Linux worker process sandboxing by iang-msft · Pull Request #4755 · microsoft/openvmm

iang-msft · 2026-10-26T07:41:58Z

This PR includes several features to enable sandboxing of OpenVMM worker processes on linux hosts.

Sandboxing crate that abstracts platform specifics
Integration of the sandbox crate into worker spawn
Profiling feature to collect syscall and file usage
Base profiles for VM Worker & TPM Worker processes

The profiling features uses ptrace to capture and log syscalls.

The sandboxing crate uses process namespaces created upon process fork, along with landlock and seccomp profiles applied shortly after process spawn.

This change also modifies ttrpc invocations to spawn worker processes instead of using inproc mesh.

Sandboxing

Launch VM and TPM Mesh hosts in Linux user and mount namespaces, adding a network namespace for restricted profiles. Retain PAL's vfork path by self-mapping the effective UID/GID before exec, then apply role-owned policy before tracing and Mesh startup. Known gaps: VM and TPM profiles remain broad and identical; inherited-handle grants are not wired or enforced; VNC/GDB and non-Linux sandbox backends are not covered; and full VM/TPM boot validation remains outstanding.

Integrate sandbox spawn

Removed references do uncommitted docs.

Removed description, should apply to all workers

Removed un-grounded non-goals

Add in-process Linux worker syscall tracing and a sandbox_profile_builder tool that converts worker JSONL traces into candidate sandbox profiles.

Trace only sandbox-profile-relevant syscalls so KVM hot paths run without ptrace stops while preserving syscall results and decoded arguments.

- load platform syscall denials from JSON configuration - derive filesystem, network, and syscall policies from worker traces - document the sandbox profiling workflow

- move worker syscall tracing into a separate pal_tracer crate - derive filesystem, network, and syscall sandbox policies from worker traces - replace separate syscall-denial rationale documentation with reasons stored alongside each denial in structured JSON - wire PAL tracing into OpenVMM worker process launch

Generate sandbox profiles automatically from worker traces

Documentation cleanup

Replace the JSON denylist and runtime parsing with static mandatory and optional syscall inventories. Update tracing, profiling, and the sandbox test launcher to consume the shared sandbox policy.

Copilot

🔵 Needs a closer look

Unresolved signal-isolation gaps let workers kill same-UID host processes, while filesystem restrictions break configured virtio-fs shares and traced-launch defects can hang worker startup.

14 open issues

1 resolved since last review

[P2] Denying fork does not enforce the no-child-process policy in…

_{Review effort: Balanced}

Mount ancestors before descendants and union compatible permissions across duplicate and nested grants so builder order cannot hide earlier access. Reject overlapping write and execute permissions before filesystem setup. Extend existing runtime tests to exercise both declaration orders, nested permissions, and device grant composition. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Compose filesystem grants before mounting

Copilot

🔵 Needs a closer look

Missing IPC isolation lets compromised workers access the controller user’s host IPC objects, while post-clone allocation can deadlock traced-worker startup.

12 open issues

2 resolved since last review

_{Review effort: Balanced}

Scan args_os and match the ASCII role option without requiring unrelated paths to be UTF-8. Keep unknown and duplicate roles as errors, including malformed non-UTF-8 role values, and cover these cases with parser regressions. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Handle non-UTF-8 paths during sandbox role scanning

Copilot

🔵 Needs a closer look

Unresolved defects allow workers to signal the controller or sibling workers and can deadlock worker startup through unsafe allocator use after raw clone.

11 open issues

1 resolved since last review

Scan args_os to support non-UTF-8 paths

_{Review effort: Balanced}

Grant file-specific access for proc maps, worker naming, and the overcommit setting without exposing unrelated proc files. Add an isolated regression that verifies real reads and writes with Landlock enforced. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Allow required implicit proc accesses under Landlock

Copilot

🔵 Needs a closer look

Workers retain unrestricted same-UID signaling authority in the host PID namespace, allowing a compromised worker to terminate the controller or sibling workers despite sandboxing.

10 open issues

1 resolved since last review

Allow required implicit proc accesses under Landlock

_{Review effort: Balanced}

Reserve Identity UID/GID values for future host identity provisioning and reject explicit requests during preparation. Remove sandbox credential-setting launch fields and reject PAL identity overrides with user namespace self-mapping, while preserving ordinary process identity changes. Document controller identity inheritance and remove stale claims of per-worker host identity isolation and worker-side UID/GID switching. Cover rejected zero and nonzero requests, default namespace mappings, and ordinary PAL launches. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

…tities Defer unsupported sandbox host identities explicitly

Copilot

🟡 Changes recommended

Unresolved sandbox isolation flaws let compromised workers terminate the controller through same-UID signaling and, when run as root, read sensitive host files such as /etc/shadow.

