fix(sandbox): support kernels < 5.19 via seccomp WAIT_KILLABLE_RECV fallback (#3420)

* fix(sandbox): fall back to plain seccomp listener when WAIT_KILLABLE_RECV is unavailable

SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV was added in Linux 5.19. On older
kernels (for example RHEL 9.x / 5.14 nodes such as RHCOS on OpenShift) the
flag is rejected with EINVAL, which made the capability-free sandbox fail to
start during the notification probe with "notification launcher disappeared".

Install the notification listener with WAIT_KILLABLE_RECV when the kernel
supports it and fall back to a plain NEW_LISTENER on EINVAL. The fallback
listener records wait_killable_recv = false: its notification receive is
uninterruptible, but the sandbox is otherwise fully functional.

Signed-off-by: Akram <akram.benaissi@gmail.com>

* fix(sandbox): address review — legacy read-only listener mode + cancellation invariant

Follow-up to the PR review (GATOR-de00bfcc-01 / mrunalp): make the < 5.19
fallback cancellation-safe instead of racing broker writes.

- Record an explicit ListenerMode (Killable vs LegacyReadOnly); add
  writes_disabled()/mode() and emit the selected mode in qualification output
  (seccomp_listener_mode).
- Centralize task-memory output writes behind NotificationListener::
  write_task_output; in LegacyReadOnly mode getpeername, accept/accept4 with a
  non-null address, and sendmmsg length write-backs fail closed with EOPNOTSUPP.
  accept with a null address, socket/connect/bind/listen/sendto/sendmsg keep
  working (copied inputs, scalar responses, atomic ADDFD_SEND).
- Enforce the launch invariant `cancellation || task_memory_writes_disabled` in
  SandboxConfirmEvidence::validate() rather than dropping cancellation
  unconditionally; add task_memory_writes_disabled to SeccompEvidence.
- Add per-path fail-closed tests (write_task_output, write_socket_addr, a real
  plain listener installed on a modern kernel) and confirmation-invariant tests.
- Correct the flag-semantics comments and document both modes plus the reduced
  legacy syscall compatibility in architecture/sandbox.md.

Signed-off-by: Akram <akram.benaissi@gmail.com>

* docs: document legacy read-only sandbox mode on kernels before 5.19

Kernels without SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV (< 5.19, e.g. RHEL 9.x /
RHCOS 5.14) run the sandbox in a legacy read-only cancellation mode where the
broker fails closed with EOPNOTSUPP on the mediated operations that write results
back into workload memory (getpeername, accept/accept4 with a non-null address,
sendmmsg length write-backs). Document this observable behavior and its syscall
limitations in the public Fern docs: the support-matrix kernel requirements and
the OpenShift runtime guidance.

Signed-off-by: Akram <akram.benaissi@gmail.com>

* style(sandbox): satisfy rustfmt and clippy doc_markdown

Match the pinned rustfmt (Rust 1.95.0) line-wrapping for the write_task_output
call, and backtick `legacy_read_only` in the qualification-report doc comment
so clippy::doc_markdown (-D warnings) passes.

Signed-off-by: Akram <akram.benaissi@gmail.com>

* fix(sandbox): migrate task_memory_writes_disabled into backend protocol

Add the `task_memory_writes_disabled` field to `SeccompEvidence` in the
backend protocol contract and relax the validation from requiring
`cancellation` to accepting `cancellation || task_memory_writes_disabled`.

This completes the rebase migration missed by the isolation-interface
refactor: the sandbox reports this field but the backend struct lacked
it, and the validator rejected every pre-5.19 legacy listener.

