8jZ9VdZddlZddlZddlZddlZddlmZddlm Z m Z m Z m Z m Z mZdZdZej"e dk\dGd d ej$Zej"e dk\dGd d ej$Zed k(rej,yy)aEB+-Gegenproben gegen das ECHTE /home/aria mit dem tools-Profil (Landlock, ohne systemd-Bus). Laeuft nur mit python3 im Kaefig, nie codex. Belegt: Credentials/ssh/claude/codex gesperrt, claude nicht ausfuehrbar, normale Tools laufen, Home lesbar aber (E44 Option 2) nur in Allowlist- Ordnern schreibbar, kill/AF_UNIX gesperrt.N)profiles) CAGE_PROBEPYTHONhome_probe_dirhome_project_probe_dir landlock_abi run_in_cagez /home/ariaz/home/aria/.local/lib/node_modules/@openai/codex/node_modules/@openai/codex-linux-x64/vendor/x86_64-unknown-linux-musl/bin/codex-code-mode-hostzLandlock ABI < 4c<eZdZedZedZdZdZdZdZ dZ dZ d Z d Z ejej"j%ed d Zejej"j%ed d ZdZdZdZdZy)ToolsProfileRealHomec tj|_tjj |jj d}tj||dz|dz|dz|dz|dz|_ |jj|jj|jj|jj|jjfD]}tj|dt!|jj"d d 5}|j%d dddt'|_tj*d |j(\}|_tj.|tj0t2|jj4g|_tj8|jt:t2dddd|j6|_y#1swYxYw)Nrun/ws/home /codex-home/authdir/tmpTexist_okwutf-8encoding {"token":"x"}z .ariaprobe_w_)prefixdirextra_prune_paths,@CPUFSIZENOFILE codex_bin home_rootrlimits secret_files)tempfileTemporaryDirectory_tmpospathjoinnamePRunDirsdirs workspacehome codex_homeauthdirtmpmakedirsopen auth_copywriter probe_dirmkstemphome_probe_fileclosescan_secret_filesHOMErootcfg_secret_files tools_profilercfg)clsrDdfhfds ;/home/aria/aria-v3-dev/python/tests/test_isolation_tools.py setUpClasszToolsProfileRealHome.setUpClasssx..0ww||CHHMM5199T4%< AU!J.v ?(($$chhmmSXX5H5H#((JZJZ\_\d\d\h\hi *A KKD ) * #(($$cG < & HH_ % &'( "*"2"2/s}}"]C    224CHHMM?[//#((f25SW*X/2/C/CE & &s %HH cztj|jd|jj yNT) ignore_errors)shutilrmtreer>r-cleanup)rHs rL tearDownClassz"ToolsProfileRealHome.tearDownClass*s$ cmm48 c t|jtdt|g|d}|j |j d|d|d|j d|j jd dd y) N-Itimeoutr z: rc= err=replaceerrors)r rGrr assertEqual returncodestderrdecode)selfcheckargsrs rLprobezToolsProfileRealHome.probe/sr 64U"JT"JTV W q!7!D6q||nE!((//Yb/BcdhehBiAjk mrUc|jdd|jddtjjdr|jddyy)N read-deniedz/home/aria/.envz/home/aria/.codex/auth.jsonz /home/aria/.claude/settings.json)rir.r/existsres rLtest_credentials_blockedz-ToolsProfileRealHome.test_credentials_blocked4sE ="34 ="?@ 77>>< = JJ}&H I >rUc|jddtjjdr|jddyy)Nz list-deniedz/home/aria/.sshz/home/aria/.config/gh)rir.r/isdirrms rLtest_ssh_and_gh_blockedz,ToolsProfileRealHome.test_ssh_and_gh_blocked:s6 ="34 77==0 1 JJ}&= > 2rUc(|jddy)Nz exec-deniedz/usr/bin/clauderirms rLtest_claude_not_executablez/ToolsProfileRealHome.test_claude_not_executable?s ="34rUc(|jddy)Nzexec-okz /usr/bin/idrsrms rLtest_normal_tool_executablez0ToolsProfileRealHome.test_normal_tool_executableBs 9m,rUc tjj|jjd}|j ddd|j zd|j zdtjj|jdzd|z|jtjj||jtjj|j d |jtjjtjj|jdy) Nzhome-test-ok.txt write-matrixread-ok:/home/aria/CLAUDE.mdread-ok:append-denied:create-denied:neu.txt write-ok:r)r.r/r0r4r5rir@r> assertTrueisfileragetsize assertFalselexists)rews_oks rL#test_home_readable_but_not_writablez8ToolsProfileRealHome.test_home_readable_but_not_writableEs