Tracker: pseudo-filesystem audit R5-R11

[vyskocilm]

Tracker for the remaining pseudo-filesystem recommendations, migrated from TODO.md, which is being retired in favour of issues. Full report: .claude/design/PSEUDOFS-AUDIT.md, including the accepted gaps and the full test list (§Disposition).

R1 and R2 — the two structural defects — are fixed (RULE 4 and RULE 2 in internal/policy/validate.go, with internal/policy/testdata/refusals.txt as the review artifact). R3 and R4 are #29. What is left:

• R5 — snug doctor should read and report the host hardening snug silently depends on: kptr_restrict, dmesg_restrict, perf_event_paranoid, ptrace_scope, unprivileged_bpf_disabled. It checks none today. ptrace_scope in particular is what stands between two co-resident payloads (see pidfd_getfd is not denied by the seccomp filter #23), and a host where it is 0 is exactly the container case key feature 3 says snug must work in.
• R6 — refuse a rw grant at or under /sys. Cgroup delegation gives kill/freeze over out-of-sandbox processes. Keep ro /sys expressible.
• R7 — route the hard-coded NOT-GRANTED literal in cmd/snug/dryrun.go through covered(); today it can print ro /sys and "never mounted" on one screen, in the one artifact a human trusts. Verify first: the sibling of this bug was fixed for ~/.config/gh when authored() was introduced, so part of R7 may already be closed.
• R8 — bound the /dev, /dev/shm, /tmp and $HOME tmpfs with size=. Host-RAM-exhaustion DoS; the engine's own containers already do this.
• R9 — batched doc corrections: INDEX §5.2's /dev enumeration and §5.3's fingerprint claim, the phantom [profile.sysfs], N5's side-channel list, @podman-socket's host-resource claim, and the time-namespace fact for CLAUDE.md.
• R10 — opt-in --new-session for non-interactive payloads, closing the /dev/tty OSC-52 channel to the operator's terminal. Do not filter escape sequences. Note snug already passes --new-session conditionally, on /proc/sys/dev/tty/legacy_tiocsti (internal/policy/bwrap.go:133) — this is a second, independent reason for the same flag and must not silently merge with the first.
• R11 — SECCOMP_RET_ERRNO on non-native architectures instead of ALLOW. The x86_64 i386-compat path falls through to ALLOW, so a 32-bit binary bypasses the filter; it is the only remaining native route toward a writable remount. Closing it outright breaks 32-bit binaries, and that trade was taken deliberately and is documented in internal/sandbox/seccomp.go — this item is about returning an errno rather than allowing, which is a different trade. (clone3 and the x32 ABI were the other two gaps and are closed.)

Standing note

Every confirmed finding becomes a named regression test with a positive control before its fix lands. Several existing pseudo-fs tests fail the pasta.avx2 "can this test ever fail?" check and are named in the report.

The audit's workflow could not spawn a redteam-typed phase, so its findings rest on research agents' live probing plus lead re-verification. A dedicated redteam pass over this surface is still worth running before a fix lands.

[vyskocilm]

Triage against main (a830cc6), rows read against code and MEASURED against a real sandbox

Method as #34/#31, plus: where a row asserts an exposure, I ran a real sandbox rather than reading the mount list (#29 taught that the two disagree in both directions). One row split to its own issue (#281); one R9 sub-item was verifiably done and its stale flag is fixed in #280.

Measured on this host, default sandbox: /sys is EMPTY inside (nothing mounted), /dev/shm is present and UNBOUNDED, /proc/sys write is REFUSED (#29 holds), /proc/sys/kernel/kptr_restrict reads 1 inside (P8). /dev inside is core fd full null ptmx pts random shm stderr stdin stdout tty urandom zero — note core (a symlink to /proc/kcore).

R5 — doctor reports host hardening — LIVE. doctor() (internal/cli/doctor.go) checks only the userns sysctls (unprivileged_userns_clone, max_user_namespaces), not kptr_restrict/dmesg_restrict/perf_event_paranoid/ptrace_scope/unprivileged_bpf_disabled. ptrace_scope IS now enforced, but only in the CONTAINER preflight (containerpreflight.go:409, P6, refuses =0) — a different path from doctor reporting the five. Keep.

R6 — refuse rw at/under /sys — LIVE. No builtin grants /sys (measured empty inside; hostpathvisiblepseudofs_test.go asserts it), and validate.go has RULE 4 for /proc,/dev,/snug but no /sys rule. A user profile writing rw = ["/sys/fs/cgroup"] would get cgroup delegation (kill/freeze over out-of-sandbox processes) with nothing refusing it. ro /sys must stay expressible. Keep.

