[M3gA-Mind]

Stacked on #161 (which contains #160): it keeps their descriptor contract. Review it after those, or read only the last commit.

Summary

A bwrap jail that allows network shared the host's network namespace. So host loopback services and abstract unix sockets were reachable from it, and it stayed Process, which native_jail::prepare refuses when require_process_isolation is set. tinymcp and OpenHuman set exactly that for registry-installed stdio MCP servers, so every one of them was refused on Linux.

When a root-owned pasta (passt) and nsenter are found at fixed paths and pass a probe, an allow_net jail now gets a private network:

1. pasta starts a holder (sh -c 'read _') that owns a fresh user, network and pid namespace.
2. The launcher enters the holder's user and network namespace with nsenter --user --net --preserve-credentials. It enters by namespace descriptor (/proc/self/fd/N), opened once after checking that the pid is pasta's child and that its network namespace is not the host's. Then it runs bwrap, without --unshare-net.
3. pasta is only ever started with --config-net --no-map-gw -T none -U none --dns-forward 169.254.1.1: no port forwarding either way, no gateway mapping to the host, DNS through one forwarded address. The jail gets its own /etc/resolv.conf naming that address, via --ro-bind-data. The host's resolv.conf (often a symlink into /run) is not bound.
4. The holder reads a pipe whose only writer, once the jail starts, is bwrap's --sync-fd. When bwrap exits, normally or killed, the holder sees end-of-file and exits, and pasta with it. Before the hand-over, dropping the Network kills pasta. So no pasta outlives a jail.
5. isolation_for reports Kernel for such a jail. Without a working pasta nothing changes: the host network is shared, and the jail stays Process.

Why not pasta -- bwrap, which the issue suggested: pasta closes every inherited descriptor above 2 at startup. bwrap would then lose its argument file (--args 9), the --bind-fd grant descriptors (#160) and the seccomp filters (#161). We confirmed this on ubuntu-latest ("Can't read --args data: Bad file descriptor").

Why not slirp4netns, or attaching pasta to the namespaces bwrap creates: both join an existing namespace. Ubuntu's AppArmor user-namespace restriction (apparmor_restrict_unprivileged_userns=1) refuses that setns, with "Operation not permitted" from both tools. slirp4netns has no mode that creates the namespace itself, so it is left out.

Related issue

Closes #109.

API or behavior changes

• New: BubblewrapBackend::networks_privately().
• isolation_for / is_suitable_for_untrusted_jail now return Kernel / true for an allow_net jail when networks_privately().
• Behaviour change on hosts with pasta: an allow_net jail no longer reaches host loopback services, the host through its gateway address, or host abstract sockets. Outbound connections and DNS work.
• Nothing changes where pasta or nsenter is missing.

Validation

Commands actually run, on our Linux CI runner (no pasta installed there) at 4e06be4 (bubblewrap 0.9.0):

• cargo fmt --all -- --check: clean
• cargo clippy --all-targets --all-features -- -D warnings: 0 warnings (--keep-going, all targets)
• cargo build --all-targets --all-features: ok
• cargo test --all-features: 1608 passed, 0 failed, 5 ignored; bwrap::pasta::tests 9, bwrap::launcher::tests 11, bwrap::tests 17
• Real bwrap suites with TINYBOX_REQUIRE_BWRAP=1: bwrap_isolation 24/0, bwrap_fd_leak 2/0, bwrap_pasta_live 3/0 (all three skipped there: no pasta)

That runner has no pasta, so the live pasta tests skip there. The new CI job bwrap-pasta-live runs them on ubuntu-latest, with passt installed and TINYBOX_REQUIRE_PASTA=1. The same shape was proven there first, by hand, with a probe:

• outbound HTTPS 200;
• host 127.0.0.1 refused; gateway address refused; host abstract socket refused;
• --args/--bind-fd descriptors intact;
• no pasta left after bwrap exits or is SIGKILLed.