Signed-off-by: Akram <akram.benaissi@gmail.com>

---------

Signed-off-by: Akram <akram.benaissi@gmail.com>

Author: akram

architecture/sandbox.md

@@ -205,9 +205,31 @@ The sandbox reserves `SIGUSR2` with a non-restarting no-op handler for these
 broker threads; startup rejects a conflicting handler. This signal disposition
 is process-global kernel state, while registrations and cancellation state are
 owned by the broker. Workload exec resets the caught handler to its default.
-This sandbox runtime requires Linux 6.2 or newer for Landlock ABI v3 and treats
-`SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV` as mandatory so cancelled
-notifications cannot race task-memory writes.
+This sandbox runtime requires Landlock ABI v3 (Linux 6.2, or an equivalent
+vendor backport). The seccomp listener is installed in one of two cancellation
+modes, and the launch confirmation enforces the invariant
+`cancellation || task_memory_writes_disabled`:
+
+- **Killable** (`SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV`, Linux 5.19+): the
+  notified workload thread waits kill-only, so a non-fatal signal cannot resume
+  a mediated syscall between notification validation and the broker's result
+  write. Full mediation, including task-memory output writes.
+- **LegacyReadOnly** (kernels < 5.19, e.g. RHEL 9.x / 5.14): the flag is
+  unavailable (`EINVAL`), so the listener falls back to a plain notifier and the
+  broker refuses every task-memory *output* write to stay cancellation-safe.
+  Concretely, in this mode `getpeername`, `accept`/`accept4` **with a non-null
+  peer-address argument**, and `sendmmsg` paths that write per-message lengths
+  fail closed with `EOPNOTSUPP`. `accept` with a null address, and socket
+  creation, `connect`, `bind`, `listen`, `sendto`, and `sendmsg` continue to
+  work — they use copied inputs, scalar responses, or atomic `ADDFD_SEND`, none
+  of which write into workload memory. Some server workloads whose accept
+  wrappers request the peer address will therefore not run until the kernel
+  provides `WAIT_KILLABLE_RECV` (a distribution backport); outbound-oriented
+  workloads are unaffected.
+
+Input mediation, DNS/TCP authorization, and outer-fence enforcement are
+identical in both modes. The selected mode is emitted in the sandbox
+qualification output (`seccomp_listener_mode`).
 
 DNS uses an exact sandbox-local resolver at `127.0.0.53:53`. The driver sets the
 nameserver and permits an unprivileged bind to port 53. UDP and TCP DNS requests

crates/openshell-isolation-interface/src/linux/seccomp_notify.rs

@@ -177,13 +177,52 @@ impl NotificationProbeReport {
     }
 }
 
+/// Cancellation posture a listener was installed with.
+///
+/// `WAIT_KILLABLE_RECV` (Linux 5.19+) keeps the notified workload thread in a
+/// kill-only wait so a non-fatal signal cannot resume the mediated syscall
+/// after the broker has validated the notification. A plain listener has no
+/// such guarantee, so it runs read-only: the broker must refuse every
+/// task-memory *output* write to stay cancellation-safe.
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ListenerMode {
+    /// Modern kernel: `WAIT_KILLABLE_RECV` active; full mediation including
+    /// task-memory output writes.
+    Killable,
+    /// Legacy kernel (< 5.19): plain listener; task-memory output writes are
+    /// disabled so a resumed syscall cannot race a broker write.
+    LegacyReadOnly,
+}
+
+impl ListenerMode {
+    /// Stable identifier for qualification output and diagnostics.
+    #[must_use]
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Killable => "killable",
+            Self::LegacyReadOnly => "legacy_read_only",
+        }
+    }
+}
+
 /// Owned listener returned by `SECCOMP_FILTER_FLAG_NEW_LISTENER`.
 pub struct NotificationListener {
     fd: OwnedFd,
     wait_killable_recv: bool,
 }
 
 impl NotificationListener {
+    /// Construct a listener from an already-owned notification descriptor in a
+    /// specific mode. Intended for tests that must exercise the legacy
+    /// read-only fail-closed paths without a `< 5.19` kernel.
+    #[must_use]
+    pub fn from_fd_with_mode(fd: OwnedFd, mode: ListenerMode) -> Self {
+        Self {
+            fd,
+            wait_killable_recv: matches!(mode, ListenerMode::Killable),
+        }
+    }
+
     /// Raw listener descriptor for readiness integration and diagnostics.
     #[must_use]
     pub fn as_raw_fd(&self) -> RawFd {
@@ -196,6 +235,23 @@ impl NotificationListener {
         self.wait_killable_recv
     }
 
+    /// The cancellation mode this listener was installed with.
+    #[must_use]
+    pub fn mode(&self) -> ListenerMode {
+        if self.wait_killable_recv {
+            ListenerMode::Killable
+        } else {
+            ListenerMode::LegacyReadOnly
+        }
+    }
+
+    /// Whether broker task-memory output writes are disabled for this listener.
+    /// True exactly in `LegacyReadOnly` mode (no `WAIT_KILLABLE_RECV`).
+    #[must_use]
+    pub fn writes_disabled(&self) -> bool {
+        matches!(self.mode(), ListenerMode::LegacyReadOnly)
+    }
+
     /// Receive the next kernel notification.
     pub fn receive(&self) -> io::Result<Notification> {
         let mut raw = RawNotification::default();
@@ -223,6 +279,34 @@ impl NotificationListener {
         Ok(())
     }
 
