Implementation of sandbox "Write-Protected" Governance Files (#23139)

Co-authored-by: Abhi <43648792+abhipatel12@users.noreply.github.com>

packages/core/src/sandbox/linux/LinuxSandboxManager.test.ts

@@ -4,15 +4,42 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { describe, it, expect, beforeEach } from 'vitest';
+import { describe, it, expect, vi, beforeEach } from 'vitest';
 import { LinuxSandboxManager } from './LinuxSandboxManager.js';
 import type { SandboxRequest } from '../../services/sandboxManager.js';
+import fs from 'node:fs';
+
+vi.mock('node:fs', async () => {
+  const actual = await vi.importActual<typeof import('node:fs')>('node:fs');
+  return {
+    ...actual,
+    default: {
+      // @ts-expect-error - Property 'default' does not exist on type 'typeof import("node:fs")'
+      ...actual.default,
+      existsSync: vi.fn(() => true),
+      realpathSync: vi.fn((p: string | Buffer) => p.toString()),
+      mkdirSync: vi.fn(),
+      openSync: vi.fn(),
+      closeSync: vi.fn(),
+      writeFileSync: vi.fn(),
+    },
+    existsSync: vi.fn(() => true),
+    realpathSync: vi.fn((p: string | Buffer) => p.toString()),
+    mkdirSync: vi.fn(),
+    openSync: vi.fn(),
+    closeSync: vi.fn(),
+    writeFileSync: vi.fn(),
+  };
+});
 
 describe('LinuxSandboxManager', () => {
   const workspace = '/home/user/workspace';
   let manager: LinuxSandboxManager;
 
   beforeEach(() => {
+    vi.clearAllMocks();
+    vi.mocked(fs.existsSync).mockReturnValue(true);
+    vi.mocked(fs.realpathSync).mockImplementation((p) => p.toString());
     manager = new LinuxSandboxManager({ workspace });
   });
 
@@ -52,6 +79,15 @@ describe('LinuxSandboxManager', () => {
       '--bind',
       workspace,
       workspace,
+      '--ro-bind',
+      `${workspace}/.gitignore`,
+      `${workspace}/.gitignore`,
+      '--ro-bind',
+      `${workspace}/.geminiignore`,
+      `${workspace}/.geminiignore`,
+      '--ro-bind',
+      `${workspace}/.git`,
+      `${workspace}/.git`,
       '--seccomp',
       '9',
       '--',
@@ -79,6 +115,15 @@ describe('LinuxSandboxManager', () => {
       '--bind',
       workspace,
       workspace,
+      '--ro-bind',
+      `${workspace}/.gitignore`,
+      `${workspace}/.gitignore`,
+      '--ro-bind',
+      `${workspace}/.geminiignore`,
+      `${workspace}/.geminiignore`,
+      '--ro-bind',
+      `${workspace}/.git`,
+      `${workspace}/.git`,
       '--bind-try',
       '/tmp/cache',
       '/tmp/cache',
@@ -88,6 +133,48 @@ describe('LinuxSandboxManager', () => {
     ]);
   });
 
+  it('protects real paths of governance files if they are symlinks', async () => {
+    vi.mocked(fs.realpathSync).mockImplementation((p) => {
+      if (p.toString() === `${workspace}/.gitignore`)
+        return '/shared/global.gitignore';
+      return p.toString();
+    });
+
+    const bwrapArgs = await getBwrapArgs({
+      command: 'ls',
+      args: [],
+      cwd: workspace,
+      env: {},
+    });
+
+    expect(bwrapArgs).toContain('--ro-bind');
+    expect(bwrapArgs).toContain(`${workspace}/.gitignore`);
+    expect(bwrapArgs).toContain('/shared/global.gitignore');
+
+    // Check that both are bound
+    const gitignoreIndex = bwrapArgs.indexOf(`${workspace}/.gitignore`);
+    expect(bwrapArgs[gitignoreIndex - 1]).toBe('--ro-bind');
+    expect(bwrapArgs[gitignoreIndex + 1]).toBe(`${workspace}/.gitignore`);
+
+    const realGitignoreIndex = bwrapArgs.indexOf('/shared/global.gitignore');
+    expect(bwrapArgs[realGitignoreIndex - 1]).toBe('--ro-bind');
+    expect(bwrapArgs[realGitignoreIndex + 1]).toBe('/shared/global.gitignore');
+  });
+
+  it('touches governance files if they do not exist', async () => {
+    vi.mocked(fs.existsSync).mockReturnValue(false);
+
+    await getBwrapArgs({
+      command: 'ls',
+      args: [],
+      cwd: workspace,
+      env: {},
+    });
+
+    expect(fs.mkdirSync).toHaveBeenCalled();
+    expect(fs.openSync).toHaveBeenCalled();
+  });
+
   it('should not bind the workspace twice even if it has a trailing slash in allowedPaths', async () => {
     const bwrapArgs = await getBwrapArgs({
       command: 'ls',
@@ -102,7 +189,20 @@ describe('LinuxSandboxManager', () => {
     const bindsIndex = bwrapArgs.indexOf('--seccomp');
     const binds = bwrapArgs.slice(bwrapArgs.indexOf('--bind'), bindsIndex);
 
