UAT: `ContainerToolExecutor` has no security hardening — no-new-privileges, read-only filesystem, and cap-drop not enforced #6134

New issue

Open

opened 2026-04-09 15:21:15 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-09 15:21:15 +00:00

Owner

Bug Report

Feature Area: Container Tool Execution — Security
Severity: Non-critical (backlog)
Found by: UAT Testing (container-tool-execution worker)

What Was Tested

Code-level analysis of ContainerToolExecutor._build_exec_command() against the spec's container security requirements.

Expected Behavior (from spec)

The spec states that container tool execution should provide isolation. Standard container security hardening should be applied to prevent privilege escalation and limit attack surface:

--no-new-privileges — prevents privilege escalation via setuid/setgid binaries
--read-only — mounts the container filesystem as read-only (writes only to explicitly mounted volumes)
--cap-drop ALL — drops all Linux capabilities
--security-opt no-new-privileges:true — additional privilege escalation prevention

Actual Behavior

_build_exec_command() builds a minimal devcontainer exec command with no security flags:

cmd = [
    devcontainer,
    "exec",
    *target_args,
    "--",
    "sh",
    "-c",
    f"timeout {int(container_timeout)} cleveragents-tool-exec "
    + shlex.quote(tool_name),
]

No security constraints are applied. A tool running inside the container could:

Escalate privileges via setuid binaries
Write to the container filesystem outside of mounted volumes
Use Linux capabilities not needed for tool execution

Code Location

src/cleveragents/tool/container_executor.py — _build_exec_command() (lines 430-461)
src/cleveragents/tool/container_executor.py — ContainerConfig class (lines 55-82) — no security fields

Expected Fix

Add security hardening options to ContainerConfig and apply them in _build_exec_command():

no_new_privileges: bool = True
read_only_filesystem: bool = False (opt-in, as tools may need to write)
drop_capabilities: list[str] = ["ALL"]

These should be passed as --security-opt and --cap-drop flags to the underlying container runtime.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area:** Container Tool Execution — Security **Severity:** Non-critical (backlog) **Found by:** UAT Testing (container-tool-execution worker) --- ## What Was Tested Code-level analysis of `ContainerToolExecutor._build_exec_command()` against the spec's container security requirements. ## Expected Behavior (from spec) The spec states that container tool execution should provide isolation. Standard container security hardening should be applied to prevent privilege escalation and limit attack surface: - `--no-new-privileges` — prevents privilege escalation via setuid/setgid binaries - `--read-only` — mounts the container filesystem as read-only (writes only to explicitly mounted volumes) - `--cap-drop ALL` — drops all Linux capabilities - `--security-opt no-new-privileges:true` — additional privilege escalation prevention ## Actual Behavior `_build_exec_command()` builds a minimal `devcontainer exec` command with no security flags: ```python cmd = [ devcontainer, "exec", *target_args, "--", "sh", "-c", f"timeout {int(container_timeout)} cleveragents-tool-exec " + shlex.quote(tool_name), ] ``` No security constraints are applied. A tool running inside the container could: 1. Escalate privileges via setuid binaries 2. Write to the container filesystem outside of mounted volumes 3. Use Linux capabilities not needed for tool execution ## Code Location - `src/cleveragents/tool/container_executor.py` — `_build_exec_command()` (lines 430-461) - `src/cleveragents/tool/container_executor.py` — `ContainerConfig` class (lines 55-82) — no security fields ## Expected Fix Add security hardening options to `ContainerConfig` and apply them in `_build_exec_command()`: - `no_new_privileges: bool = True` - `read_only_filesystem: bool = False` (opt-in, as tools may need to write) - `drop_capabilities: list[str] = ["ALL"]` These should be passed as `--security-opt` and `--cap-drop` flags to the underlying container runtime. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

HAL9000 added the

labels

2026-04-09 15:26:41 +00:00

HAL9000 added a new dependency

2026-04-09 17:37:39 +00:00

#5504 EPIC: Container Tool Execution — Docker/Podman Tool Runner (v3.6.0)