feat(sandbox): bind /proc in bwrap on Lakebox hosts

The linux_bwrap sandbox mounts a fresh procfs under --unshare-pid, but a
Lakebox microVM masks /proc so that mount returns EPERM and the sandbox
fails to start. That blocked linux_bwrap — and the L7 egress management
built on top of it — on the Lakebox backend.

Bind the existing /proc instead of mounting a fresh one, but only on
outer sandbox backends known to be safe for it (allow-list: lakebox).
The backend is read from OMNIGENT_HOST_SANDBOX_BACKEND when set, else
autodetected via the /run/lakebox marker. Everywhere else the fresh-proc
mount and its fail-closed behavior stay unchanged.

Binding /proc exposes the outer process list and world-readable per-proc
files (cmdline/comm/stat/status). The retained user namespace still
blocks ptrace-gated files (environ/mem/maps/fd) and --unshare-pid still
contains signalling, so the leak is acceptable on a single-tenant
Lakebox microVM.

Signed-off-by: Thomas Garnier <6202935+mxatone@users.noreply.github.com>

Author: mxatone

omnigent/inner/bwrap_sandbox.py

@@ -18,7 +18,9 @@
   ``/etc/ld.so.cache``, ``/etc/ld.so.conf``,
   ``/etc/ld.so.conf.d``, ``/etc/ssl``, ``/etc/ca-certificates``,
   ``/etc/pki``) bound read-only via ``--ro-bind-try``.
-- Fresh ``/proc``, ``/dev``, and ``/tmp``.
+- Fresh ``/proc`` (bind-mounted from the host on outer sandboxes that
+  forbid a fresh procfs mount, e.g. Lakebox — see
+  :func:`_should_bind_host_proc`), ``/dev``, and ``/tmp``.
 - Cwd bind-mounted read-only by default; explicit
   ``write_paths: ["."]`` flips it to read-write. Top-level
   dotfiles / dotdirs in cwd are tmpfs-masked unless their name is
@@ -175,6 +177,83 @@
 )
 