-    // Should only contain the primary workspace bind, not the second one with a trailing slash
-    expect(binds).toEqual(['--bind', workspace, workspace]);
+    // Should only contain the primary workspace bind and governance files, not the second workspace bind with a trailing slash
+    expect(binds).toEqual([
+      '--bind',
+      workspace,
+      workspace,
+      '--ro-bind',
+      `${workspace}/.gitignore`,
+      `${workspace}/.gitignore`,
+      '--ro-bind',
+      `${workspace}/.geminiignore`,
+      `${workspace}/.geminiignore`,
+      '--ro-bind',
+      `${workspace}/.git`,
+      `${workspace}/.git`,
+    ]);
   });
 });

packages/core/src/sandbox/linux/LinuxSandboxManager.ts

@@ -4,14 +4,15 @@
  * SPDX-License-Identifier: Apache-2.0
  */
 
-import { join, normalize } from 'node:path';
-import { writeFileSync } from 'node:fs';
+import fs from 'node:fs';
+import { join, dirname, normalize } from 'node:path';
 import os from 'node:os';
 import {
   type SandboxManager,
   type GlobalSandboxOptions,
   type SandboxRequest,
   type SandboxedCommand,
+  GOVERNANCE_FILES,
   sanitizePaths,
 } from '../../services/sandboxManager.js';
 import {
@@ -72,11 +73,30 @@ function getSeccompBpfPath(): string {
   }
 
   const bpfPath = join(os.tmpdir(), `gemini-cli-seccomp-${process.pid}.bpf`);
-  writeFileSync(bpfPath, buf);
+  fs.writeFileSync(bpfPath, buf);
   cachedBpfPath = bpfPath;
   return bpfPath;
 }
 
+/**
+ * Ensures a file or directory exists.
+ */
+function touch(filePath: string, isDirectory: boolean) {
+  try {
+    // If it exists (even as a broken symlink), do nothing
+    if (fs.lstatSync(filePath)) return;
+  } catch {
+    // Ignore ENOENT
+  }
+
+  if (isDirectory) {
+    fs.mkdirSync(filePath, { recursive: true });
+  } else {
+    fs.mkdirSync(dirname(filePath), { recursive: true });
+    fs.closeSync(fs.openSync(filePath, 'a'));
+  }
+}
+
 /**
  * A SandboxManager implementation for Linux that uses Bubblewrap (bwrap).
  */
@@ -109,6 +129,21 @@ export class LinuxSandboxManager implements SandboxManager {
       this.options.workspace,
     ];
 
+    // Protected governance files are bind-mounted as read-only, even if the workspace is RW.
+    // We ensure they exist on the host and resolve real paths to prevent symlink bypasses.
+    // In bwrap, later binds override earlier ones for the same path.
+    for (const file of GOVERNANCE_FILES) {
+      const filePath = join(this.options.workspace, file.path);
+      touch(filePath, file.isDirectory);
+
+      const realPath = fs.realpathSync(filePath);
+
+      bwrapArgs.push('--ro-bind', filePath, filePath);
+      if (realPath !== filePath) {
+        bwrapArgs.push('--ro-bind', realPath, realPath);
+      }
+    }
+
     const allowedPaths = sanitizePaths(req.policy?.allowedPaths) || [];
     const normalizedWorkspace = normalize(this.options.workspace).replace(
       /\/$/,