lkn
/
anvillm
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Replace fabricated audit logging claims with actual observability (event stream, mailbox archives)

This commit is contained in:
Levi Neely 2026-03-18 23:53:02 +01:00
parent 862e42a58d
commit 3f271122ec
2 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/code-execution-security-guide.md
View File

@ -144,7 +144,7 @@ Validation is basic pattern matching. Not comprehensive - relies on sandbox for
**Mitigations**: **Mitigations**:
1. 9P socket permissions (Unix socket, user-only) 1. 9P socket permissions (Unix socket, user-only)
2. anvilsrv enforces access control 2. anvilsrv enforces access control
3. Audit logging in anvilsrv 3. Observability via event stream and mailbox archives
**Residual risk**: If subprocess has 9P access, it has the same capabilities as any 9P client. This is by design. **Residual risk**: If subprocess has 9P access, it has the same capabilities as any 9P client. This is by design.

11
docs/code-execution-security.md
View File

@ -34,7 +34,7 @@ The code execution pattern allows agents to write and execute bash code in a iso
┌─────────────────────────────────────────┐ ┌─────────────────────────────────────────┐
│ 9P Operations │ │ 9P Operations │
│ - Unix permissions │ │ - Unix permissions │
│ - Audit logging │ │ - Event stream / mailbox archives │
└─────────────────────────────────────────┘ └─────────────────────────────────────────┘
``` ```
@ -248,10 +248,7 @@ if agentID != session.AgentID {
} }
``` ```
3. **Audit Logging**: All 9P operations logged 3. **Observability**: State changes visible via event stream, message history via mailbox archives
```go
log.Printf("9P: agent=%s op=%s path=%s", agentID, op, path)
```
4. **Operation Whitelist**: Only allowed operations exposed 4. **Operation Whitelist**: Only allowed operations exposed
```go ```go
@ -308,7 +305,7 @@ import { evil } from "/etc/passwd";
1. **Data Isolation**: Intermediate data stays in subprocess — only stdout/stderr returned to the model 1. **Data Isolation**: Intermediate data stays in subprocess — only stdout/stderr returned to the model
2. **Privacy Preservation**: PII processed in subprocess, never enters model context 2. **Privacy Preservation**: PII processed in subprocess, never enters model context
3. **Explicit Control**: Agent explicitly chooses what to print (and thus what the model sees) 3. **Explicit Control**: Agent explicitly chooses what to print (and thus what the model sees)
4. **9P Access Control**: Unix socket permissions, audit logging 4. **9P Access Control**: Unix socket permissions, event stream for observability
5. **Process Isolation**: Separate landrun sandbox per execution 5. **Process Isolation**: Separate landrun sandbox per execution
6. **Code Validation**: Pattern matching rejects dangerous constructs 6. **Code Validation**: Pattern matching rejects dangerous constructs
@ -562,7 +559,7 @@ The code execution pattern provides strong security through multiple layers:
2. **bash Subprocess**: Process-level isolation 2. **bash Subprocess**: Process-level isolation
3. **Landlock LSM**: Kernel-level enforcement 3. **Landlock LSM**: Kernel-level enforcement
4. **Resource Limits**: Prevent exhaustion 4. **Resource Limits**: Prevent exhaustion
5. **Audit Logging**: Comprehensive trail 5. **Observability**: Event stream and mailbox archives
**Security Posture**: Data isolation and explicit control over information flow via sandboxed subprocesses. **Security Posture**: Data isolation and explicit control over information flow via sandboxed subprocesses.