Tests

• Unit tests (pasta_tests, launcher_tests, mod_tests):
  • the only pasta flags allowed, plus a forbidden-flag list;
  • trusted-path lookup;
  • /proc children, PPid and route-table parsing;
  • the ready-timeout error;
  • refusal of a pid that is not pasta's child, or that shares this process's network;
  • the nsenter prefix by descriptor;
  • --ro-bind-data/--sync-fd wiring, without --unshare-net and without the host resolv.conf;
  • Kernel only with a working pasta.
• Live tests (tests/bwrap_pasta_live.rs, live_*):
  • the reachability matrix: outbound reached; host loopback, gateway and host abstract socket refused;
  • killing a jail leaves no pasta;
  • a jail that exits leaves no pasta.
• bwrap_isolation.rs: the two tests that assumed allow_net shares the host network now expect isolation when networks_privately() is true, and the old behaviour otherwise.
• Not unit-tested: Pasta::start and the holder lookup against a real pasta. The live tests cover them, because they need pasta.

Documentation

The bwrap module docs have a new "Private network" section and updated "What is claimed". pasta.rs documents the design and why it is shaped this way.

Checklist

• The change is focused on one logical change
• No new #[allow(...)], #[ignore], or relaxed lints
• No secrets, tokens, or .env contents in the diff or the description

[M3gA-Mind]

Stacked on #161 (which contains #160). Please merge #160, then #161, then this; until then this PR's diff shows their commits too. The live pasta reachability, fd and no-orphan tests run in this PR's bwrap-pasta-live job on ubuntu-latest.

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 93c6486b-330b-40cc-811a-02fb235862d8

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

[tinysweeper]

Tiny Sweeper review

Findings

No active actionable findings.

Advisory notes

• medium: Use a caret range instead of an exact pin for command-fds (crates/tinybox-jail/Cargo.toml:39)
  Problem: AGENTS.md says: "Pin dependencies to a caret range, enable only needed features, gate optional parts behind documented Cargo features, and comment why each crate is needed." `=0.3.
  Suggested fix:
  No concrete fix was supplied.

Resolved this pass

• Pass the python script without single-quote wrapping
• Pass the python script without single-quote wrapping
• Pass the python script without single-quote wrapping
• Pass the python script without single-quote wrapping
• Pass the python script without single-quote wrapping
• Pass the python script without single-quote wrapping
• Pass the python script without single-quote wrapping

Verdict: Incomplete · Priority: medium
Coverage: Reviewed 14 of 19 files; not reviewed: Cargo.lock; not reviewed (large PR): crates/tinybox-j…, crates/tinybox-j…, and 2 additional unreviewed files.

Diagnostics and supporting details

Full summary

Pull request purpose (title): Give allow_net bwrap jails a private network through pasta. When a root-owned `pasta` and `nsenter` are found at fixed trusted paths and pass a probe, an `allow_net` bubblewrap jail now runs in a private user and network namespace owned by a `pasta` holder; the launcher enters those namespaces with `nsenter --user --net --preserve-credentials` by namespace descriptor, and `bwrap` runs without `--unshare-net`. The jail gets its own `/etc/resolv.conf` via `--ro-bind-data`, and the holder's writer is handed to `bwrap` through `--sync-fd` so no `pasta` outlives a jail. `isolation_for` reports `Kernel` for such a jail while `isolation()` stays `Process`. Independently, every jail starts under a compiled seccomp deny list, grants are bound from descriptors where `bwrap` and the kernel support it, and a `bwrap` that cannot load the filters or an unsupported architecture leaves the backend unavailable. Where `pasta` is missing nothing changes, and a `pasta` start failure refuses the jail rather than falling back to the host network. The latest-push delta is unavailable.

Unreviewed paths

• Cargo.lock
• crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh
• crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh
• crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh
• crates/tinybox-jail/tests/fixtures/fake-bwrap.sh

Partial review reasons

• critique: crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh — not selected by the large-review budget
• security: crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh — not selected by the large-review budget
• critique: crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh — not selected by the large-review budget
• security: crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh — not selected by the large-review budget
• critique: crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh — not selected by the large-review budget
• security: crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh — not selected by the large-review budget
• critique: crates/tinybox-jail/tests/fixtures/fake-bwrap.sh — not selected by the large-review budget
• security: crates/tinybox-jail/tests/fixtures/fake-bwrap.sh — not selected by the large-review budget

Review snapshot

Change surface	Files	Review signal	Count
Production	5	Active findings	0
Tests	11	Noted findings	1
Documentation	0	Resolved findings	7
Configuration	2	Pending checks/questions	12

Completeness: Incomplete
Test assessment: Test coverage is assessed from changed tests and lane evidence; execution is not claimed without trusted check data.

