Sandboxing ও Isolation — seccomp, Capabilities, আর SELinux

লক্ষ্য: আগের সেকশনগুলোতে প্রতিটা mechanism আলাদা আলাদা করে দেখা হয়েছে। এখানে একটা ছোট “কম্পাইলার” লেখা হবে যা একটামাত্র declarative বর্ণনা থেকে তিনটা বাস্তব-ফরম্যাটের config বানায় — ঠিক যেভাবে বাস্তব CI/deployment pipeline-এ এই ধরনের জেনারেশন হয়।

# hardening_profile.py -- a tiny "compiler" from a declarative service
# description to three concrete, real-format hardening artifacts:
#   1. an OCI/Docker-style seccomp JSON profile
#   2. a capability drop/add list (docker run --cap-drop/--cap-add shape)
#   3. an SELinux type-enforcement rule stub (policy-language shape)
# Every string below matches the REAL syntax these tools expect --
# this script just assembles it from one small declaration, run for real.
import json

SERVICE = {
    "name": "static-file-http-server",
    "syscalls_allowed": [
        "epoll_wait", "accept4", "fcntl", "readv", "writev", "openat",
        "newfstatat", "mmap", "munmap", "brk", "sendto", "recvfrom",
        "close", "read", "write", "socket", "bind", "listen",
        "rt_sigaction", "rt_sigprocmask", "rt_sigreturn", "futex",
        "clone", "set_robust_list", "getrandom", "prlimit64",
        "arch_prctl", "set_tid_address", "exit", "exit_group", "poll",
    ],
    "capabilities_needed": ["CAP_NET_BIND_SERVICE"],
    "selinux_domain": "hardened_httpd_t",
    "selinux_content_type": "hardened_httpd_content_t",
}

def build_seccomp_profile(service):
    return {
        "defaultAction": "SCMP_ACT_ERRNO",
        "architectures": ["SCMP_ARCH_X86_64"],
        "syscalls": [
            {"names": sorted(service["syscalls_allowed"]), "action": "SCMP_ACT_ALLOW"}
        ],
    }

ALL_DOCKER_DEFAULT_CAPS = [
    "CHOWN", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "SETGID",
    "SETUID", "SETPCAP", "NET_BIND_SERVICE", "NET_RAW", "SYS_CHROOT",
    "MKNOD", "AUDIT_WRITE", "SETFCAP",
]

def build_capability_flags(service):
    needed = {c.replace("CAP_", "") for c in service["capabilities_needed"]}
    dropped = sorted(set(ALL_DOCKER_DEFAULT_CAPS) - needed)
    flags = ["--cap-drop=ALL"] + [f"--cap-add={c}" for c in sorted(needed)]
    return flags, dropped

def build_selinux_rules(service):
    domain = service["selinux_domain"]
    content = service["selinux_content_type"]
    return [
        f"type {domain};",
        f"type {content};",
        f"allow {domain} {content}:file {{ read getattr open }};",
        f"allow {domain} self:tcp_socket {{ create bind listen accept read write }};",
        f"# NOTE: no rule grants {domain} write access to {content} --",
        f"# even the process's own UID-0-mapped root cannot bypass this,",
        f"# because MAC is checked in addition to, not instead of, DAC.",
    ]

profile = build_seccomp_profile(SERVICE)
print("--- 1. seccomp profile (OCI/Docker JSON shape) ---")
print(json.dumps(profile, indent=2))
print(f"\nallowlist size = {len(profile['syscalls'][0]['names'])} syscalls "
      f"(everything else -> SCMP_ACT_ERRNO)")

flags, dropped = build_capability_flags(SERVICE)
print("\n--- 2. capability flags (docker run shape) ---")
print(" ".join(flags))
print(f"dropped from Docker's own default set ({len(ALL_DOCKER_DEFAULT_CAPS)} caps): "
      f"{len(dropped)} -> {dropped}")

print("\n--- 3. SELinux type-enforcement stub ---")
for line in build_selinux_rules(SERVICE):
    print(line)

print("\n--- combined: what actually ships for this service ---")
print(f"namespaces : PID+mount+net+UTS+IPC+user (from the previous lesson)")
print(f"cgroup     : memory.max, cpu.max, pids.max (from the previous lesson)")
print(f"seccomp    : {len(profile['syscalls'][0]['names'])}-syscall allowlist, default ERRNO")
print(f"capabilities: bounding set reduced from {len(ALL_DOCKER_DEFAULT_CAPS)} to "
      f"{len(SERVICE['capabilities_needed'])} ({SERVICE['capabilities_needed'][0]})")
print(f"MAC        : confined to SELinux domain {SERVICE['selinux_domain']}")

