[dwsuse]

Fifth step of privilege separation (#3879), re-scoped: the printers which decode device data run in a sandboxed child process. The previous version sandboxed the parsers of the command line, nvme-cli.conf and --set-options; that is dropped. Under the threat model (see Documentation/PRIVSEP.md) those inputs come from the user who runs nvme-cli or from a file owned by root, so sandboxing them gained nothing, while it needed the most intricate code (copying the regions back, the result check). The data a device or a fabrics target returns is what an attacker controls, and most of the bugs fuzzing found were in its decoders.

Behind the sandbox meson option (disabled by default for now, Linux and FreeBSD). NVME_SANDBOX=0 disables the sandbox, e.g. for a debugger; NVME_SANDBOX=1 enables it in any build.

CI: as privilege separation and the sandbox are disabled by default, no job built them. The last commit adds scripts/build.sh privsep, which enables both, and the Build privsep workflow: on Linux it runs the tests as a user (the privsep tests skip as root), on FreeBSD it builds the sandbox only, and like build-freebsd.yml only when master is updated.

The primitive: shr_sandbox_begin() forks a child which closes all descriptors but stdio and the result pipe, enters the sandbox (seccomp on Linux, Capsicum on FreeBSD) and runs the code that follows; shr_sandbox_end() hands one result back. The child reads the device data in its copy of the memory and prints itself. Without a sandbox (disabled, unsupported, valgrind, Windows) the code runs in process. A crash, a missing or malformed result is an error.

The printers: the hook is the nvme_print() macro, which all nvme_show_*() functions use, including the log plugin. Printers called from a sandboxed printer run in the same child. The libnvme tree printers (they read sysfs while printing), the ZNS zone list printers (they hand JSON objects to their caller), top and the messages stay in process, unless a sandboxed printer prints them. A printer which fails in the sandbox is reported like any other error (nvme_show_error()) and nvme-cli exits with an error.

JSON output: a command prints one JSON document, and the format stays as it is. In process nothing changes: the printers add their members to the document. A sandboxed child only has a copy of the document, so struct print_ops gets optional capture hooks, which the dispatcher calls around a sandboxed printer and whose result it hands over as it is. Only the JSON plugin implements them, and its details stay in nvme-print-json.c: in the child the printer call writes to an object of its own, whose members are serialized; the caller adds them to its document as raw text, re-indented to their level. No parse in the caller: a parse would turn 128 bit numbers into doubles, and the child can write anything to stdout anyway. The stdout and binary plugins need no hooks, the child writes to the inherited stdout. Two fixes found along the way were merged separately in #4231.

Closed standard descriptors: a new first commit opens /dev/null on the standard descriptors nvme-cli starts with closed. Before, the socket to the privsep helper took the place of a closed one: with stdout closed the output went into the requests to the helper, and the sandboxed child, which keeps stdio, would have kept the socket. The child closes the other descriptors with close_range(), else those listed in /proc/self/fd or with closefrom(), and fails if it cannot.

What it buys: with plain root the decoders no longer run as root; with privilege separation a decoder that is taken over no longer holds the helper socket, which issues any NVMe command; a crashing decoder no longer takes nvme-cli down. Not covered: size handling in the command code that fetches the data, vendor plugins which decode inside the command, the printers which stay in process.

The comparison test below found a bug on master (the JSON output of the persistent event log printed uninitialized memory), fixed in #4229.

Testing:

• sandbox unit test: results, the time zone of the caller (libc loads it on first use, so the caller loads it before the fork), fallback, nesting, empty and oversized results, data after the result, crashes, denied open, closed descriptors, terminal queries on a pty, other ioctls, tgkill of another process (the result framing checks mutation-checked)
• in process the output is unchanged; the print test checks that the JSON output is indented by its depth (a broken re-indent fails it), and dropping the members a sandboxed printer hands back fails print-sandbox, print-sandbox-compare, host-metadata-sandbox and discovery-logs-sandbox (mutation-checked)
• closed stdio: test_closed_stdio closes fd 0, 1 and 2 in turn and checks from the helper that the descriptor is /dev/null, not the helper socket (fails on master); a descriptor above a lowered soft limit is closed in the child, also by the fallback without close_range() (sandbox-util-fallback, fails with the old loop); the sandbox unit test skips only when no sandbox is available, other failures fail it
• print-sandbox-compare: the print test (about 1100 invocations on random device data) with and without the sandbox; exit status, stdout and stderr must be the same
• every mock CLI test also runs with NVME_SANDBOX=1 (<name>-sandbox), and the print test checks that the sandbox is used (it fails when nvme-cli cannot fork)
• an attack planted in the smart-log printer (open a file, write to every inherited descriptor, crash): without the sandbox it reads the file, can write to the helper socket and kills nvme-cli; with it, open fails with EPERM, the helper socket is gone, the crash is contained
• full test suite with the sandbox enabled and disabled (gcc, --werror), without json-c, every commit on its own; a decoder crash forced in the child prints the labelled error in text mode and an "error" member in JSON mode
• previous revision, the sandbox primitive is unchanged since (CI covers the cross builds of this one): clang and privsep builds; FreeBSD: tests, and on a real device id-ctrl, smart-log, error-log, fw-log, id-ns, get-feature print the same with and without the sandbox; truss shows the child entering cap_enter()
• previous revision: cross builds and tests for s390x, ppc64le, armhf, i386 (under qemu-user there is no seccomp, so the sandbox falls back to in-process there), Windows (x86_64, aarch64) builds
• cost: about 0.8 ms per command

[Copilot]

🟡 Changes recommended

Unresolved confinement gaps, fail-open setup handling and lost JSON diagnostics prevent approval.