+    /// Write broker-produced output into the notified task's memory, closing
+    /// the validation-to-write race that a plain listener cannot.
+    ///
+    /// In `Killable` mode `WAIT_KILLABLE_RECV` keeps the notified workload
+    /// thread in a kill-only wait, so a non-fatal signal cannot resume the
+    /// mediated syscall between `validate_id` and this write. In
+    /// `LegacyReadOnly` mode (kernels < 5.19) there is no such guarantee: a
+    /// resumed syscall could repurpose the target buffer while the privileged
+    /// broker writes through the captured tid and pointer — via `/proc/<tid>/mem`
+    /// even into pages the workload has since made read-only. There is no way to
+    /// close that window without the flag, so this fails closed (`EOPNOTSUPP`)
+    /// rather than racing. Callers must route every task-memory *output* write
+    /// through this method; input reads never write workload memory and are
+    /// unaffected.
+    pub fn write_task_output(
+        &self,
+        id: u64,
+        tid: u32,
+        address: u64,
+        data: &[u8],
+    ) -> io::Result<()> {
+        if self.writes_disabled() {
+            return Err(io::Error::from_raw_os_error(libc::EOPNOTSUPP));
+        }
+        self.validate_id(id)?;
+        crate::linux::task_memory::write_exact(tid, address, data)
+    }
+
     /// Return a successful scalar result to the notifying syscall.
     pub fn respond_value(&self, id: u64, value: i64) -> io::Result<()> {
         self.validate_id(id)?;
@@ -330,16 +414,22 @@ pub fn install_listener(syscalls: &[i64]) -> io::Result<NotificationListener> {
     verify_notification_sizes()?;
     set_no_new_privileges()?;
 
-    install_listener_with_flags(syscalls, true).map_err(|error| {
-        if error.raw_os_error() == Some(libc::EINVAL) {
-            io::Error::new(
-                io::ErrorKind::Unsupported,
-                "seccomp WAIT_KILLABLE_RECV is required (Linux 5.19 or newer)",
-            )
-        } else {
-            error
+    // WAIT_KILLABLE_RECV (Linux 5.19+) keeps the *notified workload thread* in
+    // a kill-only wait while the broker services its syscall, so a non-fatal
+    // signal cannot resume the syscall and repurpose its buffers underneath a
+    // pending broker write. Kernels older than 5.19 (for example RHEL 9.x /
+    // 5.14 nodes) reject the flag with EINVAL. Rather than refusing to start
+    // there, fall back to a plain listener so the sandbox boots; the resulting
+    // listener records `wait_killable_recv = false`, and the broker then fails
+    // closed on every task-memory output write (see `write_task_output`)
+    // instead of racing them. Input mediation is unaffected.
+    match install_listener_with_flags(syscalls, true) {
+        Ok(listener) => Ok(listener),
+        Err(error) if error.raw_os_error() == Some(libc::EINVAL) => {
+            install_listener_with_flags(syscalls, false)
         }
-    })
+        Err(error) => Err(error),
+    }
 }
 
 /// Install the capability-free workload networking listener on the calling
@@ -935,4 +1025,52 @@ mod tests {
             .expect_err("zero errno must fail");
         assert_eq!(error.kind(), io::ErrorKind::InvalidInput);
     }
+
+    #[test]
+    fn plain_listener_fails_closed_on_output_write() {
+        // A LegacyReadOnly listener (kernels < 5.19) must refuse every
+        // task-memory output write rather than race a resumed syscall. The
+        // guard short-circuits before touching the descriptor or workload
+        // memory, so a dup of stderr is a sufficient stand-in.
+        // SAFETY: dup takes one valid descriptor and returns a new descriptor
+        // or a negative error without modifying memory.
+        let duplicated = unsafe { libc::dup(libc::STDERR_FILENO) };
+        assert!(duplicated >= 0, "duplicate stderr for validation test");
+        // SAFETY: successful dup returned a new owned descriptor.
+        let listener = NotificationListener::from_fd_with_mode(
+            unsafe { OwnedFd::from_raw_fd(duplicated) },
+            ListenerMode::LegacyReadOnly,
+        );
+        assert!(listener.writes_disabled());
+        assert_eq!(listener.mode(), ListenerMode::LegacyReadOnly);
+        let error = listener
+            .write_task_output(1, 0, 0, &[0_u8; 4])
+            .expect_err("plain listener must reject output writes");
+        assert_eq!(error.raw_os_error(), Some(libc::EOPNOTSUPP));
+    }
+
+    #[test]
+    fn real_plain_listener_disables_output_writes() {
+        // Deliberately install a plain NEW_LISTENER (no WAIT_KILLABLE_RECV)
+        // even on a modern CI kernel and prove the broker write path fails
+        // closed on the real listener object.
+        set_no_new_privileges().expect("no_new_privs for listener install");
+        let listener = install_listener_with_flags(&[libc::SYS_getppid], false)
+            .expect("install plain listener");
+        assert_eq!(listener.mode(), ListenerMode::LegacyReadOnly);
+        assert!(listener.writes_disabled());
+        let error = listener
+            .write_task_output(1, 0, 0, &[0_u8; 4])
+            .expect_err("plain listener must reject output writes");
+        assert_eq!(error.raw_os_error(), Some(libc::EOPNOTSUPP));
+    }
+
+    #[test]
+    fn killable_listener_enables_output_writes() {
+        set_no_new_privileges().expect("no_new_privs for listener install");
+        let listener = install_listener_with_flags(&[libc::SYS_getppid], true)
+            .expect("install killable listener");
+        assert_eq!(listener.mode(), ListenerMode::Killable);
+        assert!(!listener.writes_disabled());
+    }
 }

crates/openshell-sandbox-backend/src/boundary_protocol.rs

@@ -82,6 +82,7 @@ pub struct SeccompEvidence {
     pub task_memory_read: bool,
     pub task_memory_write: bool,
     pub cancellation: bool,
+    pub task_memory_writes_disabled: bool,
 }
 
