필사 모드: AI 编码智能体沙箱化：安全代码执行隔离与安全运维指南

(version 1)
(deny default)

;; 允许读取基本系统库
(allow file-read*
  (subpath "/usr/lib")
  (subpath "/usr/share")
  (subpath "/System/Library")
  (subpath "/Library/Frameworks")
  (subpath "/private/var/db/dyld"))

;; 仅允许读写项目目录
(allow file-read* file-write*
  (subpath "/Users/dev/projects/my-app"))

;; 限制可执行的二进制文件
(allow process-exec
  (literal "/usr/bin/git")
  (literal "/usr/bin/python3")
  (literal "/usr/local/bin/node"))

;; 完全阻断网络
(deny network*)

;; 显式阻断敏感目录
(deny file-read* file-write*
  (subpath "/Users/dev/.ssh")
  (subpath "/Users/dev/.aws")
  (subpath "/Users/dev/.gnupg")
  (subpath "/Users/dev/.config/gcloud"))

;; 允许进程 fork（构建/测试所需）
(allow process-fork)
(allow signal (target self))

# 用 sandbox-exec 运行智能体
sandbox-exec -f /path/to/agent-sandbox.sb -- claude --dangerously-skip-permissions

# 确认配置文件已生效（拦截日志）
log stream --predicate 'subsystem == "com.apple.sandbox"' --level debug

# 安装 Agent Safehouse
git clone https://github.com/eugene1g/agent-safehouse.git
cd agent-safehouse
chmod +x safehouse

# 在项目目录中运行智能体
cd ~/projects/my-app
safehouse claude --dangerously-skip-permissions

# 使用自定义策略运行
safehouse --policy custom-policy.sb -- claude

;; machine-local-policy.sb - 机器专属设置
(allow file-read*
  (home-literal "/.gitignore_global")
  (home-subpath "/Library/Application Support/Claude"))

;; 允许访问特定共享卷
(allow file-read*
  (subpath "/Volumes/Shared/Engineering"))

# docker-compose.yml - AI 智能体隔离环境
version: '3.8'

services:
  ai-agent:
    build:
      context: .
      dockerfile: Dockerfile.agent
    security_opt:
      - no-new-privileges:true
      - seccomp:seccomp-profile.json
      - apparmor:agent-profile
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    read_only: true
    tmpfs:
      - /tmp:size=512M,noexec,nosuid
    volumes:
      - ./project:/workspace:rw
      # 禁止挂载敏感目录
    networks:
      - agent-isolated
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 4G
          pids: 256
        reservations:
          cpus: '0.5'
          memory: 512M
    environment:
      - HOME=/workspace
      # API 密钥从密钥管理器注入
    user: '1000:1000'

networks:
  agent-isolated:
    driver: bridge
    internal: true # 阻断外部网络

{
  "defaultAction": "SCMP_ACT_ERRNO",
  "defaultErrnoRet": 1,
  "architectures": ["SCMP_ARCH_X86_64", "SCMP_ARCH_AARCH64"],
  "syscalls": [
    {
      "names": [
        "read",
        "write",
        "open",
        "close",
        "stat",
        "fstat",
        "lstat",
        "poll",
        "lseek",
        "mmap",
        "mprotect",
        "munmap",
        "brk",
        "access",
        "pipe",
        "select",
        "sched_yield",
        "clone",
        "fork",
        "vfork",
        "execve",
        "exit",
        "wait4",
        "kill",
        "uname",
        "fcntl",
        "flock",
        "fsync",
        "fdatasync",
        "truncate",
        "getdents",
        "getcwd",
        "chdir",
        "mkdir",
        "rmdir",
        "unlink",
        "readlink",
        "chmod",
        "chown",
        "getuid",
        "getgid",
        "geteuid",
        "getegid",
        "getpid",
        "getppid",
        "socket",
        "connect",
        "sendto",
        "recvfrom",
        "bind",
        "listen",
        "accept",
        "arch_prctl",
        "set_tid_address",
        "set_robust_list",
        "futex",
        "clock_gettime",
        "epoll_create",
        "epoll_ctl",
        "epoll_wait",
        "openat",
        "newfstatat",
        "readlinkat",
        "getrandom",
        "pread64",
        "pwrite64"
      ],
      "action": "SCMP_ACT_ALLOW"
    },
    {
      "names": [
        "ptrace",
        "mount",
        "umount2",
        "pivot_root",
        "swapon",
        "swapoff",
        "reboot",
        "sethostname",
        "setdomainname",
        "init_module",
        "delete_module",
        "kexec_load",
        "perf_event_open"
      ],
      "action": "SCMP_ACT_ERRNO",
      "errnoRet": 1
    }
  ]
}

