diff --git a/cmd/agent-system/main.go b/cmd/agent-system/main.go index 5692e74..84899fe 100644 --- a/cmd/agent-system/main.go +++ b/cmd/agent-system/main.go @@ -45,6 +45,7 @@ func main() { insecure := fs.Bool("insecure-listen", false, "允许在非回环地址上不开启认证（每次启动都会警告）") allowedHosts := fs.String("allowed-hosts", "", "逗号分隔的额外主机名，供反向代理的 Host 与 Origin 校验") noExec := fs.Bool("disable-exec-tools", false, "硬关闭执行原语 run_shell/run_python/register_artifact（用户设置无法覆盖；多用户部署在执行隔离就位前建议开启）") + execBackend := fs.String("exec-backend", "", "执行后端：direct（默认，现状直启）| sandbox（bwrap 隔离档：断网、只读系统根、仅会话目录可写、进程数限额）") fs.Parse(os.Args[1:]) cliSet := visited(fs) @@ -52,6 +53,7 @@ func main() { Addr: *addr, DataDir: *data, PluginsDir: *pluginsDir, Mock: *mock, StorageDSN: *dsn, ArtifactsDir: *artifacts, AuthMode: *auth, Instance: *instance, InsecureListen: *insecure, AllowedHostsRaw: *allowedHosts, DisableExecTools: *noExec, + ExecBackend: *execBackend, }, cliSet) if err != nil { fmt.Fprintln(os.Stderr, "agent-system:", err) @@ -61,7 +63,7 @@ func main() { Addr: resolved.Addr, DataDir: resolved.DataDir, PluginsDir: resolved.PluginsDir, ForceMock: resolved.Mock, StorageDSN: resolved.StorageDSN, ArtifactsDir: resolved.ArtifactsDir, AuthMode: resolved.AuthMode, InstanceID: resolved.Instance, InsecureListen: resolved.InsecureListen, AllowedHosts: resolved.AllowedHosts(), - DisableExecTools: resolved.DisableExecTools, + DisableExecTools: resolved.DisableExecTools, ExecBackend: resolved.ExecBackend, }); err != nil { fmt.Fprintln(os.Stderr, "agent-system:", err) os.Exit(1) @@ -105,11 +107,13 @@ func runConfig(args []string) int { insecure := fs.Bool("insecure-listen", false, "") allowedHosts := fs.String("allowed-hosts", "", "") noExec := fs.Bool("disable-exec-tools", false, "") + execBackend := fs.String("exec-backend", "", "") fs.Parse(args[1:]) resolved, err := config.Load(*cfgFile, os.LookupEnv, config.Config{ Addr: *addr, DataDir: *data, PluginsDir: *pluginsDir, Mock: *mock, StorageDSN: *dsn, ArtifactsDir: *artifacts, AuthMode: *auth, Instance: *instance, InsecureListen: *insecure, AllowedHostsRaw: *allowedHosts, DisableExecTools: *noExec, + ExecBackend: *execBackend, }, visited(fs)) if err != nil { fmt.Fprintln(os.Stderr, "agent-system:", err) diff --git a/internal/app/app.go b/internal/app/app.go index 547b314..3167aa1 100644 --- a/internal/app/app.go +++ b/internal/app/app.go @@ -76,6 +76,9 @@ type Options struct { // register_artifact 与小队内核执行配置）：用户设置 runtime.exec 无法覆盖； // 零值=false=现状。 DisableExecTools bool + // ExecBackend 执行后端（EXT-16）：空/direct=现状直启；sandbox=bwrap 隔离档。 + // 硬关闭 DisableExecTools 优先级高于后端选择。 + ExecBackend string } // Run 装配并阻塞服务直至 SIGINT/SIGTERM（优雅停机：中断在途 run、冲净事件缓冲）。 @@ -128,6 +131,13 @@ func Run(opt Options) error { if opt.DisableExecTools { log.Printf("exec tools: disabled by startup option (runtime.exec settings are ignored)") } + // EXT-16：执行后端选择（direct|sandbox）；未知名字启动即失败（fail-closed）。 + if err := tools.SetExecBackend(opt.ExecBackend); err != nil { + return fmt.Errorf("exec backend: %w", err) + } + if tools.ExecBackendName() == "sandbox" { + log.Printf("exec tools: backend=sandbox (bwrap: no network, ro root, session-only writes, proc limit)") + } if err := tools.RegisterExecTools(reg); err != nil { return fmt.Errorf("exec tools: %w", err) } diff --git a/internal/config/config.go b/internal/config/config.go index 6d3cd23..b87afc6 100644 --- a/internal/config/config.go +++ b/internal/config/config.go @@ -28,6 +28,9 @@ type Config struct { AllowedHostsRaw string `json:"allowedHosts"` // DisableExecTools 启动级硬关闭执行原语（用户设置 runtime.exec 无法覆盖）。 DisableExecTools bool `json:"disableExecTools"` + // ExecBackend 执行后端（EXT-16）：direct（空 = 现状直启）| sandbox（bwrap + // 隔离档）。DisableExecTools 优先级高于后端选择。 + ExecBackend string `json:"execBackend"` } var defaults = Config{ @@ -47,6 +50,7 @@ var envKey = map[string]string{ "auth": "AGENT_SYSTEM_AUTH", "mock": "AGENT_SYSTEM_MOCK", "instance": "AGENT_SYSTEM_INSTANCE", + "execBackend": "AGENT_SYSTEM_EXEC_BACKEND", "insecureListen": "AGENT_SYSTEM_INSECURE_LISTEN", "allowedHosts": "AGENT_SYSTEM_ALLOWED_HOSTS", "disableExecTools": "AGENT_SYSTEM_DISABLE_EXEC_TOOLS", @@ -170,6 +174,8 @@ func loadFile(path string) (Config, map[string]bool, error) { dst = &c.AllowedHostsRaw case "disableExecTools": dst = &c.DisableExecTools + case "execBackend": + dst = &c.ExecBackend default: return Config{}, nil, fmt.Errorf("config file %s: unknown key %q", path, k) } @@ -199,6 +205,8 @@ func stringField(c Config, f string) string { return c.Instance case "allowedHosts": return c.AllowedHostsRaw + case "execBackend": + return c.ExecBackend } return "" } @@ -247,6 +255,8 @@ func setString(c *Config, f, v string) { c.Instance = v case "allowedHosts": c.AllowedHostsRaw = v + case "execBackend": + c.ExecBackend = v } } @@ -268,7 +278,7 @@ func (r Resolved) Explain(w io.Writer, file string) { fmt.Fprintln(w, "config file: (none)") } fmt.Fprintln(w, "field value source") - for _, f := range []string{"addr", "data", "plugins", "dsn", "artifacts", "auth", "mock", "instance", "insecureListen", "allowedHosts", "disableExecTools"} { + for _, f := range []string{"addr", "data", "plugins", "dsn", "artifacts", "auth", "mock", "instance", "insecureListen", "allowedHosts", "disableExecTools", "execBackend"} { v := stringField(r.Config, f) if isBoolField(f) { v = fmt.Sprintf("%t", boolField(r.Config, f)) diff --git a/internal/tools/exec_backend.go b/internal/tools/exec_backend.go new file mode 100644 index 0000000..70faf3d --- /dev/null +++ b/internal/tools/exec_backend.go @@ -0,0 +1,192 @@ +// EXT-16 执行后端：把「启动白名单解释器进程」抽象为 ExecBackend 接口。 +// +// direct = 现状（exec.CommandContext 直启，逐字节等价）；sandbox = bwrap 隔离档 +// （模型生成代码按不可信对待）：只读系统根、tmpfs 遮蔽 /home 与 /tmp、仅会话 +// 工作目录与技能目录挂载可写、--unshare-net 断网、ulimit -u 限进程数防 fork +// 炸弹、超时杀 bwrap 宿主侧进程组（pid 命名空间随之销毁，不可逃逸存活）。 +// 启动级 DisableExecTools 是最终兜底，优先级高于后端选择（execGate 拒绝在前）。 +package tools + +import ( + "context" + "errors" + "fmt" + "io" + "os" + "os/exec" + "strings" + "sync/atomic" + "syscall" + "time" +) + +// execSandboxMaxProcs sandbox 档内 ulimit -u（fork 炸弹防线；bash 自身进程也计入）。 +const execSandboxMaxProcs = 256 + +// ExecSpec 一次解释器执行的启动规格（后端无关）。 +type ExecSpec struct { + Bin string // 白名单解释器绝对路径 + Args []string // 落盘脚本路径为唯一参数 + Dir string // 会话沙箱工作目录（sandbox 档唯一可写挂载） + Env []string // 最小环境（execEnv 口径） + SkillsDir string // 技能根（sandbox 档只读挂载；空 = 不挂） + Timeout time.Duration // 硬超时（调用方 ctx.WithTimeout 之前传入，仅记录用） +} + +// ExecProcess 后端启动的执行体句柄：Wait 等待退出；Kill 杀整个执行体 +// （direct = 进程组 SIGKILL；sandbox = bwrap 宿主侧进程组，pid 命名空间销毁）。 +type ExecProcess interface { + Wait() error + Kill() error +} + +// ExecBackend 执行后端接口（EXT-16）：启动 spec 描述的解释器， +// stdout+stderr 合并写入 out。 +type ExecBackend interface { + Start(ctx context.Context, spec ExecSpec, out io.Writer) (ExecProcess, error) +} + +// ---- 后端选择（组合根装配期设置）---- + +var execBackend = atomic.Value{} // string："" / "direct" = 现状；"sandbox" = 隔离档 + +// SetExecBackend 按名选择执行后端；空串与 "direct" 等价（现状直启）。 +// 未知名字报错（fail-closed，不静默回落）。硬关闭 DisableExecTools 优先于此。 +func SetExecBackend(name string) error { + switch name { + case "", "direct", "sandbox": + execBackend.Store(name) + return nil + default: + return fmt.Errorf("unknown exec backend %q (direct|sandbox)", name) + } +} + +// ExecBackendName 报告当前后端名（空 = direct）。 +func ExecBackendName() string { + v, _ := execBackend.Load().(string) + return v +} + +func currentExecBackend() ExecBackend { + if ExecBackendName() == "sandbox" { + return sandboxBackend{} + } + return directBackend{} +} + +// ---- direct 后端：现状行为 ---- + +type directBackend struct{} + +func (directBackend) Start(ctx context.Context, spec ExecSpec, out io.Writer) (ExecProcess, error) { + cmd := exec.CommandContext(ctx, spec.Bin, spec.Args...) + cmd.Dir = spec.Dir + cmd.Env = spec.Env + cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} + cmd.WaitDelay = 2 * time.Second + cmd.Cancel = func() error { + if cmd.Process == nil { + return os.ErrProcessDone + } + err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL) + if errors.Is(err, syscall.ESRCH) { + return nil + } + return err + } + cmd.Stdout = out + cmd.Stderr = out + if err := cmd.Start(); err != nil { + return nil, err + } + return cmdProcess{cmd: cmd}, nil +} + +type cmdProcess struct { + cmd *exec.Cmd +} + +func (p cmdProcess) Wait() error { return p.cmd.Wait() } + +func (p cmdProcess) Kill() error { + if p.cmd.Process == nil { + return os.ErrProcessDone + } + err := syscall.Kill(-p.cmd.Process.Pid, syscall.SIGKILL) + if errors.Is(err, syscall.ESRCH) { + return nil + } + return err +} + +// ---- sandbox 后端：bwrap 隔离档 ---- + +type sandboxBackend struct{} + +func (sandboxBackend) Start(ctx context.Context, spec