From 967f377eed91c54adcef35d0fa1e58b62c84f80c Mon Sep 17 00:00:00 2001
From: VarunGore36 <varungore1@gmail.com>
Date: Mon, 9 Nov 2026 03:54:00 +0530
Subject: [PATCH] test: pin the trusted_exec_path contract in the policy crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

trusted_exec_path treats a bare argv[0] as trusted because the backend
resolves bare names only from the sandbox's fixed PATH (a system-tree
set the guest cannot write). That reasoning was implicit; these tests
pin it from the policy side — bare names and the read-only system tree
are trusted, relative/traversal forms and guest-writable locations and
lookalike prefixes are refused — so a change on either side of the
contract fails CI.
---
 crates/policy/src/lib.rs | 50 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/crates/policy/src/lib.rs b/crates/policy/src/lib.rs
index b0fddbc..ac94874 100644
--- a/crates/policy/src/lib.rs
+++ b/crates/policy/src/lib.rs
@@ -783,3 +783,53 @@ mod tests {
         assert!(!bad.allow);
     }
 }
+
+#[cfg(test)]
+mod trusted_exec_path_tests {
+    use super::*;
+
+    /// The contract the backend's program-path resolution must uphold (and
+    /// now does): a bare argv[0] is trusted *because* the sandbox resolves
+    /// bare names only from its fixed PATH (GUEST_PATH, system tree). These
+    /// tests pin that reasoning so a change on either side fails here.
+    #[test]
+    fn bare_names_are_trusted() {
+        assert!(trusted_exec_path("git"));
+        assert!(trusted_exec_path("dependency-updater"));
+        assert!(trusted_exec_path("python3.12"));
+        assert!(!trusted_exec_path(""));
+    }
+
+    #[test]
+    fn absolute_system_tree_is_trusted() {
+        for p in [
+            "/bin/sh",
+            "/usr/bin/git",
+            "/sbin/mkfs",
+            "/lib64/ld-linux-x86-64.so.2",
+        ] {
+            assert!(trusted_exec_path(p), "{p} must be trusted");
+        }
+    }
+
+    #[test]
+    fn relative_and_traversal_forms_are_refused() {
+        for p in ["./git", "sub/git", "../git", "a/../evil", "/usr/../evil"] {
+            assert!(!trusted_exec_path(p), "{p} must be refused");
+        }
+    }
+
+    #[test]
+    fn guest_writable_locations_are_refused() {
+        for p in ["/workspace/git", "/tmp/git", "/home/user/tool", "/root/x"] {
+            assert!(!trusted_exec_path(p), "{p} must be refused");
+        }
+    }
+
+    #[test]
+    fn lookalike_prefixes_are_refused() {
+        // Not under /usr/ — "/usrfoo/" is a different directory.
+        assert!(!trusted_exec_path("/usrfoo/sh"));
+        assert!(!trusted_exec_path("/usrshare/tool"));
+    }
+}