Repository navigation
feat(sandbox): include credential denials in folder plans - #18
Merged
senamakel merged 10 commits intoOct 25, 2026
Merged
Conversation
Add a test asserting that a trusted folder plan carries pre-admitted grants and reports credential denials, including the workspace credential and the home .ssh directory, in its deny_read list. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Sandbox plans can now carry a list of credential paths that the host knows about, and artifacts return the canonical deny_read list for TinyBox NativeJailConfig. This lets an allow-default folder jail exclude native and host-supplied credential roots, so the contract version is bumped to 1.31. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The trusted folder plan test now reads the home directory from the scope's paths instead of the temporary directory handle, so the assertion exercises the same path the operator plan actually uses. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Replace the local denial count and path byte constants in the sandbox engine and grant admission with the shared MAX_CREDENTIAL_ROOTS and MAX_CREDENTIAL_ROOT_BYTES limits so both paths enforce the same bounds. Add a test covering rejection of relative, oversized, and traversal credential denial paths. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Extend the sandbox wire-shape tests to assert that credential_denials and deny_read are omitted when unset and round-trip correctly when present, and rename the request test to reflect the 1.30 shape it now checks. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Doc comments now render `TinySecurity` and `TinyBox` as inline code so the product names stand out consistently. The corresponding test assertion was switched to `assert_eq!` against an empty array for a clearer failure message. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The assertion comparing credential_denials against an empty array literal now uses an explicitly typed empty Vec so the element type is inferred correctly. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Moved the inline minimum isolation calculation out of the engine's plan path into a dedicated function so the same logic can be reused and tested on its own. Behaviour is unchanged. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Document that `Process` may represent trusted folder confinement such as Seatbelt and never a kernel-isolation floor, and record that OpenHuman's `SandboxMode::ReadOnly` is a host-side tool filter mapping to no sandbox backend rather than a confinement claim or `Plan2` artifact. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Replace the string prefix check with a Path::is_absolute assertion so the test verifies absolute paths correctly on platforms where the separator differs. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
senamakel
merged commit Oct 25, 2026
7a370aa
into
epic/8369-security-migration
14 of 16 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #10
Part of tinyhumansai/openhuman#8369
TinySecurity contract 1.31 lets Plan2 carry trusted-host credential denials and returns their canonical paths in
SandboxArtifact2.deny_readfor process-level folder jails. It derives native home credential roots, rejects malformed paths and unsafe workspaces inside denied roots, and preserves canonical, pre-admitted grants in the artifact. Trusted sources may accept a process-level jail such as Seatbelt; untrusted and SaaS plans still require kernel or microVM isolation.The existing
SandboxMode::ReadOnlybehavior is explicitly documented as a host-side tool filter. It maps to no sandbox backend and allows network; it makes no filesystem-confinement claim.Validation:
cargo test -p tinysecurity-buscargo test -p tinysecurity-sandboxcargo test -p tinysecurity-module sandboxcargo check -p tinysecurity-bus -p tinysecurity-sandbox -p tinysecurity-modulecargo clippy -p tinysecurity-bus -p tinysecurity-sandbox -p tinysecurity-module --all-targets -- -D warningscargo fmt --all -- --check