13 open issues

1 resolved since last review

Map requested identities into the user namespace

_{Review effort: Balanced}

+    DeniedSyscall {
+        name: "waitid",
+        enforcement: MANDATORY,
+        reason: None,
+    },


Replace recursive /etc grants with optional loader, resolver/NSS, and OpenSSL configuration files. Narrow the TPM SSL directory grant as well to prevent aliases from re-exposing private keys, and bind resolver configuration directly without granting its runtime target. Exercise file access, missing configuration, resolver symlinks, NSS lookup, and denial of private fixtures in isolated namespace tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Request CLONE_NEWIPC for every confined Linux launch, including unrestricted-network profiles. Keep namespace creation required with no weaker fallback. Exercise SysV shared memory, semaphore, and message queue isolation through real PAL launches for both worker roles and both clone modes. Update namespace documentation and kernel creation-order guidance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Allocate owner-only staging mountpoints with mkdtemp instead of reusing a fixed host pathname. Remove the backing directory through the old root after pivot_root, and detach all staging mount layers before nonrecursive cleanup on setup errors. Cover pre-existing files and symlinks, unique private allocations, successful cleanup, mount and grant failures, and stacked root-grant mounts without deleting writable bind contents. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Compile tracing bytecode in the parent so the pre-exec callback only borrows and installs it, without compiling or dropping heap-owned filter state. Return compilation errors from spawn before creating a child instead of silently skipping the tracing filter. Document the parent-side compilation contract and add an oversized-filter regression. Existing live tracing tests continue to verify successful filter installation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Continue consuming synthetic ptrace and syscall stops, but forward genuine SIGTRAP signals so application handlers and default termination behave normally. Preserve existing SIGSTOP handling. Add traced child regressions for a SIGTRAP handler and an unhandled SIGTRAP, with core dumps disabled for the latter. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 252beba7-825f-475b-9a31-8da82494a58b

Sandbox/pr 4755 narrow etc

Copilot

🟡 Changes recommended

Workers can kill the controller through permitted same-UID signaling, and tracer startup failures can leave stopped child processes unreaped.

11 open issues

7 resolved since last review

_{Review effort: Balanced}

 }

 fn do_main(pidfile_guard: &mut Option<pidfile::Pidfile>) -> anyhow::Result<i32> {
+    meshworker::apply_vmm_mesh_host_sandbox()?;


+
+#[cfg(target_os = "linux")]
+fn linux_clone_flags(profile: &Profile) -> u64 {
+    let mut flags = libc::CLONE_NEWUSER | libc::CLONE_NEWNS | libc::CLONE_NEWIPC;


+            #[cfg(target_os = "linux")]
+            None,


+    let profile = Profile::deny_all()
+        .name("vm_worker")
+        .read("/sys/devices")
+        .read_exec("/usr/lib")


+    #[test]
+    fn network_operations_work_in_namespace() {
+        let exe = std::env::current_exe().expect("failed to get test executable path");
+        let output = Command::new("unshare")
+            .args(["--user", "--map-root-user", "--net"])


iang-msft and others added 30 commits September 4, 2026 13:36

Sandbox init

4689363

Minimal test program

2648c9b

More bounds tests

7c68c13

Verify fs access

e48f79b

Verify tmp doesn't leak info

635f415

Merge branch 'microsoft:main' into sandboxing

1e2584d

Merge pull request #1 from iang-msft/sandboxing

0752e8d

Sandboxing

Fix basic profiles

82f0cdb

initial FD-allowlist implementation

e091c92

Filter allowlist and TPM profile

51499c6

Revert seccomp allowlist

7ef40b2

Separate sandbox policy

5c4baff

Simplify process launch

a14ba77

Push prepared sandbox to PAL

57229d9

Merge pull request #2 from iang-msft/integrate_sandbox_spawn

dd8d0a1

Integrate sandbox spawn

Merge branch 'microsoft:main' into main

7d74353

Update Sandbox_design.md for clarity

dcc0ce7

Removed references do uncommitted docs.

Update compromised worker restrictions in documentation

e8e4e3f

Removed description, should apply to all workers

Revise non-goals in Sandbox design documentation

f3d7cd5

Removed un-grounded non-goals

Major cleanup

86dc86e

Add OpenVMM worker sandbox profiling

8e4471d

Add in-process Linux worker syscall tracing and a sandbox_profile_builder tool that converts worker JSONL traces into candidate sandbox profiles.

Use seccomp filtering for worker tracing

9c5c21a

Trace only sandbox-profile-relevant syscalls so KVM hot paths run without ptrace stops while preserving syscall results and decoded arguments.

Add trace-driven sandbox profile policies

00f1b0c

- load platform syscall denials from JSON configuration - derive filesystem, network, and syscall policies from worker traces - document the sandbox profiling workflow

Fix worker profiling after upstream rebase

b32925b

Merge pull request #4 from dipanjan/sandbox-profiler

f22e888

Generate sandbox profiles automatically from worker traces

Merge branch 'microsoft:main' into main

50a7b77

Merge pull request #5 from iang-msft/documentation_cleanup

a159d61

Documentation cleanup

Move platform syscall denylist to Rust

5fa1e2c

Replace the JSON denylist and runtime parsing with static mandatory and optional syscall inventories. Update tracing, profiling, and the sandbox test launcher to consume the shared sandbox policy.