TYY002DE >#A:PTPdPdCd#d&:&::#bggll4>>9&MM& ( u-. )=)=>B dnni)PQRrUc(|jddy)Nz kill-denied1rsrms rLtest_kill_foreign_deniedz-ToolsProfileRealHome.test_kill_foreign_deniedQs =#&rUc *ddlddlddgggddddddd dd d dd d gddd g}djfdfd|DD}ttj j|j jdd5}|j|dddtj|j tt||j}t|ddd|j jdtgdS#1swYnxYw)Nrzconnection/hello)typesupportedVersionsrequiredCapabilitiesoptionalCapabilitieszoperation/requestz session/opens1)method sessionId)ridrequestzsession/executet1z1+1) tool_call_idsource enabled_tools)rrrrUc3ZK|]"}jdt||z$yw)zz0ToolsProfileRealHome._v8_host..]s%i! D#a&1A5is(+c3\K|]#}j|j%yw)N)dumpsencode)rf_jsons rLrz0ToolsProfileRealHome._v8_host..]s#?h\] A@U@U@W?hs),z frames.binwbr&z/bin/shz-cz(cat z/frames.bin; sleep 3) | <rY)jsonrr0r;r.r/r4r5r=r2rFV8_HOSTrCrEr )rer)framesblobrJrGrrs @@rL_v8_hostzToolsProfileRealHome._v8_hostTs %-QCac+-/.a~lpDqr.aO`os/3uWYZE\]^ xxi?hag?hii "'',,tyy22LA4 H B HHTN oodii7dT[+/+@+@B3D$(II$7$73B!CLNP P   s D  Dz&codex-code-mode-host nicht installiertc|jdddd}|j|jd|jdd|j d|j y)Nrr r!r"ris "type":"execute/initialResponse")rrarbrcassertInstdoutrerhs rLtest_v8_host_runs_in_tools_cagez4ToolsProfileRealHome.test_v8_host_runs_in_tools_cageesJ MM#4H I q!((45/: 9188DrUc|jddddd}|j|jd|jd|jy)Nlrr r!)ASr#r$r%rs V8 sandbox)rassertNotEqualrbrrcrs rL+test_v8_host_dies_under_address_space_limitz@ToolsProfileRealHome.test_v8_host_dies_under_address_space_limitks@ MMS7VZ[ \ ALL!, mQXX.rUc(|jddy)Nzaf-unix-deniedz/run/user/1001/busrsrms rLtest_af_unix_deniedz(ToolsProfileRealHome.test_af_unix_deniedqs #%9:rUcd}d}tjj|rtjj|s|jdtjj |j j d}|jd||||jtjj|y)Nz/home/aria/.cargo/envz#/home/aria/state/run-heartbeat.confzIVORAUSSETZUNG: .cargo/env und state/run-heartbeat.conf muessen existierenok.txtzro-write-denied-rw-ok) r.r/rskipTestr0r4r5rir)rero1ro2rws rL*test_deferred_exec_ro_targets_denied_rw_okz?ToolsProfileRealHome.test_deferred_exec_ro_targets_denied_rw_okts &3s#s(; MMe f WW\\$))--x 8 *Cb9 r*+rUchtjjdr|jddyy)Nz/home/aria/.claude.jsonrk)r.r/rlrirms rLtest_claude_json_read_deniedz1ToolsProfileRealHome.test_claude_json_read_denieds' 77>>3 4 JJ}&? @ 5rUcdtjz}|jtjj ||j d||jtjj |dy)Nz /home/aria/.aria-latent-probe-%dz create-deniedz+latente Datei wurde im Home angelegt (LEAK))r.getpidrr/rri)relatents rL)test_latent_top_level_dotfile_uncreatablez>ToolsProfileRealHome.test_latent_top_level_dotfile_uncreatables[4biikA 01 ?F+ 02_`rUN)__name__ __module__ __qualname__ classmethodrMrTrirnrqrtrvrrrunittest skipUnlessr.r/rrrrrrrrrUrLr r sEE(m J ? 5- S'P"X02Z[E\E X02Z[/\/ ; ,A arUr cBeZdZdZedZedZdZdZdZ y)WriteAllowlistRealHomea"E44 Option 2 gegen das ECHTE /home/aria (Landlock, python3 im Kaefig, nie codex). Zwei gleich aufgebaute Testprojekte nach dem kostenwache-Muster (melde.sh = Cron-Ziel, per cron_targets injiziert, die echte Crontab bleibt unberuehrt; kostenwache.py daneben): `allow` ist Allowlist-Ordner, `deny` nicht. Erwartung in EINEM Kaefig-Lauf: Workspace und `allow` schreibbar, `deny` und das uebrige Home nicht, Lesen im Home geht, Credentials bleiben unlesbar, im Allowlist- Ordner bleiben Cron-Ziel, Git-Hook und Secret geschuetzt.c <tj|_tjj |jj d}tj||dz|dz|dz|dz|dz|_ |jj|jj|jj|jj|jjfD]}tj|dt!