# 查看当前进程的权能
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  bash -c 'cat /proc/self/status | grep Cap'
# CapInh: 0000000000000000
# CapPrm: 0000000000000000
# CapEff: 0000000000000000
# CapBnd: 0000000000000000
# CapAmb: 0000000000000000

# 所有值为 0，表示沙箱进程没有任何权能

# 添加 CAP_NET_BIND_SERVICE，允许绑定低端口
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  --cap-add CAP_NET_BIND_SERVICE \
  bash -c 'cat /proc/self/status | grep CapEff'
# CapEff: 0000000000000400

# 解码权能
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --cap-add CAP_NET_BIND_SERVICE \
  bash -c '
    capsh --decode=0000000000000400 2>/dev/null || \
    python3 -c "print(f\"{0x0000000000000400:064b}\")"
  '

# 即使在 user namespace 内映射为 root，也要显式删除权能
bwrap \
  --ro-bind / / \
  --unshare-user \
  --uid 0 \
  --dev /dev \
  --proc /proc \
  --cap-drop ALL \
  bash -c 'cat /proc/self/status | grep CapEff'
# CapEff: 0000000000000000

# 安装 seccomp 工具
# Fedora: sudo dnf install libseccomp-devel
# Debian: sudo apt install libseccomp-dev

# 创建一个简单的 seccomp 过滤规则
# 使用 JSON 格式（需要 bwrap 编译时支持 libseccomp）
cat > /tmp/seccomp.json << 'EOF'
{
    "defaultAction": "SCMP_ACT_ALLOW",
    "architectures": ["SCMP_ARCH_X86_64"],
    "syscalls": [
        {
            "names": ["mount", "umount2", "pivot_root", "chroot"],
            "action": "SCMP_ACT_ERRNO"
        },
        {
            "names": ["reboot", "kexec_load", "kexec_file_load"],
            "action": "SCMP_ACT_ERRNO"
        },
        {
            "names": ["init_module", "finit_module", "delete_module"],
            "action": "SCMP_ACT_ERRNO"
        },
        {
            "names": ["ptrace", "process_vm_readv", "process_vm_writev"],
            "action": "SCMP_ACT_ERRNO"
        },
        {
            "names": ["ioperm", "iopl"],
            "action": "SCMP_ACT_ERRNO"
        }
    ]
}
EOF

# 策略 1: 白名单模式（最安全）
# 只允许已知安全的系统调用
cat > /tmp/seccomp-whitelist.json << 'EOF'
{
    "defaultAction": "SCMP_ACT_ERRNO",
    "syscalls": [
        {
            "names": [
                "read", "write", "open", "close", "stat", "fstat", "lstat",
                "poll", "lseek", "mmap", "mprotect", "munmap", "brk",
                "ioctl", "access", "pipe", "select", "sched_yield",
                "mremap", "msync", "mincore", "madvise",
                "dup", "dup2", "nanosleep", "getpid", "clone",
                "fork", "execve", "exit", "wait4", "kill",
                "uname", "fcntl", "flock", "fsync", "fdatasync",
                "getcwd", "chdir", "mkdir", "rmdir", "link", "unlink",
                "readlink", "chmod", "chown", "lchown", "umask",
                "gettimeofday", "getuid", "getgid", "geteuid", "getegid",
                "getppid", "getpgrp", "setsid", "setreuid", "setregid",
                "getgroups", "setgroups", "setresuid", "setresgid",
                "getpgid", "setpgid", "getsid", "sigaltstack",
                "rt_sigaction", "rt_sigprocmask", "rt_sigreturn",
                "set_tid_address", "futex", "epoll_create", "epoll_wait",
                "epoll_ctl", "clock_gettime", "clock_getres",
                "exit_group", "openat", "mkdirat", "newfstatat",
                "unlinkat", "renameat", "readlinkat", "fchmodat",
                "faccessat", "pselect6", "utimensat", "epoll_create1",
                "pipe2", "dup3", "pread64", "pwrite64", "readv", "writev",
                "sendfile", "signalfd4", "epoll_pwait", "timerfd_create",
                "eventfd2", "accept4", "epoll_ctl", "clock_nanosleep",
                "getrandom", "memfd_create"
            ],
            "action": "SCMP_ACT_ALLOW"
        }
    ]
}
EOF

# 策略 2: 黑名单模式（更实用）
# 允许大部分操作，只禁止危险的系统调用
cat > /tmp/seccomp-blacklist.json << 'EOF'
{
    "defaultAction": "SCMP_ACT_ALLOW",
    "syscalls": [
        {
            "names": [
                "mount", "umount2", "pivot_root", "chroot",
                "reboot", "kexec_load", "kexec_file_load",
                "init_module", "finit_module", "delete_module",
                "ptrace", "process_vm_readv", "process_vm_writev",
                "ioperm", "iopl", "swapon", "swapoff",
                "acct", "settimeofday", "clock_settime",
                "nfsservctl", "quotactl", "lookup_dcookie",
                "perf_event_open", "bpf", "userfaultfd"
            ],
            "action": "SCMP_ACT_ERRNO"
        }
    ]
}
EOF

# 验证危险系统调用被阻止
bwrap \
  --ro-bind / / \
  --unshare-all \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  bash -c '
    # 尝试 mount 系统调用
    mount -t tmpfs tmpfs /tmp/test 2>&1
    # mount: /tmp/test: permission denied.