 
+# ---------------------------------------------------------------------------
+# Nested-sandbox /proc handling
+# ---------------------------------------------------------------------------
+
+# Outer sandbox backends whose microVM/container permits binding the
+# existing ``/proc`` but forbids mounting a FRESH procfs under
+# ``--unshare-pid`` (masked ``/proc`` overmounts make ``mount proc``
+# return EPERM). On these backends the bwrap wrap binds the host
+# ``/proc`` instead of emitting ``--proc /proc``.
+#
+# Why an explicit allow-list rather than a "fresh-proc mount failed, retry
+# with a bind" fallback: binding the existing ``/proc`` is a security
+# DOWNGRADE. It exposes the outer process list plus the world-readable
+# per-process files (``cmdline`` / ``comm`` / ``stat`` / ``status``) to the
+# sandboxed helper. It does NOT expose the ptrace-gated files (``environ``
+# / ``mem`` / ``maps`` / ``fd``): the retained user namespace keeps those
+# blocked even for same-uid targets and even as namespaced root, and
+# ``--unshare-pid`` still contains signalling. That leak is acceptable on a
+# single-tenant dev microVM (Lakebox) but not on an arbitrary host, so the
+# downgrade is only taken for vetted backends. Add entries here as more
+# backends are verified safe.
+_PROC_BIND_HOST_BACKENDS: frozenset[str] = frozenset({"lakebox"})
+
+# Env var an outer launcher may set to name the host's outer sandbox
+# backend (e.g. ``lakebox``). Authoritative when present; otherwise the
+# backend is autodetected (see ``_detect_host_sandbox_backend``). Note it
+# must survive ``SandboxPolicy.spawn_env_allowlist`` pruning to be visible
+# on the re-exec launcher path — the marker autodetect below is the
+# prune-proof fallback that lakebox relies on today.
+_HOST_SANDBOX_BACKEND_ENV = "OMNIGENT_HOST_SANDBOX_BACKEND"
+
+# Marker directory the Databricks Lakebox runtime seeds inside every
+# microVM. Used to autodetect lakebox when the launcher hasn't declared the
+# backend via ``_HOST_SANDBOX_BACKEND_ENV``.
+_LAKEBOX_MARKER = Path("/run/lakebox")
+
+
+def _detect_host_sandbox_backend() -> str | None:
+    """
+    Identify the outer sandbox backend this host process runs under.
+
+    Prefers the explicit ``OMNIGENT_HOST_SANDBOX_BACKEND`` env var (set by
+    the launcher that provisioned this host); otherwise falls back to
+    lakebox autodetection via the :data:`_LAKEBOX_MARKER` directory. Runs
+    in the host/parent process — never inside the agent's sandbox — so the
+    signals it reads cannot be forged from within the sandbox.
+
+    :returns: Lower-cased backend name (e.g. ``"lakebox"``), or ``None``
+        when the host is not running under a recognised outer sandbox.
+    """
+    declared = os.environ.get(_HOST_SANDBOX_BACKEND_ENV)
+    if declared and declared.strip():
+        return declared.strip().lower()
+    try:
+        if _LAKEBOX_MARKER.is_dir():
+            return "lakebox"
+    except OSError:
+        pass
+    return None
+
+
+def _should_bind_host_proc() -> bool:
+    """
+    Whether the bwrap wrap should bind the existing ``/proc`` instead of
+    mounting a fresh procfs.
+
+    ``True`` only when the host runs under an outer sandbox backend in
+    :data:`_PROC_BIND_HOST_BACKENDS` (lakebox today). On every other host
+    the fresh-proc mount is kept, so ordinary hosts — and their fail-closed
+    behaviour when a fresh procfs mount is denied — are unchanged.
+
+    :returns: ``True`` to emit ``--bind /proc /proc``; ``False`` to emit
+        ``--proc /proc``.
+    """
+    return _detect_host_sandbox_backend() in _PROC_BIND_HOST_BACKENDS
+
+
 # ---------------------------------------------------------------------------
 # Backend
 # ---------------------------------------------------------------------------
@@ -344,9 +423,18 @@ def wrap_launcher_argv(
         # /proc, /dev (filtered by bwrap to a safe minimal device set),
         # and a private /tmp so the agent's writes there don't pollute
         # the host.
+        #
+        # ``--proc`` mounts a FRESH procfs tied to the new PID namespace so
+        # the helper sees only its own processes. Some nested outer
+        # sandboxes (Lakebox) forbid that mount under ``--unshare-pid``
+        # (masked ``/proc`` overmounts -> ``mount proc: EPERM``), so there
+        # we bind the host ``/proc`` instead. See ``_should_bind_host_proc``
+        # for the gate and the security trade-off.
+        if _should_bind_host_proc():
+            bwrap_args += ["--bind", "/proc", "/proc"]
+        else:
+            bwrap_args += ["--proc", "/proc"]
         bwrap_args += [
-            "--proc",
-            "/proc",
             "--dev",
             "/dev",
             "--tmpfs",

tests/inner/test_bwrap_sandbox.py

@@ -36,12 +36,17 @@
 
 import pytest
 
+from omnigent.inner import bwrap_sandbox
 from omnigent.inner.bwrap_sandbox import (
     _ALLOWED_SOCKET_FAMILIES,
     _CLONE_NEW_FLAG_BITS,
     _DEFAULT_CWD_ALLOW_HIDDEN,
+    _HOST_SANDBOX_BACKEND_ENV,
+    _PROC_BIND_HOST_BACKENDS,
     BwrapSandboxBackend,
     _bwrap_extra_seccomp_rules,
+    _detect_host_sandbox_backend,
+    _should_bind_host_proc,
 )
 from omnigent.inner.datamodel import OSEnvSandboxSpec, OSEnvSpec
 from omnigent.inner.sandbox import SandboxPolicy, with_denied_unix_sockets
@@ -879,6 +884,124 @@ def _last_index(pred: object) -> int:
     )
 