|jj"d d 5}|j%d dddt'|_t'|_i|_|j(|j*fD]}d D]x\}}t!tjj ||d d 5}|j%|ddd||j,tjj ||<ztjtjj |j(ddtjtjj |j(dt!tjj |j(dddd d 5}|j%ddddt!tjj |j(dd d 5}|j%dddd|j(|j*fDcgc]}d|z c}|_tj0t2|jj4g|_dddd|_tj:|jt<t2|j8|j6|j.|j(g|_y#1swYxYw#1swY0xYw#1swY?xYw#1swYxYwcc}w)NrrrrrrTrrrrr))melde.shz!#!/bin/sh python3 kostenwache.py )kostenwache.pyzprint('kosten') .githookssrc pre-commitz #!/bin/sh .envz CANARY=1 z(*/10 * * * * %s/melde.sh >/dev/null 2>&1rrr r!r")r'r(r)r* cron_targetswrite_allowlist) r+r,r-r.r/r0r1r2r3r4r5r6r7r8r9r:r;r<r=rallowdenybodycronrBrCrDr*r)rFrrG)rHrDrIrJrelrs rLrMz!WriteAllowlistRealHome.setUpClasss..0ww||CHHMM5199T4%< AU!J.v ?(($$chhmmSXX5H5H#((JZJZ\_\d\d\h\hi *A KKD ) * #(($$cG < & HH_ % &*, )+))SXX& 6AG 6 T"'',,q#.gF#"HHTN#15a-.  6 6 BGGLLFG<= BGGLLE23 "'',,syy&'<H#X_ ` $df HH] # $ "'',,syy&13 I #R HH\ " #MPYYX[X`X`Labq>Bb..t W!GtD //#((fVYVaVa/2/?/?chh3699+?) & &##  $ $ # #bs6%O&3O31PP 5 P&O03O= P  Pc|j|jfD]}tj|d|jj yrO)rrrQrRr-rS)rHrIs rLrTz$WriteAllowlistRealHome.tearDownClasss<))SXX& 1A MM!4 0 1 rUc t|tdtdg|d}|j|jdd|jd|j j d dd y) NrWrxrXrYrzrc=r\r]r^r)r rrrarbrcrd)rerGtokensrhs rLrizWriteAllowlistRealHome.probes` fdJPPZ\ ] qC ~U188??Zc?CdeifiCjBk*lmrUctjj|jjd}|j |j }}dtjz}|jtjj||j|jd|zdtjj|ddzdtjj|dzdtjj|dzd tjj|dzd tjj|d zdtjj|d zd|zd tjj|d zd tjj|d d dzdtjj|dzdtjj|dzddd|jtjj|ttjj|ddd5}|j|j!ddddttjj|dd5}|j|j!dddd|jtjjtjj|dtjj|dtjj|d tjj|d fD]F}t|d5}|j|j!|j"||dddH|jtjjtjj|d |jtjj|dy#1swYxYw#1swYxYw#1swYxYw)Nrz/home/aria/.aria-e44-latent-%dr~rr}rr|z neu-oben.txtr{rzneu.pyrrrz read-denied:rrzryzread-denied:/home/aria/.envz'read-denied:/home/aria/.codex/auth.jsonrbxrrzDatei im Home angelegt (LEAK))r.r/r0r4r5rrrrrrirGrrr;rareadr)rerarIrrJps rL*test_write_only_in_workspace_and_allowlistzAWriteAllowlistRealHome.test_write_only_in_workspace_and_allowlists' TYY00(;zz49911BIIK? 01 488&a !BBa1A!BB$bggll1n&EE#bggll16F&GG#bggll1j&AA#bggll1h&??#f,#bggll1j&AA#bggll1fg|&TT!BGGLLF$;; Q0@ AA10<% >( u-. "'',,q%3T : .b   RWWY - . "'',,q"23T : .b   RWWY - . a)HIJ'',,q"23RWW\\!Z5PRTRYRYR^R^_`blRmn =Aa'* =b  DIIaL!< = = = a)BCD 02QR . . . . = =s$(!Q;!Q!/Q.Q!Q+.Q7 c tj|jtt|j |j |j}|j|dtjj|jjdzdtjj|jdzdtjj|jdzdtjj|jdz|jtjjtjj|jdy) N)r'r(r)r*rr~zok0.txtr{rr|zneu0.txtrz)r2rFr4rrCr)r*rrir.r/r0r5rrr)recfg0s rL3test_without_allowlist_the_same_folder_is_read_onlyzJWriteAllowlistRealHome.test_without_allowlist_the_same_folder_is_read_onlystyyFdTXT`T`,0,=,=DIIW 4rww||DII4G4G'SS#bggll4::?O&PP#bggll4::z&JJ TZZ9I JJ L djj*)MNOrUN) rrr__doc__rrMrTrirrrrUrLrrsCA??> n#SJPrUr__main__)rr.rQr+raria_router.isolationrr2tests.iso_helpersrrrrrr rCrrTestCaser rrmainrrUrLrs. /,, @\^q(*<=xa8,,xa>xav\^q(*<=`PX..`P>`PF zHMMOrU