R7 — NOT-GRANTED literal through covered() — DONE. The row said "verify first, may already be closed." It is: cmd/snug/dryrun.go is gone, and notGranted (internal/cli/dryrun.go:2306) routes every candidate through coverageOf (full/partial/none) and authored, so the "ro /sys and never-mounted on one screen" contradiction cannot render. Strike.

R8 — bound the tmpfs with size= — LIVE, split to #281. Measured: /dev/shm mounted unbounded; bwrap.go emits --tmpfs with no --size (defaults to half RAM each), and bwrap --help confirms --size BYTES is the mechanism. The engine's own containers already bound theirs, so the sandbox is the one place still open. Filed #281 with the measurement and the /dev/shm-is-bwrap-synthetic nuance. Keep, pointing at #281.

R9 — batched doc corrections — PARTIALLY DONE; two sub-items verified done, rest live.

• §5.3 fingerprint claim: DONE. INDEX §5.3 now marks the machine-id "cannot fingerprint" claim falsified (INDEX:997) and §5.2's headline states the time namespace is not unshared. So the "Contradicts INDEX §5.3" flag on the audit's P6 row (PSEUDOFS-AUDIT:99) was stale — fixed in PSEUDOFS-AUDIT P6: record the INDEX §5.3 contradiction as closed (refs #32) #280 to record the contradiction as closed. (This is the flag flagged during the Tracker: supervisor low-severity findings (Phase 1, review round 3, placement-D) #31 triage; it now belongs to PSEUDOFS-AUDIT P6: record the INDEX §5.3 contradiction as closed (refs #32) #280, not to a floating note.)
• phantom [profile.sysfs]: DONE in INDEX — grep finds no profile.sysfs in INDEX.md, so INDEX §787's "ships [profile.sysfs]" claim was already removed. The audit's own correction-notes (PSEUDOFS-AUDIT:232, :323) that still name it are now stale worklist entries.
• §5.2 /dev enumeration: LIVE. INDEX §5.2 describes /dev generically; the audit wants core named as a /proc/kcore symlink (measured present above) and console as a host-pty bind. Not done.
• N5 name /proc/interrupts: LIVE. INDEX §82 (N5) still says only "timing, /proc/cpuinfo, shared page cache".
• @podman-socket ABUSE sentence + time-namespace/nodev facts for CLAUDE.md: LIVE (CLAUDE.md has no time-namespace fact; I did not edit CLAUDE.md — it is the maintainer's working agreement and has in-flight edits).
  Keep R9 open for the remaining sub-items; the two done ones can be struck from its worklist.

R10 — opt-in --new-session for non-interactive payloads — LIVE. p.NewSession is set on ONE reason only: the legacy_tiocsti probe (main.go:563, bwrap.go:175). The OSC-52-to-operator-terminal reason the row wants is not implemented, and the row explicitly warns it "must not silently merge with the first". Keep.

R11 — SECCOMP_RET_ERRNO on non-native arch instead of ALLOW — LIVE (documented gap). seccomp.go:315 still reads "KNOWN GAP ... a non-native audit arch falls through to ALLOW, so the x86_64 i386-compat path bypasses this filter." The row is about returning an errno rather than allowing — a different trade from the deliberately-accepted 32-bit-breakage one, and not taken. (clone3 and x32 ARE closed, as the row says.) Keep.

Summary

• DONE (strike): R7. R9 sub-items §5.3 (→ PSEUDOFS-AUDIT P6: record the INDEX §5.3 contradiction as closed (refs #32) #280) and phantom-sysfs-in-INDEX.
• LIVE: R5, R6, R8 (→ tmpfs mounts (/dev/shm, /tmp, $HOME) carry no size= bound — host-RAM-exhaustion DoS from inside #281), R9 (remaining sub-items), R10, R11.
• Split to its own issue: R8 → tmpfs mounts (/dev/shm, /tmp, $HOME) carry no size= bound — host-RAM-exhaustion DoS from inside #281.
• Doc fix landed for the §5.3 flag the Tracker: supervisor low-severity findings (Phase 1, review round 3, placement-D) #31 triage surfaced: PSEUDOFS-AUDIT P6: record the INDEX §5.3 contradiction as closed (refs #32) #280.

No row was made WRONG by today's #29 closure — R3/R4 were already the #29 rows, and #29's procfs work leaves R5-R11 either untouched or (R7) closed. The measurement mattered anyway: it is what lets me say R6's "/sys not granted" and R8's "/dev/shm unbounded" from the effective view rather than the mount list.

Standing note still stands: a dedicated redteam pass over this surface before any of these fixes lands — nobody here can run it.