ExecSpec, out io.Writer) (ExecProcess, error) { + bin, err := exec.LookPath("bwrap") + if err != nil { + return nil, fmt.Errorf("sandbox exec backend requires bwrap: %w", err) + } + argv := sandboxArgv(spec) + cmd := exec.CommandContext(ctx, bin, argv...) + cmd.Env = []string{"PATH=" + os.Getenv("PATH")} + cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} + cmd.WaitDelay = 2 * time.Second + cmd.Cancel = func() error { + if cmd.Process == nil { + return os.ErrProcessDone + } + err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL) + if errors.Is(err, syscall.ESRCH) { + return nil + } + return err + } + cmd.Stdout = out + cmd.Stderr = out + if err := cmd.Start(); err != nil { + return nil, err + } + return cmdProcess{cmd: cmd}, nil +} + +// sandboxArgv 组装 bwrap 参数（单测锚点；挂载顺序敏感——/home 与 /tmp 的 +// tmpfs 遮蔽必须后于 --ro-bind /，会话目录 bind 必须后于其遮蔽）。 +func sandboxArgv(spec ExecSpec) []string { + argv := []string{ + "--unshare-all", // pid/net/ipc/uts/user 命名空间全隔离（断网在此） + "--die-with-parent", + "--ro-bind", "/", "/", // 只读系统根（解释器与依赖库可用） + "--tmpfs", "/home", // 遮蔽真实家目录（~/.secrets 等不可见不可读） + "--tmpfs", "/tmp", // 可写临时区（pip/tempfile），不含宿主内容 + "--proc", "/proc", + "--dev", "/dev", + "--bind", spec.Dir, spec.Dir, // 会话沙箱：唯一可写挂载 + } + if spec.SkillsDir != "" { + argv = append(argv, "--ro-bind", spec.SkillsDir, spec.SkillsDir) + } + argv = append(argv, "--chdir", spec.Dir, "--clearenv") + for _, kv := range spec.Env { + if i := strings.IndexByte(kv, '='); i > 0 { + argv = append(argv, "--setenv", kv[:i], kv[i+1:]) + } + } + // ulimit 包一层 bash（dash 不支持 -u）：进程数限额防 fork 炸弹 + // （命名空间内 RLIMIT_NPROC 生效）。 + wrapped := append([]string{spec.Bin}, spec.Args...) + argv = append(argv, "/bin/bash", "-c", + fmt.Sprintf("ulimit -u %d; exec %s", execSandboxMaxProcs, shellQuote(wrapped))) + return argv +} + +// shellQuote 逐元素单引号包裹（sh 安全拼接，无引号内插值）。 +func shellQuote(parts []string) string { + out := make([]string, len(parts)) + for i, p := range parts { + out[i] = "'" + strings.ReplaceAll(p, "'", `'\''`) + "'" + } + return strings.Join(out, " ") +} diff --git a/internal/tools/exec_backend_test.go b/internal/tools/exec_backend_test.go new file mode 100644 index 0000000..fc25ef4 --- /dev/null +++ b/internal/tools/exec_backend_test.go @@ -0,0 +1,285 @@ +package tools + +// EXT-16 执行后端测试：direct 档回归（现状语义）＋ sandbox 档 bwrap 参数组装与 +// 逃逸负例（提案 2026-10-09-ext-g1-b1-b3 §4 验收：读 ~/.secrets、读其他会话目录、 +// 访问外网、fork 炸弹、超时不可杀——须全部被拦；会话目录内正常任务成功）。 +// bwrap 缺席的环境跳过 sandbox 集成项（CI 只兜 direct 回归；隔离证据在具备 +// bwrap 的评审环境重放）。 + +import ( + "bytes" + "context" + "os" + "os/exec" + "path/filepath" + "strings" + "testing" + "time" +) + +func TestSetExecBackendValidation(t *testing.T) { + defer func() { _ = SetExecBackend("") }() + if err := SetExecBackend("jail"); err == nil { + t.Fatal("unknown backend must be rejected (fail-closed)") + } + for _, ok := range []string{"", "direct", "sandbox"} { + if err := SetExecBackend(ok); err != nil { + t.Fatalf("%q: %v", ok, err) + } + } + if err := SetExecBackend("sandbox"); err != nil || ExecBackendName() != "sandbox" { + t.Fatalf("sandbox not selected: %v %q", err, ExecBackendName()) + } +} + +func TestSandboxArgvShape(t *testing.T) { + argv := sandboxArgv(ExecSpec{ + Bin: "/usr/bin/python3", Args: []string{"/data/s/x.py"}, + Dir: "/data/s", SkillsDir: "/data/skills", + Env: []string{"PATH=/usr/bin:/bin", "HOME=/tmp/h"}, + }) + joined := strings.Join(argv, "\x00") + musts := []string{ + "--unshare-all", "--die-with-parent", + "--ro-bind\x00/\x00/", // 只读系统根 + "--tmpfs\x00/home", // 遮蔽真实家目录 + "--tmpfs\x00/tmp", + "--bind\x00/data/s\x00/data/s", // 会话目录唯一可写挂载 + "--ro-bind\x00/data/skills\x00/data/skills", + "--chdir\x00/data/s", "--clearenv", + "--setenv\x00PATH", "--setenv\x00HOME", + "/bin/bash", "-c", + } + for _, m := range musts { + if !strings.Contains(joined, m) { + t.Fatalf("sandbox argv missing %q: %v", m, argv) + } + } + wrapper := argv[len(argv)-1] + if !strings.Contains(wrapper, "ulimit -u "+itoa(execSandboxMaxProcs)) || + !strings.Contains(wrapper, "exec '/usr/bin/python3' '/data/s/x.py'") { + t.Fatalf("wrapper = %q（须 ulimit -u 限进程数并 exec 白名单解释器）", wrapper) + } +} + +func itoa(n int) string { + if n == 0 { + return "0" + } + var b [20]byte + i := len(b) + for n > 0 { + i-- + b[i] = byte('0' + n%10) + n /= 10 + } + return string(b[i:]) +} + +// ---- sandbox 集成（需 bwrap；缺席即跳过）---- + +func requireBwrap(t *testing.T) { + t.Helper() + if _, err := exec.LookPath("bwrap"); err != nil { + t.Skip("bwrap not available; sandbox integration replayed on capable hosts") + } +} + +// sandboxRun 经 sandbox 后端执行一段 bash 脚本，返回合并输出与退出描述。 +func sandboxRun(t *testing.T, script string, timeout time.Duration) (string, string) { + t.Helper() + dir := t.TempDir() + p := filepath.Join(dir, "s.sh") + if err := os.WriteFile(p, []byte(script), 0o600); err != nil { + t.Fatal(err) + } + ctx, cancel := context.WithTimeout(context.Background(), timeout) + defer cancel() + var buf bytes.Buffer + spec := ExecSpec{ + Bin: "/bin/bash", Args: []string{p}, Dir: dir, + Env: []string{"PATH=/usr/bin:/bin", "HOME=/home/agent"}, + } + proc, err := sandboxBackend{}.Start(ctx, spec, &buf) + if err != nil { + t.Fatalf("start: %v", err) + } + werr := proc.Wait() + out := buf.String() + state := "exit=0" + if werr != nil { + if ee, ok := werr.(*exec.ExitError); ok { + state = "exit=" + itoa(ee.ExitCode()) + } else { + state = "err:" + werr.Error() + } + } + if ctx.Err() == context.DeadlineExceeded { + state = "exit=timeout" + } + return out, state +} + +func TestSandboxHomeHidden(t *testing.T) { + requireBwrap(t) + home, err := os.UserHomeDir() + if err != nil || home == "" || !strings.HasPrefix(home, "/home/") { + t.Skipf("home %q not under /home; fixture would not be shadowed", home) + } + secret := filepath.Join(home, ".agent-ext16-marker") + if