestBubblewrapContextCancellation(t *testing.T) {
 	cancel()
 
 	select {
-	case <-done:
-		// Run returned promptly after cancellation
+	case err := <-done:
+		// Run returned promptly after cancellation and did not fail before cancellation.
+		require.NoError(t, err)
 	case <-time.After(5 * time.Second):
 		t.Fatal("Run() did not return within 5 seconds after context cancellation")
 	}