Repository navigation
Score a user-space kernel as the sandbox's boundary - #53
Merged
Merged
Conversation
Under gVisor, root, capabilities, a missing seccomp filter, no_new_privs, setuid binaries, /proc/sysrq-trigger and cgroup limits describe what the sandbox's own kernel grants the process, not what the host's does. Those findings (PRIV-001 to PRIV-005, FS-005, FS-006, RES-001) are now info under a user-space kernel, with the severity they would have on a shared kernel kept in the evidence. Network, secret, mount and file findings keep their severity. The rule is skipped when the probe sees a mount over /proc or /proc/version. Modal's four reports are rescored from the same probe output: 46, 39, 39 and 31, where they read 100, 100, 100 and 97. No other example changes. The version on main becomes 0.5.0.dev0 so the rescored reports name the scorer that produced them. COMPATIBILITY.md documents the rule as the third evidence-based severity, and the changelog names it as a pre-1.0 exception to the fixed-severity promise. Tests check the rule, its documented finding list, and the mount exception. The scoring item moves to Done in the roadmap. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes the roadmap item on scoring under a user-space kernel.
The rule. Under gVisor, eight findings describe what the sandbox's own kernel grants the process, not the host's kernel: PRIV-001 to PRIV-005 (root, capabilities, seccomp,
no_new_privs), FS-005 (/proc/sysrq-trigger), FS-006 (setuid binaries) and RES-001 (cgroup limits). They are nowinfowhen the probe sees a user-space kernel. Each one keeps the severity it would have on a shared kernel inevidence.severity_on_shared_kernel. Findings about what the sandbox exposes beyond that kernel keep their severity: the network, secrets including PID 1's environment (SEC-004), mounts and files. PRIV-007 says whether the rule was applied, and no longer says the score overstates.The rule is skipped when the probe sees a mount over
/procor/proc/version, since such a mount could make a shared kernel look like gVisor. The probe does not list tmpfs mounts, and the docs say so.What changes. Only Modal's four reports, rescored with
agentsec score --redactfrom their stored probe output, which is byte-identical. Their scores go from 100, 100, 100 and 97 to 46, 39, 39 and 31. Re-scoring the other 52 reports inexamples/reproduces their stored scores. Modal appears in no README table or chart.Version.
mainbecomes0.5.0.dev0, so the rescored reports name the scorer that produced them. The release PR sets the final number.Policy.
docs/COMPATIBILITY.mddocuments this as the third severity that follows evidence. The changelog names it as a pre-1.0 exception to the rule that an existing finding's severity changes only in a major version. A Modal baseline from before this change has noagentsec_version, so--baselineshows the drop without a version note. A drop is not a regression, so nothing fails.Tests. New tests cover the rule on Modal's probe data against the same data without gVisor, the code's list matching the documented one, and the
/procmount exception. Each was checked by breaking the code and watching it fail. The old test named "does not change the score" now asserts the new behavior. Locally 516 tests pass and 13 skip without network.The score still does not measure gVisor's own strength, and the probe does not test leaving it.
MEASUREMENTS.mdsays so.🤖 Generated with Claude Code