What changed

Open findings: the description lane reports a real defect — the launcher's fd keep-list arithmetic uses a count taken before the two namespace descriptors are appended, so those descriptors fall outside the keep list and are closed before `bwrap` runs (`--user=/proc/self/fd/N` is already consumed by `nsenter`, but the mismatch also silently changes the boundary). The tests lane flags a related concern: a bash-version-dependent `-ge` with a leading-zero operand in that same descriptor-closing loop, which only the existing leak test and the new grant-fd test would catch on a bash that rejects it. The description lane notes the earlier disputed python-probe quoting finding no longer applies to the current code; the commits lane reports no sensitive content in committed files with one earlier finding still open. The revision adds the pasta private-network path (holder, nsenter-by-descriptor entry, jail-local resolver, `--sync-fd` lifetime, `Kernel` isolation and suitability for `allow_net` jails where pasta works, refusal on pasta start failure), the compiled seccomp deny list on every jail with the backend unavailable when filters cannot load, descriptor-bound grants via `--bind-fd`/`--ro-bind-fd` with `openat2` (path binding where unavailable), a shell launcher with an fd keep-list, and a `bwrap-pasta-live` CI job that installs bubblewrap, passt and util-linux, lifts the AppArmor userns restriction, pins third-party actions by SHA, and runs the live suites with `TINYBOX_REQUIRE_PASTA=1`.

Features

• Added — nsenter-by-descriptor launcher entry: The launcher enters the holder's user and network namespaces with `nsenter --user=/proc/self/fd/N --net=/proc/self/fd/N --preserve-credentials` by descriptor, so a reused pid cannot redirect it; the script keeps only the counted grant descriptors from 10 up and closes everything else, including the namespace descriptors once entered. This keep-list counting is where the open defect and the bash-version concern live. (crates/tinybox-jail/src/bwrap/launcher.rs impl ArgsFile {, crates/tinybox-jail/src/bwrap/launcher.rs for fd in /proc/self/fd/*; do, crates/tinybox-jail/src/bwrap/launcher.rs use std::path::{Path, PathBuf};)
• Added — Pasta holder lifetime pinned to bwrap: The holder reads a pipe whose only writer becomes `bwrap` through `--sync-fd`, so `pasta` exits when `bwrap` exits, normally or killed; before hand-over, dropping the network kills `pasta`, and a `pasta` start failure refuses the jail. (crates/tinybox-jail/src/bwrap/pasta.rs, crates/tinybox-jail/src/bwrap/mod.rs fn run_probe(program: &Path, disable_userns: bool, root: &Path, host_only: &Path)
• Added — Seccomp deny list on every bwrap jail: Every jail starts under compiled deny filters for keyrings, other processes' memory, bpf/perf/userfaultfd/io_uring, mount and setns, namespace-creating clone/unshare, file handles, modules, kexec, reboot, clock, swap, syslog and terminal-injection ioctls; denied calls fail with EPERM and clone3 with ENOSYS, and a `bwrap` without `--add-seccomp-fd` or an unsupported architecture leaves the backend unavailable rather than unfiltered. (crates/tinybox-jail/src/bwrap/seccomp.rs, crates/tinybox-jail/src/bwrap/mod.rs fn prepare_command(verified: &Verified, jail: &Jail, cmd: &Command) -> io::Resul, crates/tinybox-jail/Cargo.toml landlock = { version = "0.4", optional = true })
• Added — Descriptor-bound grants via --bind-fd: Grants are opened once as `O_PATH` descriptors (nested ones with `RESOLVE_NO_SYMLINKS | RESOLVE_BENEATH`) and bound by descriptor, so what was checked is what is mounted; the nested-grant check-then-use gap remains only where `--bind-fd` or `openat2` is unavailable. (crates/tinybox-jail/src/bwrap/args.rs pub(super) fn jail_args(, crates/tinybox-jail/src/bwrap/args.rs fn replaces_private_mount(path: &Path) -> bool {, crates/tinybox-jail/src/bwrap/mod.rs fn is_trusted_binary(path: &Path) -> bool {)
• Added — CI job for live pasta reachability: A new `bwrap-pasta-live` job installs bubblewrap, passt and util-linux, lifts the AppArmor unprivileged-userns restriction, and runs the pasta live, isolation and fd-leak suites with `TINYBOX_REQUIRE_PASTA=1`, so a missing private network fails rather than skips; third-party actions are pinned by SHA and no untrusted context is interpolated into a shell. (.github/workflows/ci.yml jobs:)

