From f3e81a69dbc148b8538cc0c4bc92a9e406f5b8f9 Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Thu, 13 Aug 2026 18:33:31 +0800
Subject: [PATCH] =?UTF-8?q?security:=20Wterm(workspace=5Fedit)=20bwrap?=
 =?UTF-8?q?=E6=B2=99=E7=AE=B1=E5=8C=96=EF=BC=8C=E9=98=B2=20rm=20-rf/sudo?=
 =?UTF-8?q?=E6=8F=90=E6=9D=83/=E8=B6=8A=E7=95=8C/=E7=BD=91=E7=BB=9C?=
 =?UTF-8?q?=E6=94=BB=E5=87=BB?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- vi 编辑包进 bwrap 沙箱：只暴露 workspace(挂/home) + 只读系统目录
- --unshare-user/pid/ipc/uts/net 隔离，no_new_privileges 阻断 sudo setuid
- bwrap 缺失时拒绝终端（安全优先，不给完整 shell）
---
 wwwroot/workspace_edit.xterm | 33 ++++++++++++++++++++++++++++++++-
 1 file changed, 32 insertions(+), 1 deletion(-)

diff --git a/wwwroot/workspace_edit.xterm b/wwwroot/workspace_edit.xterm
index 1fc2e3c..aec918a 100644
--- a/wwwroot/workspace_edit.xterm
+++ b/wwwroot/workspace_edit.xterm
@@ -1,5 +1,6 @@
 import os
 import shlex
+import shutil
 
 file_id = (params_kw or {}).get('id', '').strip()
 
@@ -45,8 +46,38 @@ if not real_full.startswith(real_ws + os.sep):
     r.cmdargs = ['echo 非法路径']
     return r
 
+# bwrap 沙箱路径（不存在则拒绝终端，安全优先，不给完整 shell）
+bwrap = shutil.which('bwrap')
+if not bwrap and os.path.exists('/d/pipeline/pipeline-app/bin/bwrap'):
+    bwrap = '/d/pipeline/pipeline-app/bin/bwrap'
+
 r = DictObject()
 r.host = 'localhost'
 r.username = 'pipeline'
-r.cmdargs = ['vi ' + shlex.quote(full_path)]
+
+if not bwrap:
+    r.cmdargs = ['echo 沙箱不可用，已拒绝终端访问']
+    return r
+
+# bwrap 沙箱：只暴露 workspace（挂载到 /home 可写）+ 只读系统目录，
+# 隔离 user/pid/ipc/uts/net，防 rm -rf /、sudo 提权、越界访问、网络攻击
+cmd = (
+    bwrap +
+    ' --unshare-user --unshare-pid --unshare-ipc --unshare-uts --unshare-net'
+    ' --die-with-parent'
+    ' --ro-bind /usr /usr'
+    ' --ro-bind /bin /bin'
+    ' --ro-bind /sbin /sbin'
+    ' --ro-bind /lib /lib'
+    ' --ro-bind /lib64 /lib64'
+    ' --ro-bind /etc /etc'
+    ' --proc /proc'
+    ' --dev /dev'
+    ' --tmpfs /tmp'
+    ' --bind ' + shlex.quote(real_ws) + ' /home'
+    ' --chdir /home'
+    ' --setenv HOME /home'
+    ' -- vi ' + shlex.quote(file_id)
+)
+r.cmdargs = [cmd]
 return r