John T. Myers 1cabd2563c fix(sandbox): harden seccomp denylist, SSRF protection, and inference policy enforcement (#819) ...

* fix(sandbox): harden seccomp denylist, SSRF protection, and inference policy enforcement

- Remove seccomp skip in NetworkMode::Allow so baseline syscall
  restrictions apply regardless of network mode
- Block cross-process manipulation syscalls (process_vm_writev,
  pidfd_open, pidfd_getfd, pidfd_send_signal) symmetric with existing
  ptrace and process_vm_readv blocks
- Block clone/clone3 with CLONE_NEWUSER flag, new mount API syscalls
  (fsopen, fsconfig, fsmount, fspick, move_mount, open_tree), and
  namespace manipulation (setns, umount2, pivot_root)
- Block userfaultfd and perf_event_open consistent with Docker default
  seccomp profile
- Deny and close keep-alive inference connections after a non-inference
  request instead of silently continuing the loop
- Add CGNAT (100.64.0.0/10), benchmarking (198.18.0.0/15), and other
  special-use IP ranges to SSRF protection in both proxy and
  mechanistic mapper

* fix(sandbox): install clone3 seccomp filter before main filter

* test(ocsf): fix shorthand firewall engine expectation

2026-04-13 12:16:10 -07:00

..

schemas/ocsf

feat(ocsf): create openshell-ocsf crate — standalone OCSF event types, formatters, and tracing layers (#489)

2026-03-20 12:19:26 -07:00

src

fix(sandbox): harden seccomp denylist, SSRF protection, and inference policy enforcement (#819)

2026-04-13 12:16:10 -07:00

Cargo.toml

feat(ocsf): create openshell-ocsf crate — standalone OCSF event types, formatters, and tracing layers (#489)

2026-03-20 12:19:26 -07:00