Tests

• unit — Pasta unit tests cover the closed-down flags with a forbidden-flag list, the resolver contents, trusted-path lookup, `/proc` children/PPid/route parsing, the ready timeout, refusal of a pid that is not pasta's child or shares this process's network, and the fake network's descriptor duplication and release without a process.: Added in the diff; the tests lane answered and did not raise a defect here. (crates/tinybox-jail/src/bwrap/pasta_tests.rs)
• unit — Seccomp unit tests cover kernel release parsing, ptrace denied only before Linux 4.8, the escape and attack-surface calls being denied, unsupported architectures refused, both filters compiling to whole BPF instructions, and one rule per namespace flag.: Added in the diff; the tests lane answered and did not raise a defect here. (crates/tinybox-jail/src/bwrap/seccomp_tests.rs)
• unit — Launcher unit tests assert that only the numbered grant descriptors reach bwrap while a stray inheritable descriptor is closed, and that with namespace entry `nsenter` is the program with `--user=/proc/self/fd/14 --net=/proc/self/fd/15 --preserve-credentials --` and no environment.: Added in the diff; the tests lane answered, noted no test that cannot fail, and observed the keep-list assertion depends on bash rejecting a leading-zero `-ge` operand — which is the open bash-version concern. (crates/tinybox-jail/src/bwrap/launcher_tests.rs fn the_args_file_is_gone_once_the_launcher_has_started_bwrap() -> io::Result<()>, crates/tinybox-jail/src/bwrap/launcher_tests.rs fn the_launcher_runs_with_an_empty_environment() -> io::Result<()> {)
• unit — Args unit tests cover grants bound from descriptors with baseline paths by path, a symlink swapped in after the check not being followed, a symlink above a grant left to the host, a missing read-only grant skipped, and path binding when descriptor support is absent.: Added in the diff; the tests lane answered and did not raise a defect here. (crates/tinybox-jail/src/bwrap/args_tests.rs fn a_denial_through_a_baseline_symlink_also_covers_the_link_target() -> io::Resu, crates/tinybox-jail/src/bwrap/args_tests.rs use super::*;)
• integration — Live pasta tests assert outbound reachability with host loopback, gateway and abstract sockets refused, only stdio open in the jail, and no pasta outliving a killed or exited jail; they require pasta and skip unless `TINYBOX_REQUIRE_PASTA=1` makes a missing private network a failure.: Added in the diff; the tests lane answered and did not raise a defect here; these are the tests the new CI job is intended to exercise. (crates/tinybox-jail/tests/bwrap_pasta_live.rs)
• integration — Isolation tests now expect `allow_net` to reach host loopback only when the host network is shared, expect descriptor binding whenever bwrap lists `--bind-fd`, assert keyctl denied with EPERM while getpid works, and ptrace of a jail child allowed.: Modified in the diff; the tests lane answered and did not raise a defect here. (crates/tinybox-jail/tests/bwrap_isolation.rs fn network_is_unreachable_when_denied_and_reachable_when_shared() -> io::Result<, crates/tinybox-jail/tests/bwrap_isolation.rs fn a_read_only_grant_nested_in_the_root_stays_read_only() -> io::Result<()> {, crates/tinybox-jail/tests/bwrap_isolation.rs fn nested_user_namespaces_are_blocked_on_a_hardened_backend() -> io::Result<()>)

Before merge

• Complete the critique review for crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap.sh.
• Complete the security review for crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap.sh.
• Review uncovered paths: crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap.sh.

