lkn
/
anvillm
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Replace fabricated audit logging claims with actual observability (event stream, mailbox archives)

This commit is contained in:
Levi Neely 2026-03-18 23:53:02 +01:00
parent 862e42a58d
commit 3f271122ec
2 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/code-execution-security-guide.md
View File

@ -144,7 +144,7 @@ Validation is basic pattern matching. Not comprehensive - relies on sandbox for
**Mitigations**:
1. 9P socket permissions (Unix socket, user-only)
2. anvilsrv enforces access control
3. Audit logging in anvilsrv
3. Observability via event stream and mailbox archives
**Residual risk**: If subprocess has 9P access, it has the same capabilities as any 9P client. This is by design.

11
docs/code-execution-security.md
View File

@ -34,7 +34,7 @@ The code execution pattern allows agents to write and execute bash code in a iso
┌─────────────────────────────────────────┐
│ 9P Operations │
│ - Unix permissions │
│ - Audit logging │
│ - Event stream / mailbox archives │
└─────────────────────────────────────────┘
```
@ -248,10 +248,7 @@ if agentID != session.AgentID {
}
```
3. **Audit Logging**: All 9P operations logged
```go
log.Printf("9P: agent=%s op=%s path=%s", agentID, op, path)
```
3. **Observability**: State changes visible via event stream, message history via mailbox archives
4. **Operation Whitelist**: Only allowed operations exposed
```go
@ -308,7 +305,7 @@ import { evil } from "/etc/passwd";
1. **Data Isolation**: Intermediate data stays in subprocess — only stdout/stderr returned to the model
2. **Privacy Preservation**: PII processed in subprocess, never enters model context
3. **Explicit Control**: Agent explicitly chooses what to print (and thus what the model sees)
4. **9P Access Control**: Unix socket permissions, audit logging
4. **9P Access Control**: Unix socket permissions, event stream for observability
5. **Process Isolation**: Separate landrun sandbox per execution
6. **Code Validation**: Pattern matching rejects dangerous constructs
@ -562,7 +559,7 @@ The code execution pattern provides strong security through multiple layers:
2. **bash Subprocess**: Process-level isolation
3. **Landlock LSM**: Kernel-level enforcement
4. **Resource Limits**: Prevent exhaustion
5. **Audit Logging**: Comprehensive trail
5. **Observability**: Event stream and mailbox archives
**Security Posture**: Data isolation and explicit control over information flow via sandboxed subprocesses.