security(image): remove vscode passwordless-sudo grant - #103
Open
shejnowicz wants to merge 1 commit into
Open
Conversation
The devcontainers base image ships /etc/sudoers.d/vscode granting vscode NOPASSWD:ALL. Sandcat's agent has no legitimate sudo use — every root-phase step runs in app-init.sh before it drops to vscode via gosu — so the grant is pure attack surface. Remove it at build time. This hardens the image itself, complementing the runtime security_opt: no-new-privileges added in #90: inside sandcat's compose sudo is now blocked by two independent layers; run outside compose (bare docker run of the agent image), the removed grant alone denies it. Verified: base image `docker run -u vscode ... sudo -n whoami` reaches root; the sandcat agent image (entrypoint bypassed) returns "a password is required" and the grant file is absent. sudo binary intentionally left in place (no grant = harmless). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01DFCiFbv1Cpr7yzCU8ftvzZ
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #12.
Summary
The devcontainers base image ships
/etc/sudoers.d/vscode(vscode ALL=(root) NOPASSWD:ALL). Sandcat's agent has no legitimate sudo use — every root-phase step runs in the entrypoint (app-init.sh) before it drops to the vscode user viagosu— so the grant is pure attack surface. This removes it at build time (RUN rm -f /etc/sudoers.d/vscodeinDockerfile.app).Two-layer defense
Issue #12 had two parts: (1) sandcat's setup must not require sudo — already true (grep of
cli/**finds zero sudo usage; the onlysudoin the repo is the host-side Docker install instruction in the README), and (2) the user must not be able to sudo inside the image.Part 2 was partly addressed by #90's runtime
security_opt: no-new-privileges, but that's a compose-level knob — the image run bare (docker run -u vscode <agent-image>) still had the grant. This PR closes that gap at the image level:Test plan
regression.batse2e (realsandcat init→ generated project): assertsDockerfile.appcontainsrm -f /etc/sudoers.d/vscode. Fulltest/init/suite green (131 tests).docker run -u vscode mcr.microsoft.com/devcontainers/base:debian bash -c 'sudo -n whoami'→root(exit 0) — the vulnerability the issue reports.sudo -n whoami→sudo: a password is required(exit 1);/etc/sudoers.d/vscodeabsent;sudobinary still present (no grant = harmless).sudo -n whoami→ blocked by the no-new-privileges message;NoNewPrivs: 1.Notes
sudobinary is deliberately left installed — removing only the grant means it prompts for a root password that doesn't exist, which is the standard hardened posture. No devcontainer Feature or sandcat runtime step depends on runtime sudo (build-time root work usesUSER rootin the Dockerfile).🤖 Generated with Claude Code
https://claude.ai/code/session_01DFCiFbv1Cpr7yzCU8ftvzZ