প্রকৃত চালিয়ে পাওয়া output (deterministic — হুবহু এটাই আসবে):

--- 1. seccomp profile (OCI/Docker JSON shape) ---
{
  "defaultAction": "SCMP_ACT_ERRNO",
  "architectures": [
    "SCMP_ARCH_X86_64"
  ],
  "syscalls": [
    {
      "names": [
        "accept4",
        "arch_prctl",
        "bind",
        "brk",
        "clone",
        "close",
        "epoll_wait",
        "exit",
        "exit_group",
        "fcntl",
        "futex",
        "getrandom",
        "listen",
        "mmap",
        "munmap",
        "newfstatat",
        "openat",
        "poll",
        "prlimit64",
        "read",
        "readv",
        "recvfrom",
        "rt_sigaction",
        "rt_sigprocmask",
        "rt_sigreturn",
        "sendto",
        "set_robust_list",
        "set_tid_address",
        "socket",
        "write",
        "writev"
      ],
      "action": "SCMP_ACT_ALLOW"
    }
  ]
}

allowlist size = 31 syscalls (everything else -> SCMP_ACT_ERRNO)

--- 2. capability flags (docker run shape) ---
--cap-drop=ALL --cap-add=NET_BIND_SERVICE
dropped from Docker's own default set (14 caps): 13 -> ['AUDIT_WRITE', 'CHOWN', 'DAC_OVERRIDE', 'FOWNER', 'FSETID', 'KILL', 'MKNOD', 'NET_RAW', 'SETFCAP', 'SETGID', 'SETPCAP', 'SETUID', 'SYS_CHROOT']

--- 3. SELinux type-enforcement stub ---
type hardened_httpd_t;
type hardened_httpd_content_t;
allow hardened_httpd_t hardened_httpd_content_t:file { read getattr open };
allow hardened_httpd_t self:tcp_socket { create bind listen accept read write };
# NOTE: no rule grants hardened_httpd_t write access to hardened_httpd_content_t --
# even the process's own UID-0-mapped root cannot bypass this,
# because MAC is checked in addition to, not instead of, DAC.

--- combined: what actually ships for this service ---
namespaces : PID+mount+net+UTS+IPC+user (from the previous lesson)
cgroup     : memory.max, cpu.max, pids.max (from the previous lesson)
seccomp    : 31-syscall allowlist, default ERRNO
capabilities: bounding set reduced from 14 to 1 (CAP_NET_BIND_SERVICE)
MAC        : confined to SELinux domain hardened_httpd_t

সবচেয়ে গুরুত্বপূর্ণ সারি শেষেরটা — একটা মাত্র SERVICE dict থেকে পাঁচটা স্বাধীন স্তরের প্রতিটাই একটা concrete, deploy-করার-উপযোগী config-এ রূপান্তরিত হয়েছে। Docker-এর নিজস্ব ১৪-capability ডিফল্ট থেকে মাত্র ১টা (NET_BIND_SERVICE) রেখে বাকি ১৩টা drop হয়েছে, আর SELinux stub স্পষ্টভাবে দেখাচ্ছে hardened_httpd_t-এর কোনো write-path hardened_httpd_content_t-এর দিকে নেই — মডিউলের Hardened HTTP Server প্রজেক্টে ঠিক এই প্যাটার্নটাই বাস্তব runc/Docker/Kubernetes config হিসেবে ব্যবহার করা হবে।

নিজে বাড়ান:

1. SERVICE["syscalls_allowed"]-এ execve যোগ করে দেখুন seccomp profile-এ কী বদলায় — তারপর যুক্তি দিন কেন এটা কখনো একটা static-file server-এর জন্য করা উচিত না
2. একটা দ্বিতীয় SERVICE dict বানান একটা এমন সার্ভিসের জন্য যার সত্যিই subprocess spawn করার দরকার আছে (যেমন একটা image-thumbnail generator যা ffmpeg কল করে) — allowlist-এ কী কী নতুন syscall/capability যোগ করতে হবে, আর কীভাবে সেই বর্ধিত অনুমতিকে যতটা সম্ভব সংকীর্ণ রাখবেন (যেমন শুধু নির্দিষ্ট একটা path-এর execve অনুমোদন, arg-constraint দিয়ে)
3. build_selinux_rules-এ একটা নতুন rule যোগ করুন যা hardened_httpd_t-কে hardened_httpd_content_t-এ write করার অনুমতি দেয় শুধু একটা নির্দিষ্ট sub-domain (যেমন hardened_httpd_upload_t) থেকে — কেন এই ধরনের fine-grained domain-splitting বাস্তব SELinux policy-তে (যেমন Android-এর SEAndroid) সাধারণ একটা প্যাটার্ন তা নোট করুন