feat(sandbox): derive policy from CDI context

[elezar]

Summary

Consume the validated CDI context in the sandbox supervisor and derive its filesystem and process policy through a fail-closed boundary. This is the second PR in the #1606 stack.

Related Issue

Part of #1606. Depends on the core CDI resolver PR.

Changes

• Restrict CDI context consumption to the fixed supervisor path and mounted spec root.
• Enrich sandbox policies with CDI-derived requirements.
• Merge CDI supplemental groups into the common identity used for workspace validation and privilege dropping.

Testing

• mise run pre-commit passes (exceeded the local command timeout during Rust lint).
• Unit tests added/updated
• E2E tests added/updated (covered by the Docker producer PR)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2776.docs.buildwithfern.com/openshell

[drew]

this is an interesting list. do we need this?

[elezar]

I had the same thought (and thought I had updated it to just #[cfg(target_os = "linux")]. Let me dig in again.

I think I missed pushing these changes somewhere in the churn. Note that this list was already in the source below.

The core issue was that the agent was considering all possible rust targets and not just the effective linux-like targets (linux and macos) that we build openshell for.

[drew]

gator-agent

PR Review Status

The CDI policy consumer is project-valid and the stack boundary is coherent, but one supported workload path remains incomplete: CDI-mounted commands in standard sbin directories are admitted by policy yet cannot be found by basename. The later descendant PR #2846 appears aimed at this symptom, but #2776's effective patch still needs the invariant satisfied before this layer lands.

Action required: bring the standard sbin PATH repair into this PR, or restructure the stack so that repair lands before this CDI consumer.

Blocking findings:

• GATOR-a39d1825-01: CDI-mounted executables in standard sbin directories are not discoverable through start_agent or authenticated exec.

Carried findings:

• None

Non-blocking suggestions:

• None

Gator metadata

• Validation: Project-valid implementation of the accepted roadmap issue #1606, authored by a verified repository admin and reviewed against parent PR #2775 with downstream PR #2265 as stack context.
• Docs: Fern policy documentation and the security architecture document are updated; navigation changes are not needed for the existing page.
• Checks: Existing Branch Checks, Helm Lint, and Trivy status contexts are green; required E2E workflows have not been dispatched for this head.
• E2E: test:e2e and test:e2e-gpu will be required after blocking review feedback is resolved.
• Head SHA: a39d182582c033507af0432b9c87c2abeeda0574
• Base SHA: ed094c94e95b75058836e3ba5c125a89e938cc14
• Merge base SHA: ed094c94e95b75058836e3ba5c125a89e938cc14
• Patch ID: aa8781652a1537d73a0a87434ace0e159c13bf3b
• Gator payload: 10
• Review mode: initial
• Previous reviewed SHA: none
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[drew]

gator-agent

Warning — GATOR-a39d1825-01 · CDI-mounted commands can remain outside PATH

Summary: An operator can launch a valid CDI GPU sandbox whose spec mounts nvidia-smi under /usr/sbin. Policy enrichment admits that path, but the normal child PATH is commonly only /usr/local/bin:/usr/bin:/bin, so both the initial agent and authenticated exec report command-not-found.

Fix: Propagate CDI activation through both launch paths and append admitted standard sbin directories to every effective child PATH, including user/provider overrides and shell startup behavior. Cover both launch paths with regression tests.

Verify: Mount an executable only at /usr/sbin/nvidia-smi, then run sh -lc 'nvidia-smi -L' through start_agent and authenticated exec; both must resolve it rather than exit 127.

Agent context

• Ownership: This PR introduces the CDI consumer but does not connect accepted executable locations to process lookup.
• Location: crates/openshell-sandbox/src/boundary_server.rs:111

[drew]

gator-agent

PR Review Status

The current head rebases the CDI consumer onto the updated parent stack, but it does not change the child-process environment contract. The existing standard-sbin PATH finding therefore remains open; no new blocking findings were found in the author-only delta.

Action required: bring the standard-sbin PATH repair into this PR, or reorder the stack so that repair lands before this CDI consumer.

Blocking findings:

• No new blocking findings.

Carried findings:

• GATOR-a39d1825-01: CDI-mounted executables in standard sbin directories remain undiscoverable by basename through both start_agent and authenticated exec. The existing review thread remains the canonical finding.

Gator metadata

• Validation: Project-valid middle layer of the accepted #1606 CDI stack, evaluated with parent PR #2775, child PR #2265, and later PATH-repair PR #2846 as stack context.
• Docs: Fern policy documentation and the security architecture document are updated; navigation changes are not needed for the existing page.
• Checks: Branch Checks, Helm Lint, and Trivy are running for the current head; review feedback must be resolved before pipeline handoff.
• E2E: test:e2e and test:e2e-gpu remain required after blocking review feedback is resolved.
• Head SHA: 5fdce64a5a3b41e979542551862e7dc5d54623be
• Base SHA: eab54064acd753a8cfda0f92e28bbdb4d0994e00
• Merge base SHA: eab54064acd753a8cfda0f92e28bbdb4d0994e00
• Patch ID: a5e683d7a7555832c85e863fd9ccb3a534c4d109
• Gator payload: 10
• Review mode: follow_up
• Previous reviewed SHA: a39d182582c033507af0432b9c87c2abeeda0574
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review

[drew]

gator-agent

PR Review Status

This rebase preserves the already reviewed CDI-consumer patch, so no new code-review round was needed. The existing standard-sbin PATH obligation remains open because its repair is still downstream in PR #2846, and the current head now fails required Rust lint and test jobs because a BoundaryConfig test initializer does not provide cdi_context.

Action required: bring the standard-sbin PATH repair into this PR or place it earlier in the stack, and update the failing BoundaryConfig initializer so required Branch Checks pass.

Blocking findings:

• No new blocking findings.

Carried findings:

• GATOR-a39d1825-01: CDI-mounted executables in standard sbin directories remain undiscoverable by basename through both start_agent and authenticated exec. The existing review thread remains canonical.

Gator metadata

• Validation: Project-valid middle layer of the accepted #1606 CDI stack, evaluated with parent PR #2775, child PR #2265, and downstream PATH-repair PR #2846 as stack context.
• Docs: Fern policy documentation and the security architecture document are updated; navigation changes are not needed for the existing page.
• Checks: OpenShell / Branch Checks is failing because crates/openshell-sandbox/src/boundary_server.rs:4045 initializes BoundaryConfig without cdi_context; Helm Lint and Trivy are green.
• E2E: test:e2e and test:e2e-gpu remain required after blocking review feedback and Branch Checks are resolved.
• Head SHA: 9c69246e4dc93d5aaf3351973e1b6c7c73f328fe
• Base SHA: ff1ffe791bce60d38a29c429925231fb435ed31c
• Merge base SHA: ff1ffe791bce60d38a29c429925231fb435ed31c
• Patch ID: a5e683d7a7555832c85e863fd9ccb3a534c4d109
• Gator payload: 10
• Review mode: already_reviewed (rebase-equivalent)
• Previous reviewed SHA: 5fdce64a5a3b41e979542551862e7dc5d54623be
• Review budget exhausted: no
• Maintainer decision required: no
• Next state: gator:in-review
• Blocked reason: author_changes_required