5 open findings

• Restrict tgkill to the sandbox child · New
• Restrict inherited descriptor rights before parsing · New
• Fail closed on sandbox setup and allocation errors · New
• Close inherited privileged descriptors in the sandbox child · New
• Preserve sandbox parser diagnostics for parent reporting · New

What changed in this PR

Adds optional parser sandboxing as the next privilege-separation step, building on #4182.

Changes:

• Runs argument, configuration and --set-options parsers in confined children with parent-side report validation.
• Adds Linux seccomp, FreeBSD Capsicum and runtime sandbox controls.
• Expands unit and CLI tests for sandbox behavior and parsing equivalence.

File	Description
tests/​unit/​c/​test-plugin.c	Tests command lookup and sandboxed dispatch.
tests/​unit/​c/​test-global-config.c	Runs configuration tests in both modes.
tests/​unit/​c/​test-argconfig-report.c	Tests rejection of malformed reports.
tests/​unit/​c/​test-argconfig-parse.c	Compares sandboxed and direct parsing.
tests/​unit/​c/​meson.build	Registers parser tests and dependencies.
tests/​cli/​nvme_sandbox_test.py	Tests output equivalence and sandbox use.
tests/​cli/​nvme_privsep_test.py	Tests privileged-helper integration.
tests/​cli/​meson.build	Adds sandbox and helper test variants.
src/​sandbox.h	Declares CLI sandbox controls.
src/​sandbox.c	Implements sandbox enablement policy.
src/​privsep.h	Declares privilege-separation interfaces.
src/​privsep.c	Sandboxes privilege-drop decisions.
src/​plugin.h	Adds command privilege metadata.
src/​plugin.c	Implements command lookup and privilege checks.
src/​nvme.c	Initializes privilege separation early.
src/​nvme-cmds-fabrics.c	Marks commands requiring retained privileges.
src/​nvme-cmds-enumerate.c	Marks enumeration privilege requirements.
src/​nvme-cmds-deprecated.c	Marks deprecated key-command privilege requirements.
src/​meson.build	Includes sandbox and privilege-separation sources.
src/​global-ctx.c	Sandboxes --set-options parsing.
src/​global-config.c	Sandboxes configuration parsing and validates reports.
src/​argconfig.c	Serializes and validates sandboxed parser results.
shared/​tests/​test-sandbox-util.c	Tests confinement and result handling.
shared/​tests/​test-ini-util.c	Tests separate configuration-file reading.
shared/​tests/​meson.build	Registers sandbox utility tests.
shared/​sandbox-util.h	Defines the shared sandbox interface.
shared/​sandbox-util.c	Implements confinement and child-result transport.
shared/​sandbox-util-win.c	Provides Windows unsupported fallback.
shared/​meson.build	Selects platform sandbox implementation.
shared/​ini-util.h	Declares separate INI-file reading.
shared/​ini-util.c	Separates file reading from parsing.
plugins/​zns/​zns.c	Marks listing privilege requirements.
plugins/​wdc/​wdc-nvme.c	Marks telemetry privilege requirements.
plugins/​utils/​utils.c	Marks metadata-command privilege policy.
plugins/​solidigm/​solidigm-nvme.c	Marks version-command privilege policy.
plugins/​seagate/​seagate-nvme.c	Marks version-command privilege policy.
plugins/​sandisk/​sandisk-nvme.c	Marks telemetry privilege requirements.
plugins/​registry/​registry-nvme.c	Marks registry-list privilege requirements.
plugins/​netapp/​netapp-nvme.c	Marks enumeration privilege requirements.
plugins/​nbft/​nbft-plugin.c	Marks NBFT privilege requirements.
plugins/​micron/​micron-nvme.c	Marks privileged and no-device commands.
plugins/​keys/​keys-plugin.c	Marks key-management privilege requirements.
plugins/​huawei/​huawei-nvme.c	Marks listing privilege requirements.
plugins/​exclusion/​exclusion-nvme.c	Marks exclusion-management privilege requirements.
plugins/​config/​config-nvme.c	Marks configuration-command privilege requirements.
meson.build	Configures sandbox support.
meson_options.txt	Adds the disabled-by-default sandbox option.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Descriptor cleanup can leave privileged channels accessible, and the unit test can misclassify sandbox failures as unsupported platforms.

3 open issues

• Closed stdin lets the decoder retain a writable helper socket · New
• Descriptor cleanup misses fds above a lowered soft limit · New
• Sandbox failures are misreported as unsupported and skip remaining checks · New

5 resolved since last review

• Close inherited privileged descriptors in the sandbox child
• Fail closed on sandbox setup and allocation errors
• Restrict inherited descriptor rights before parsing
• Restrict tgkill to the sandbox child
• Preserve sandbox parser diagnostics for parent reporting

_{Review effort: Balanced}