    # 尝试 reboot
    reboot 2>&1 || echo "reboot 被阻止"

    # 尝试加载内核模块
    modprobe dummy 2>&1 || echo "modprobe 被阻止"
  '

# 使用 ulimit 限制资源（bash 内置）
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  bash -c '
    # 限制进程数
    ulimit -u 50

    # 限制文件大小
    ulimit -f 10240  # 10MB

    # 限制打开文件数
    ulimit -n 256

    # 限制虚拟内存
    ulimit -v 524288  # 512MB

    # 验证限制
    ulimit -a
  '

#!/bin/bash
# 使用 systemd-run 为 bwrap 创建 cgroup

# 使用 systemd-run 限制资源
systemd-run --user --scope \
  -p MemoryMax=512M \
  -p CPUQuota=50% \
  -p TasksMax=100 \
  bwrap \
    --ro-bind / / \
    --dev /dev \
    --proc /proc \
    --tmpfs /tmp \
    bash

# 或者使用 cgroup v2 手动配置
# echo "+memory +cpu" > /sys/fs/cgroup/cgroup.subtree_control
# mkdir /sys/fs/cgroup/sandbox
# echo 536870912 > /sys/fs/cgroup/sandbox/memory.max  # 512MB
# echo 50000 100000 > /sys/fs/cgroup/sandbox/cpu.max   # 50% CPU
# echo $$ > /sys/fs/cgroup/sandbox/cgroup.procs

# 确保父进程退出时沙箱也退出
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  --die-with-parent \
  bash -c 'echo "I will die when my parent exits"'

# 限制进程数，防止 fork 炸弹
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  bash -c '
    ulimit -u 20  # 最多 20 个进程

    # fork 炸弹测试（安全，因为有进程数限制）
    :(){ :|:& };: 2>&1 || echo "Fork bomb limited by ulimit"
  '

# 检查 SELinux 状态
getenforce
# Enforcing

# 查看 bwrap 进程的 SELinux 上下文
bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  bash -c 'id -Z'
# unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

# 创建自定义 SELinux 策略模块
cat > bwrap_sandbox.te << 'EOF'
policy_module(bwrap_sandbox, 1.0)

# 定义沙箱域
type sandbox_t;
type sandbox_exec_t;
domain_type(sandbox_t)
domain_entry_file(sandbox_t, sandbox_exec_t)

# 允许沙箱域访问 tmpfs
allow sandbox_t tmpfs_t:file { read write create };
allow sandbox_t tmpfs_t:dir { read write create add_name };

# 允许沙箱域访问 proc
allow sandbox_t proc_t:file read;

# 允许沙箱域访问 dev
allow sandbox_t device_t:chr_file { read write };

# 不允许沙箱域访问网络（可选）
# neverallow sandbox_t self:tcp_socket { create connect };
EOF

# 编译和加载策略
# checkmodule -M -m -o bwrap_sandbox.mod bwrap_sandbox.te
# semodule_package -o bwrap_sandbox.pp -m bwrap_sandbox.mod
# semodule -i bwrap_sandbox.pp

# 查看与容器/沙箱相关的 SELinux 布尔值
getsebool -a | grep -E "(container|sandbox|bwrap)"
# container_manage_cgroup --> off
# container_connect_any --> off

# 临时设置布尔值
setsebool container_manage_cgroup on

# 永久设置
setsebool -P container_manage_cgroup on

# 检查 AppArmor 状态
sudo aa-status

# 查看 bwrap 相关的策略
sudo aa-status | grep -i bwrap

# 查看具体的策略文件
cat /etc/apparmor.d/bwrap 2>/dev/null || echo "No AppArmor profile for bwrap"

# 创建 bwrap 沙箱的 AppArmor 策略
cat > /tmp/apparmor-bwrap-sandbox << 'EOF'
#include <tunables/global>

profile bwrap-sandbox flags=(attach_disconnected) {
    #include <abstractions/base>
    #include <abstractions/nameservice>

    # 允许读取系统文件
    /usr/** r,
    /lib/** r,
    /lib64/** r,
    /bin/** r,
    /sbin/** r,
    /etc/** r,

    # 允许访问 /dev 中的必要文件
    /dev/null rw,
    /dev/zero rw,
    /dev/full rw,
    /dev/random r,
    /dev/urandom r,
    /dev/tty rw,
    /dev/pts/** rw,