err := os.WriteFile(secret, []byte("topsecret"), 0o600); err != nil { + t.Skipf("cannot create home fixture: %v", err) + } + defer os.Remove(secret) + out, state := sandboxRun(t, "cat \"$HOME/.agent-ext16-marker\" 2>err.txt; cat err.txt; exit 7", 30*time.Second) + if strings.Contains(out, "topsecret") { + t.Fatalf("sandbox read real home secret (state=%s out=%q)", state, out) + } + if state == "exit=0" || state == "exit=7" && strings.Contains(out, "topsecret") { + t.Fatalf("unexpected success: state=%s out=%q", state, out) + } +} + +func TestSandboxSiblingSessionUnreadable(t *testing.T) { + requireBwrap(t) + base := t.TempDir() + a, b := filepath.Join(base, "session-a"), filepath.Join(base, "session-b") + if err := os.MkdirAll(a, 0o755); err != nil { + t.Fatal(err) + } + if err := os.MkdirAll(b, 0o755); err != nil { + t.Fatal(err) + } + marker := filepath.Join(b, "other-session.txt") + if err := os.WriteFile(marker, []byte("others-data"), 0o600); err != nil { + t.Fatal(err) + } + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + defer cancel() + var buf bytes.Buffer + spec := ExecSpec{ + Bin: "/bin/bash", Args: []string{"-c", "cat '" + marker + "'"}, Dir: a, + Env: []string{"PATH=/usr/bin:/bin", "HOME=/home/agent"}, + } + proc, err := sandboxBackend{}.Start(ctx, spec, &buf) + if err != nil { + t.Fatal(err) + } + werr := proc.Wait() + if werr == nil || buf.String() == "others-data" { + t.Fatalf("sibling session readable inside sandbox: wait=%v out=%q", werr, buf.String()) + } +} + +func TestSandboxNoNetwork(t *testing.T) { + requireBwrap(t) + out, state := sandboxRun(t, + "timeout 5 bash -c 'echo > /dev/tcp/1.1.1.1/80' 2>/dev/null && echo NET-OPEN || echo NET-BLOCKED", + 30*time.Second) + if strings.Contains(out, "NET-OPEN") { + t.Fatalf("network reachable in sandbox (state=%s)", state) + } + if !strings.Contains(out, "NET-BLOCKED") { + t.Fatalf("probe did not run: state=%s out=%q", state, out) + } +} + +func TestSandboxForkBombContained(t *testing.T) { + requireBwrap(t) + // 确定性进程数压测（替代经典 :(){ :|:& };:——其在沙箱 user namespace 内 + // 递归行为依 bash 实现而变，不适合做门禁）：400 个并发 sleep 撞 ulimit -u + // 256 的墙，fork: retry 即限额生效的直接证据。 + start := time.Now() + out, state := sandboxRun(t, + "n=0; for i in $(seq 1 400); do sleep 5 & n=$((n+1)); done; echo spawned=$n; wait", + 20*time.Second) + elapsed := time.Since(start) + if elapsed > 40*time.Second { + t.Fatalf("spawn storm stalled the runner: %s", elapsed) + } + if !strings.Contains(out, "fork: retry") { + t.Fatalf("process limit not enforced (state=%s out=%.200q)", state, out) + } + if state == "exit=0" && strings.Contains(out, "spawned=400") { + t.Fatalf("400 processes spawned unbounded: %q", out) + } +} + +func TestSandboxOrphansDieWithNamespace(t *testing.T) { + requireBwrap(t) + out, state := sandboxRun(t, ":(){ :|:& };:; echo gone", 30*time.Second) + if state != "exit=0" || !strings.Contains(out, "gone") { + t.Fatalf("state=%s out=%q", state, out) + } + time.Sleep(500 * time.Millisecond) // 给孤儿进程留存活窗口 + hb, err := exec.Command("bash", "-c", "ps -eo args | grep -c '[s]\\.sh' || true").Output() + if err != nil { + t.Skipf("host ps probe failed: %v", err) + } + if strings.TrimSpace(string(hb)) != "0" { + t.Fatalf("orphaned bomb survived outside the namespace: %s", hb) + } +} + +func TestSandboxTimeoutKills(t *testing.T) { + requireBwrap(t) + start := time.Now() + _, state := sandboxRun(t, "sleep 60", 3*time.Second) + if d := time.Since(start); d > 20*time.Second { + t.Fatalf("timeout did not kill the sandbox: %s", d) + } + if state != "exit=timeout" { + t.Fatalf("state = %s, want exit=timeout", state) + } +} + +func TestSandboxSessionWriteVisible(t *testing.T) { + requireBwrap(t) + dir := t.TempDir() + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + defer cancel() + script := filepath.Join(dir, "w.sh") + if err := os.WriteFile(script, []byte("printf 'docx-ish' > \"$(dirname \"$0\")/out.txt\"\n"), 0o600); err != nil { + t.Fatal(err) + } + var buf bytes.Buffer + spec := ExecSpec{ + Bin: "/bin/bash", Args: []string{script}, Dir: dir, + Env: []string{"PATH=/usr/bin:/bin", "HOME=/home/agent"}, + } + proc, err := sandboxBackend{}.Start(ctx, spec, &buf) + if err != nil { + t.Fatal(err) + } + if err := proc.Wait(); err != nil { + t.Fatalf("sandbox task failed: %v out=%q", err, buf.String()) + } + got, err := os.ReadFile(filepath.Join(dir, "out.txt")) + if err != nil || string(got) != "docx-ish" { + t.Fatalf("product not visible on host: %v %q", err, got) + } +} + +// direct 档回归：后端抽象后 runInterpreter 语义不变（退出码/超时文本口径）。 +func TestDirectBackendRunInterpreterUnchanged(t *testing.T) { + if _, err := exec.LookPath("bash"); err != nil { + t.Skip("bash missing") + } + dir := t.TempDir() + p := filepath.Join(dir, "x.sh") + if err := os.WriteFile(p, []byte("echo hi; exit 7\n"), 0o600); err != nil { + t.Fatal(err) + } + got, err := runInterpreter(context.Background(), "bash", p, dir, 30, nil) + if err != nil || !strings.HasPrefix(got, "exit=7\n") || !strings.Contains(got, "hi") { + t.Fatalf("direct regression: err=%v got=%q", err, got) + } + p2 := filepath.Join(dir, "t.sh") + if err := os.WriteFile(p2, []byte("sleep 60\n"), 0o600); err != nil { + t.Fatal(err) + } + got, err = runInterpreter(context.Background(), "bash", p2, dir, 2, nil) + if err != nil || !strings.HasPrefix(got, "exit=timeout(2s)") { + t.Fatalf("direct timeout regression: err=%v got=%q", err, got) + } +} diff --git a/internal/tools/exec_interpreter.go b/internal/tools/exec_interpreter.go index c29cbbd..d1dd945 100644 --- a/internal/tools/exec_interpreter.go +++ b/internal/tools/exec_interpreter.go @@ -131,6 +131,7 @@ func resolveInterpreter(name string) (string, error) { } // runInterpreter 启动白名单解释器执行落盘脚本（脚本路径为唯一参数）。 +// 进程启动经 EXT-16 执行后端（direct=现状直启 / sandbox=bwrap 隔离档）。 // 非零退出、超时与请求取消都是正常反馈，以文本返回；仅启动失败算错误。 func runInterpreter(parent context.Context, interpreter, scriptPath, dir string, timeoutS int, sink func(stream, text string)) (string, error) { if parent == nil { @@ -145,24 +146,11 @@ func runInterpreter(parent context.Context, interpreter, scriptPath, dir string, } ctx, cancel := context.WithTimeout(parent, time.Duration(timeoutS)*time.Second) defer cancel() - cmd := exec.CommandContext(ctx, bin, scriptPath) - cmd.Dir = dir - cmd.Env = execEnv() - cmd.SysProcAttr = &syscall.SysProcAttr{Setpgid: true} - cmd.WaitDelay = 2 * time.Second - cmd.Cancel = func() error { - if cmd.Process == nil { - return os.ErrProcessDone - } - err := syscall.Kill(-cmd.Process.Pid, syscall.SIGKILL) - if errors.Is(err, syscall.ESRCH) { - return nil - } - return err + spec := ExecSpec{ + Bin: bin, Args: []string{scriptPath}, Dir: dir, Env: execEnv(), + SkillsDir: skillsRoot, Timeout: time.Duration(timeoutS) * time.Second, } pr, pw := io.Pipe() - cmd.Stdout = pw - cmd.Stderr = pw var buf bytes.Buffer readDone := make(chan struct{}) go func() { @@ -183,13 +171,13 @@ func runInterpreter(parent context.Context, interpreter, scriptPath, dir string, } } }() - err = cmd.Start() + proc, err := currentExecBackend().Start(ctx, spec, pw) if err != nil { _ = pw.Close() <-readDone return "", fmt.Errorf("%s: %w", interpreter, err) } - err = cmd.Wait() + err = proc.Wait() _ = pw.Close() <-readDone text := truncateOutput(buf.Bytes()) diff --git a/pkg/extension/extension.go b/pkg/extension/extension.go index c77715b..5aa77fe 100644 --- a/pkg/extension/extension.go +++ b/pkg/extension/extension.go @@ -19,7 +19,8 @@ import ( // 2.4.0-experimental：EXT-11 新增 SetScopedHostFactory/NewScopedHost（按 owner+pluginID // 重建受限宿主句柄，供下游恢复路径）。 // 2.5.0-experimental：Options.DisableExecTools（执行原语启动级硬关闭）。 -const SurfaceVersion = "2.5.0-experimental" +// 2.6.0-experimental：Options.ExecBackend（EXT-16 执行后端 direct|sandbox）。 +const SurfaceVersion = "2.6.0-experimental" // ErrNotLinked 表示进程没有空白导入 link 包，Main 无法启动服务。 var ErrNotLinked = errors.New("extension: runner not linked; blank-import agent-system-backend/pkg/extension/link") @@ -68,6 +69,11 @@ type Options struct { // register_artifact 及小队内核执行配置）：用户设置 runtime.exec 无法覆盖。 // 零值=false=现状。多用户共享部署在执行隔离就位前应置 true。 DisableExecTools bool + // ExecBackend 执行后端（EXT-16）：空/direct=现状直启；sandbox=bwrap 隔离档 + // （模型生成代码按不可信对待：断网、只读系统根、tmpfs 遮蔽 /home 与 /tmp、 + // 仅会话工作目录与技能目录挂载、进程数限额、超时杀整个沙箱）。 + // DisableExecTools 优先级高于此选择。 + ExecBackend string } var ( diff --git a/pkg/extension/link/link.go b/pkg/extension/link/link.go index 54f1c3e..1d6a41f 100644 --- a/pkg/extension/link/link.go +++ b/pkg/extension/link/link.go @@ -15,6 +15,7 @@ func init() { DisableUploadIndexing: opt.DisableUploadIndexing, DisableConvCardMirror: opt.DisableConvCardMirror, DisableExecTools: opt.DisableExecTools, + ExecBackend: opt.ExecBackend, }) }) }