Merge pull request #127 from dzerik/feat/credential-injection

feat(net): credential injection primitives — inject an auth secret in the proxy (RFC #66)

Author: congwang-mk

README.md

@@ -183,6 +183,17 @@ sandlock run \
   --http-ca ca.pem --http-key ca-key.pem \
   -r /usr -r /lib -r /etc -- python3 agent.py
 
+# Credential injection: the secret lives in the supervisor, the child never sees
+# it. sandlock attaches it in the proxy AFTER the ACL check. Over HTTPS the value
+# is encrypted to the upstream; over cleartext HTTP sandlock warns (the secret
+# would be exposed on the wire).
+sandlock run \
+  --http-allow "POST api.openai.com/v1/*" \
+  --http-inject-ca /etc/ssl/certs/ca-certificates.crt \
+  --credential openai=env:OPENAI_API_KEY \
+  --http-auth "POST api.openai.com/* bearer openai" \
+  -r /usr -r /lib -r /etc -- python3 agent.py
+
 # Server listening on ports (Landlock --net-allow-bind, separate from --net-allow;
 # accepts comma-separated ports and lo-hi ranges, repeatable)
 sandlock run --net-allow-bind 8080,9000-9005 -r /usr -r /lib -r /etc -- python3 server.py

crates/sandlock-cli/src/main.rs

@@ -461,6 +461,8 @@ async fn run_command(args: RunArgs) -> Result<i32> {
     if !pb.extra_deny_syscalls.is_empty() { builder = builder.extra_deny_syscalls(pb.extra_deny_syscalls.clone()); }
     for rule in &pb.http_allow { builder = builder.http_allow(rule); }
     for rule in &pb.http_deny { builder = builder.http_deny(rule); }
+    for c in &pb.credentials { builder = builder.credential_spec(c); }
+    for rule in &pb.http_auth { builder = builder.http_auth(rule); }
     for port in &pb.http_ports { builder = builder.http_port(*port); }
     if let Some(ref ca) = pb.http_ca { builder = builder.http_ca(ca); }
     if let Some(ref key) = pb.http_key { builder = builder.http_key(key); }

crates/sandlock-core/src/checkpoint/capture.rs

@@ -297,6 +297,18 @@ fn parse_fdinfo(pid: i32, fd: i32) -> io::Result<(i32, u64)> {
 /// Capture a checkpoint from a running, stopped sandbox.
 /// The sandbox must already be frozen (SIGSTOP'd and fork-held).
 pub(crate) fn capture(pid: i32, policy: &Sandbox) -> Result<Checkpoint, SandlockError> {
+    // Credential-injection rules hold supervisor-only secrets that are
+    // deliberately not serialized (`#[serde(skip)]`). A checkpoint image would
+    // therefore restore with no injection rules and send every request
+    // uncredentialed — reject rather than silently drop them.
+    if !policy.inject.is_empty() {
+        return Err(SandlockError::Runtime(SandboxRuntimeError::Child(
+            "checkpoint is not supported with credential injection (--http-auth); \
+             the injected secrets cannot be serialized into the image"
+                .into(),
+        )));
+    }
+
     // Seize via ptrace (PTRACE_SEIZE + PTRACE_INTERRUPT -- doesn't auto-SIGSTOP)
     ptrace_seize(pid).map_err(|e| {
         SandlockError::Runtime(SandboxRuntimeError::Child(format!("ptrace seize: {}", e)))

crates/sandlock-core/src/context.rs

@@ -498,6 +498,15 @@ pub(crate) fn confine_child(args: ChildSpawnArgs<'_>) -> ! {
             std::env::remove_var(&key);
         }
     }
+    // Remove env vars whose value was loaded into the supervisor as a credential
+    // source, so the agent can't read the real secret straight from its own
+    // environment (this is the child; the mutation is process-local and post-fork).
+    // This runs *before* applying `sandbox.env`, so the inherited real secret is
+    // dropped but a deliberate placeholder the user passes (e.g.
+    // `--env OPENAI_API_KEY=dummy`, which SDKs need set to start) still survives.
+    for name in &sandbox.inject_env_strip {
+        std::env::remove_var(name);
+    }
     for (key, value) in &sandbox.env {
         std::env::set_var(key, value);
     }