    # 允许访问 /proc
    /proc/** r,
    /proc/self/** rw,

    # 允许 tmpfs 操作
    /tmp/** rw,

    # 禁止访问敏感文件
    deny /etc/shadow r,
    deny /etc/gshadow r,
    deny /proc/kallsyms r,
    deny /proc/kcore r,

    # 禁止网络操作（可选）
    deny network,

    # 禁止挂载操作
    deny mount,
    deny umount,
}
EOF

# 加载策略
# sudo cp /tmp/apparmor-bwrap-sandbox /etc/apparmor.d/
# sudo apparmor_parser -r /etc/apparmor.d/bwrap-sandbox

# 防止读取内核符号和内存
bwrap \
  --ro-bind / / \
  --tmpfs /proc \
  --ro-bind /proc/cpuinfo /proc/cpuinfo \
  --ro-bind /proc/meminfo /proc/meminfo \
  --ro-bind /proc/self /proc/self \
  --ro-bind /proc/thread-self /proc/thread-self \
  --dev /dev \
  bash -c '
    # 可以读取的基本信息
    cat /proc/cpuinfo | head -5
    cat /proc/meminfo | head -5

    # 无法读取敏感信息
    cat /proc/kallsyms 2>&1 || echo "kallsyms 不可访问"
    cat /proc/kcore 2>&1 || echo "kcore 不可访问"
  '

# 不暴露其他用户的信息
bwrap \
  --ro-bind / / \
  --tmpfs /var/log \
  --tmpfs /var/mail \
  --tmpfs /var/spool \
  --dev /dev \
  --proc /proc \
  bash -c '
    # lastlog 不可用
    lastlog 2>&1 | head -3 || echo "lastlog 不可用"

    # who 不显示其他用户
    who 2>&1 || echo "who 不可用"
  '

#!/bin/bash
# secure-sandbox.sh - 生产级安全沙箱
# 用法: ./secure-sandbox.sh <命令> [参数...]

set -euo pipefail

# 安全函数
die() { echo "Error: $*" >&2; exit 1; }

# 检查 bwrap
command -v bwrap >/dev/null 2>&1 || die "bwrap not found"

# 执行带安全加固的沙箱
exec bwrap \
  --ro-bind / / \
  --dev /dev \
  --proc /proc \
  --tmpfs /tmp \
  --tmpfs /var/tmp \
  --tmpfs /run \
  --tmpfs /home/user/.ssh \
  --tmpfs /home/user/.gnupg \
  --tmpfs /home/user/.aws \
  --tmpfs /home/user/.kube \
  --unshare-all \
  --hostname sandbox \
  --die-with-parent \
  --new-session \
  --cap-drop ALL \
  --clearenv \
  --setenv HOME /home/user \
  --setenv USER user \
  --setenv PATH /usr/local/bin:/usr/bin:/bin \
  --setenv LANG "${LANG:-en_US.UTF-8}" \
  --setenv TERM "${TERM:-xterm-256color}" \
  "$@"

# 在安全沙箱中运行 Python
./secure-sandbox.sh python3

# 在安全沙箱中运行 bash
./secure-sandbox.sh bash

# 在安全沙箱中执行脚本
./secure-sandbox.sh bash -c 'echo "Hello from secure sandbox"'

#!/bin/bash
# audit-sandbox.sh - 审计沙箱配置的安全性

echo "=== Bubblewrap 沙箱安全审计 ==="
echo ""

# 1. 检查 User Namespace
echo "1. User Namespace 支持:"
if unshare --user --map-root-user echo "OK" &>/dev/null; then
    echo "   ✅ 支持（推荐使用 user namespace 模式）"
else
    echo "   ❌ 不支持（可能使用 setuid 模式，安全性较低）"
fi

# 2. 检查 bwrap 是否为 setuid
echo ""
echo "2. bwrap setuid 状态:"
BWRAP_PATH=$(which bwrap)
BWRAP_PERMS=$(stat -c '%a' "$BWRAP_PATH")
if [[ "$BWRAP_PERMS" == *"4"* ]]; then
    echo "   ⚠️ bwrap 是 setuid ($BWRAP_PERMS)，存在提权风险"
else
    echo "   ✅ bwrap 不是 setuid ($BWRAP_PERMS)"
fi

# 3. 检查 seccomp 支持
echo ""
echo "3. seccomp 支持:"
if [ -f /proc/self/status ] && grep -q Seccomp /proc/self/status; then
    echo "   ✅ 内核支持 seccomp"
else
    echo "   ❌ 内核不支持 seccomp"
fi

# 4. 检查 SELinux/AppArmor
echo ""
echo "4. MAC 系统:"
if command -v getenforce &>/dev/null; then
    SELINUX_STATUS=$(getenforce)
    echo "   SELinux: $SELINUX_STATUS"
elif command -v aa-status &>/dev/null; then
    echo "   AppArmor: $(sudo aa-status --enabled 2>/dev/null && echo 'enabled' || echo 'unknown')"
else
    echo "   无 MAC 系统"
fi

# 5. 检查内核参数
echo ""
echo "5. 内核参数:"
echo "   unprivileged_userns_clone: $(cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null || echo 'N/A')"
echo "   max_user_namespaces: $(cat /proc/sys/user/max_user_namespaces 2>/dev/null || echo 'N/A')"

echo ""
echo "=== 审计完成 ==="