Agent review details

critique

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered files: crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap.sh
• Lane summary: Reviewed 8 of 12 files — 4 not reviewed. Reviewed 8 files; 3 findings. 4 files were omitted: not selected by the large-review budget.

security

• Conclusion: Neutral
• Scope reviewed: incomplete; unanswered files: crates/tinybox-jail/tests/fixtures/fake-bwrap-noseccomp.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-old.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap-probe.sh, crates/tinybox-jail/tests/fixtures/fake-bwrap.sh
• Lane summary: Reviewed 8 of 12 files — 4 not reviewed. Reviewed 8 files; 0 findings. 4 files were omitted: not selected by the large-review budget.

tests

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The tests lane answered in full, dropped its earlier single-quote-wrapping concern because the probed script contains no single quote, reported no test that cannot fail, and left one bash-version-dependent `-ge` concern in the launcher's descriptor-closing loop.
• Lane summary: The prior Python-quoting finding does not hold: `python()` embeds `SYSCALL_PROBE` verbatim inside `sh -c '...'`, and `SYSCALL_PROBE` contains no apostrophe, so the quoting is intact. The new behaviour has direct test coverage of the fd-binding paths and of the seccomp refusal path, and the seccomp/private-network live tests are gated; my one concern is a bash-version-dependent `-ge` inside the launcher's descriptor-closing loop, which the existing leak test and the new grant-fd test would only catch on a bash that rejects a leading-zero operand. _The code index is behind this pull request (indexed at `99dd8f447388`), so retrieved context may be out of date._

commits

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The commits lane answered and reported no sensitive content in committed files, with one earlier finding still open.
• Lane summary: No sensitive content in committed files. (1 earlier finding(s) still open) _The code index is behind this pull request (indexed at `99dd8f447388`), so retrieved context may be out of date._

description

• Conclusion: Success
• Scope reviewed: all assigned evidence
• Positive: The description lane answered, confirmed the earlier disputed python-quoting finding no longer applies to the current code, and identified the launcher keep-list defect described in changes.
• Lane summary: This revision adds the seccomp deny list, descriptor-bound grants, the launcher's fd keep-list, and a new CI job for the pasta live tests; the CI job pins its actions, adds no permissions block and interpolates no untrusted context into a shell. The earlier disputed finding about the python probe's quoting no longer applies to the current code. I found one real defect: the launcher's fd keep-list arithmetic is driven by a count that is taken before the two namespace descriptors are appended, so those descriptors are closed before `bwrap` runs (`--user=/proc/self/fd/N` would already have been consumed by `nsenter`, but the mismatch also silently changes the boundary). (1 earlier finding(s) still open) _The code index is behind this pull request (indexed at `99dd8f447388`), so retrieved context may be out of date._

Evidence and run details

• Models: ladder/vectors-oai3, deepseek-v4.1-flash
• Spend: $0.025499
• Tokens: 1172589 input · 120225 output · 318464 cached · 856 embedding
• Updated: 2026-11-12T07:34:46Z
• Continuity: summary cache chain restarted at the storage ceiling.

Head	State	Pass summary
4e06be4bb7cb	incomplete	1 active finding(s), 0 resolved finding(s) (at 2026-11-11T13:31:28Z)
2b160c20bbd2	incomplete	0 active finding(s), 10 resolved finding(s) (at 2026-11-11T13:36:57Z)
87c539ac6c03	ready for maintainer review	0 active finding(s), 12 resolved finding(s) (at 2026-11-11T13:39:38Z)
1f71db953749	incomplete	0 active finding(s), 12 resolved finding(s) (at 2026-11-11T14:13:32Z)
6418fe4cc133	incomplete	0 active finding(s), 7 resolved finding(s) (at 2026-11-12T07:34:46Z)

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is high.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

Diagnostics

Total spend: $0.0149

[tinysweeper]

tinysweeper could not complete coverage (4 unanswered item(s)), so this is not an approval.

Diagnostics

Total spend: $0.0414

[tinysweeper]

The previously-blocking findings are resolved. Clearing the changes request.

Diagnostics

Total spend: $0.0095

[tinysweeper]

Requesting changes: 1 lane(s) blocking, worst finding is low.

Fix or reply to the findings below and push. The next review clears this automatically once they are gone — you should not need to dismiss anything by hand.

Diagnostics

Total spend: $0.0138

[tinysweeper]

tinysweeper could not complete coverage (4 unanswered item(s)), so this is not an approval.

Diagnostics

Total spend: $0.0255