magus v0.4.3 is out. See what's new
¶ View markdown source · ✎ Suggest an edit
1 min read

MGS2012: sandbox required

sandbox.mode is required (or MAGUS_SANDBOX=required, or --sandbox=required), and the kernel cannot confine the processes the run starts. magus stops before running anything.

[MGS2012] sandbox mode is required for /tmp/mergequeue-apply-1/candidate-7/checkout,
and the kernel cannot confine its children: sandbox: kernel sandbox unsupported on this host;
run it on Linux 6.2 or newer with landlock enabled (/sys/kernel/security/landlock)

Why

Without kernel landlock the sandbox falls back to magus's own binding checks (MGS2005). Those confine what goes through magus's bindings, and nothing a subprocess does: a tool writing through a symlink, or any native code, is out of their reach. That fallback is a fair trade for a developer's own build. It is not one for code nobody trusts running in a job that holds a credential, so a caller that needs the kernel's guarantee says so and magus refuses rather than degrade.

required also needs landlock ABI 3 (Linux 6.2) or newer. Below it the kernel cannot deny truncation, so a confined child could still empty any file its user owns, inside the rules or not.

It fires in two places, with the same meaning:

  • when the workspace's sandbox is applied, before any target or script runs;
  • when a child would start under a required policy, so no path starts one unconfined.

Resolution

  • Run on Linux 6.2 or newer with landlock enabled; check that /sys/kernel/security/landlock exists. GitHub's hosted Ubuntu runners have it.
  • Where kernel enforcement is not available and you accept binding-level checks, use best-effort instead.
sandbox diagnosticsLanding page for the sandbox that confines magus spells to the workspace, plus its MGS2xxx diagnostics for denied reads, writes, execs, and env leaks. magus stdlibReference for every magus stdlib module - fs, os, http, json, yaml, crypto, and the rest of the magusfile API surface. MGS2004: sandbox config unresolvedFires when a sandbox declaration (magus.yaml's sandbox, a spell's mgs_getSandbox, or a target's sandbox policy) or a passthrough pattern cannot be honored; nothing runs. Sandbox modelThe threat model and allowlist semantics that magus enforces around spell execution, and how the MGS2xxx diagnostics map onto that model.
MGS2012sandboxlandlockkernelrequiredmerge queuefail closed
Last updated (a9ff8609)
Glossary

Workspace

The magus root directory that owns a set of projects and shared config; the unit magus operates over. See workspace.

Target

A named operation (build, test, ...) you invoke with magus run <target>; it may compose a spell's tool-native operations and depend on other targets. See targets.

Op

A single tool-native command a target composes (long form: operation); the middle of the work hierarchy (Spell to Op to Target). See operations.

Sandbox

The restricted filesystem and environment a target runs in, so builds stay reproducible and side-effect-free. See sandbox.

Job

The unit of delegated work, and one row of the job store: what an orchestrating agent handed out, with its goal, the checkpoint it was cut against, the paths it may write or must not touch, and the one check it runs. A job's holder is either a session, for work an orchestrator handed out, or the server, for its own maintenance. The store records; the agent guard is what reads those facts back when grading a write. See doctrine.

A job is not a run. magus run build web is a run, and no job exists for it. A job causes runs: its check executes as one, and a server job records the invocation of its last one. Jobs are listed with magus ls jobs and in the console's Jobs view; runs are listed in the Runs view.

Run

One target executing under one magus invocation, such as magus run test web or magus affected ci. A run keeps its captured output behind an output reference. Every magus run is a run whether or not any job asked for it; see Job for how the two relate.

Conventions

This page uses none of the site's convention markers. The full set is on the conventions page.