 /// Mechanism-specific audit evidence for the native Linux sandbox adapter.
@@ -129,7 +130,7 @@ impl NativeLinuxSandboxAuditEvidence {
             && self.seccomp.proc_fd_identity
             && self.seccomp.task_memory_read
             && self.seccomp.task_memory_write
-            && self.seccomp.cancellation
+            && (self.seccomp.cancellation || self.seccomp.task_memory_writes_disabled)
             && self.landlock_abi >= 3
             && self.landlock_allow_deny
             && self.udp_dns_round_trip
@@ -1408,6 +1409,7 @@ mod tests {
                 task_memory_read: true,
                 task_memory_write: true,
                 cancellation: true,
+                task_memory_writes_disabled: false,
             },
             landlock_abi: 6,
             landlock_allow_deny: true,
@@ -1438,6 +1440,22 @@ mod tests {
         assert!(!audit.properties().egress_interception.enforced);
     }
 
+    #[test]
+    fn audit_evidence_accepts_legacy_read_only_listener() {
+        let mut audit = complete_audit_evidence();
+        audit.seccomp.cancellation = false;
+        audit.seccomp.task_memory_writes_disabled = true;
+        assert!(audit.validate().is_ok());
+    }
+
+    #[test]
+    fn audit_evidence_rejects_plain_listener_with_writes_enabled() {
+        let mut audit = complete_audit_evidence();
+        audit.seccomp.cancellation = false;
+        audit.seccomp.task_memory_writes_disabled = false;
+        assert!(audit.validate().is_err());
+    }
+
     #[test]
     fn binary_identity_wire_rejects_ambiguous_or_invalid_shapes() {
         for encoded in [

crates/openshell-sandbox-backend/src/runtime.rs

@@ -2623,6 +2623,7 @@ mod tests {
                 task_memory_read: true,
                 task_memory_write: true,
                 cancellation: true,
+                task_memory_writes_disabled: false,
             },
             landlock_abi: 3,
             landlock_allow_deny: true,

crates/openshell-sandbox/src/boundary_server.rs

@@ -4329,6 +4329,7 @@ mod linux {
                     task_memory_read: true,
                     task_memory_write: true,
                     cancellation: true,
+                    task_memory_writes_disabled: false,
                 },
                 landlock_abi: 6,
                 landlock_allow_deny: true,

crates/openshell-sandbox/src/main.rs

@@ -146,6 +146,11 @@ struct QualificationReport {
     tcp_allow_round_trip: bool,
     tcp_deny_round_trip: bool,
     wait_killable_recv: bool,
+    /// Selected seccomp listener cancellation mode: `killable` (>= 5.19) or
+    /// `legacy_read_only` (< 5.19, broker output writes disabled).
+    seccomp_listener_mode: &'static str,
+    /// Whether the broker disables task-memory output writes (legacy mode).
+    task_memory_writes_disabled: bool,
 }
 
 #[cfg(target_os = "linux")]
@@ -237,6 +242,12 @@ fn qualify_runtime() -> Result<(openshell_sandbox::RuntimeQualification, Qualifi
         tcp_allow_round_trip: true,
         tcp_deny_round_trip: true,
         wait_killable_recv: notification.wait_killable_recv,
+        seccomp_listener_mode: if notification.wait_killable_recv {
+            "killable"
+        } else {
+            "legacy_read_only"
+        },
+        task_memory_writes_disabled: !notification.wait_killable_recv,
     };
     let qualification = openshell_sandbox::RuntimeQualification {
         seccomp: openshell_sandbox_backend::boundary_protocol::SeccompEvidence {
@@ -249,6 +260,9 @@ fn qualify_runtime() -> Result<(openshell_sandbox::RuntimeQualification, Qualifi
             task_memory_read: notification.task_memory_copy(),
             task_memory_write: notification.task_memory_copy(),
             cancellation: notification.wait_killable_recv,
+            // Legacy plain listener (< 5.19) disables broker output writes;
+            // satisfies the `cancellation || writes_disabled` launch invariant.
+            task_memory_writes_disabled: !notification.wait_killable_recv,
         },
         landlock_abi,
         landlock_allow_deny: true,