 
+# ---------------------------------------------------------------------------
+# Nested-sandbox /proc handling (lakebox proc bind)
+# ---------------------------------------------------------------------------
+
+
+def _clear_host_backend_signals(monkeypatch: pytest.MonkeyPatch, tmp_path: Path) -> None:
+    """
+    Neutralise every host-backend signal so detection returns ``None``.
+
+    Removes the declaration env var and repoints the lakebox marker at a
+    path that does not exist, isolating the test from the machine it runs
+    on — which must not be assumed to be (or not to be) a lakebox microVM.
+    """
+    monkeypatch.delenv(_HOST_SANDBOX_BACKEND_ENV, raising=False)
+    monkeypatch.setattr(bwrap_sandbox, "_LAKEBOX_MARKER", tmp_path / "no-such-marker")
+
+
+def test_detect_host_backend_none_without_signals(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """
+    With no env declaration and no marker, no outer backend is detected,
+    so the proc bind stays off (fresh procfs is kept everywhere by
+    default).
+    """
+    _clear_host_backend_signals(monkeypatch, tmp_path)
+    assert _detect_host_sandbox_backend() is None
+    assert _should_bind_host_proc() is False
+
+
+def test_detect_host_backend_env_declaration_is_normalised(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """
+    ``OMNIGENT_HOST_SANDBOX_BACKEND`` is the explicit, authoritative
+    signal; it is trimmed and lower-cased so callers don't have to match
+    an exact casing, and ``lakebox`` is on the proc-bind allow-list.
+    """
+    _clear_host_backend_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv(_HOST_SANDBOX_BACKEND_ENV, "  LakeBox  ")
+    assert _detect_host_sandbox_backend() == "lakebox"
+    assert _should_bind_host_proc() is True
+
+
+def test_detect_host_backend_env_non_lakebox_keeps_fresh_proc(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """
+    A declared backend that is NOT on :data:`_PROC_BIND_HOST_BACKENDS`
+    must not trigger the proc downgrade — even if the lakebox marker
+    happens to exist — because the explicit declaration is authoritative.
+    """
+    marker = tmp_path / "run-lakebox"
+    marker.mkdir()
+    monkeypatch.setattr(bwrap_sandbox, "_LAKEBOX_MARKER", marker)
+    monkeypatch.setenv(_HOST_SANDBOX_BACKEND_ENV, "modal")
+    assert _detect_host_sandbox_backend() == "modal"
+    assert "modal" not in _PROC_BIND_HOST_BACKENDS
+    assert _should_bind_host_proc() is False
+
+
+def test_detect_host_backend_marker_autodetects_lakebox(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """
+    When no env var is set, the ``/run/lakebox`` marker directory
+    autodetects lakebox. This is the prune-proof fallback the re-exec
+    launcher path relies on (the env var may be stripped by the spawn
+    allow-list, but the filesystem marker survives).
+    """
+    marker = tmp_path / "run-lakebox"
+    marker.mkdir()
+    monkeypatch.delenv(_HOST_SANDBOX_BACKEND_ENV, raising=False)
+    monkeypatch.setattr(bwrap_sandbox, "_LAKEBOX_MARKER", marker)
+    assert _detect_host_sandbox_backend() == "lakebox"
+    assert _should_bind_host_proc() is True
+
+
+def test_wrap_launcher_argv_fresh_proc_by_default(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """
+    On an ordinary host the wrap emits ``--proc /proc`` (a fresh procfs
+    tied to the new PID namespace) and never binds the host ``/proc``.
+    """
+    _clear_host_backend_signals(monkeypatch, tmp_path)
+    backend = _make_backend()
+    policy = _make_policy(tmp_path)
+    argv = backend.wrap_launcher_argv([sys.executable, "-c", "pass"], policy, tmp_path)
+    assert _has_pair_single_dest(argv, "--proc", "/proc")
+    assert not _has_pair(argv, "--bind", "/proc", "/proc")
+
+
+def test_wrap_launcher_argv_binds_proc_on_lakebox(
+    monkeypatch: pytest.MonkeyPatch, tmp_path: Path
+) -> None:
+    """
+    On a lakebox host the wrap binds the existing ``/proc`` instead of
+    mounting a fresh procfs (lakebox's masked ``/proc`` overmounts make
+    the fresh mount fail under ``--unshare-pid``). ``/dev`` and ``/tmp``
+    are unaffected.
+    """
+    _clear_host_backend_signals(monkeypatch, tmp_path)
+    monkeypatch.setenv(_HOST_SANDBOX_BACKEND_ENV, "lakebox")
+    backend = _make_backend()
+    policy = _make_policy(tmp_path)
+    argv = backend.wrap_launcher_argv([sys.executable, "-c", "pass"], policy, tmp_path)
+    assert _has_pair(argv, "--bind", "/proc", "/proc"), (
+        "lakebox host must bind the existing /proc; got no `--bind /proc /proc`."
+    )
+    assert not _has_pair_single_dest(argv, "--proc", "/proc"), (
+        "lakebox host must NOT also mount a fresh procfs — the two would "
+        "conflict at the same mountpoint."
+    )
+    assert _has_pair_single_dest(argv, "--dev", "/dev")
+    assert "--tmpfs" in argv
+
+
 # ---------------------------------------------------------------------------
 # Dotfile masking + symlink defense
 # ---------------------------------------------------------------------------