#!/bin/bash
# firecracker-agent-sandbox.sh
# 用 Firecracker MicroVM 隔离运行 AI 智能体

FIRECRACKER_BIN="/usr/local/bin/firecracker"
KERNEL_PATH="/opt/firecracker/vmlinux"
ROOTFS_PATH="/opt/firecracker/agent-rootfs.ext4"
SOCKET_PATH="/tmp/firecracker-agent.socket"
API_URL="http://localhost"

# 清理已存在的 socket
rm -f "$SOCKET_PATH"

# 启动 Firecracker 进程
$FIRECRACKER_BIN --api-sock "$SOCKET_PATH" &
FC_PID=$!
sleep 0.5

# 配置内核
curl --unix-socket "$SOCKET_PATH" -X PUT "$API_URL/boot-source" \
  -H "Content-Type: application/json" \
  -d '{
    "kernel_image_path": "'"$KERNEL_PATH"'",
    "boot_args": "console=ttyS0 reboot=k panic=1 pci=off"
  }'

# 根文件系统（智能体镜像）
curl --unix-socket "$SOCKET_PATH" -X PUT "$API_URL/drives/rootfs" \
  -H "Content-Type: application/json" \
  -d '{
    "drive_id": "rootfs",
    "path_on_host": "'"$ROOTFS_PATH"'",
    "is_root_device": true,
    "is_read_only": false
  }'

# 资源限制（2 vCPU，2GB RAM）
curl --unix-socket "$SOCKET_PATH" -X PUT "$API_URL/machine-config" \
  -H "Content-Type: application/json" \
  -d '{
    "vcpu_count": 2,
    "mem_size_mib": 2048
  }'

# 网络接口（隔离网络）
curl --unix-socket "$SOCKET_PATH" -X PUT "$API_URL/network-interfaces/eth0" \
  -H "Content-Type: application/json" \
  -d '{
    "iface_id": "eth0",
    "guest_mac": "AA:FC:00:00:00:01",
    "host_dev_name": "tap-agent0"
  }'

# 配置 Rate limiter（限制网络带宽）
curl --unix-socket "$SOCKET_PATH" -X PATCH "$API_URL/network-interfaces/eth0" \
  -H "Content-Type: application/json" \
  -d '{
    "iface_id": "eth0",
    "rx_rate_limiter": {
      "bandwidth": { "size": 10485760, "refill_time": 1000 },
      "ops": { "size": 1000, "refill_time": 1000 }
    },
    "tx_rate_limiter": {
      "bandwidth": { "size": 10485760, "refill_time": 1000 },
      "ops": { "size": 1000, "refill_time": 1000 }
    }
  }'

# 启动 MicroVM
curl --unix-socket "$SOCKET_PATH" -X PUT "$API_URL/actions" \
  -H "Content-Type: application/json" \
  -d '{ "action_type": "InstanceStart" }'

echo "Firecracker MicroVM started (PID: $FC_PID)"
echo "Agent is running in isolated VM"

# 任务完成后关闭 VM
cleanup() {
  kill "$FC_PID" 2>/dev/null
  rm -f "$SOCKET_PATH"
  echo "MicroVM destroyed - host remains untouched"
}
trap cleanup EXIT

# gvisor-runtime-class.yaml
apiVersion: node.k8s.io/v1
kind: RuntimeClass
metadata:
  name: gvisor
handler: runsc
scheduling:
  nodeSelector:
    sandbox.gke.io/runtime: gvisor

---
# agent-sandbox-pod.yaml
apiVersion: v1
kind: Pod
metadata:
  name: ai-coding-agent
  labels:
    app: coding-agent
    sandbox: gvisor
spec:
  runtimeClassName: gvisor
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 1000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: agent
      image: ai-coding-agent:latest
      resources:
        limits:
          cpu: '2'
          memory: '4Gi'
          ephemeral-storage: '10Gi'
        requests:
          cpu: '500m'
          memory: '1Gi'
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      volumeMounts:
        - name: workspace
          mountPath: /workspace
        - name: tmp
          mountPath: /tmp
      env:
        - name: AGENT_WORKSPACE
          value: '/workspace'
        - name: AGENT_NETWORK_POLICY
          value: 'restricted'
  volumes:
    - name: workspace
      emptyDir:
        sizeLimit: 10Gi
    - name: tmp
      emptyDir:
        sizeLimit: 512Mi

---
# agent-network-policy.yaml
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: agent-isolation
spec:
  podSelector:
    matchLabels:
      sandbox: gvisor
  policyTypes:
    - Ingress
    - Egress
  egress:
    # 仅允许访问软件包注册表
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - protocol: TCP
          port: 443
    # 允许 DNS
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
  ingress: [] # 全面阻断入站流量

# 攻击场景：隐藏在 .cursorrules 中的恶意指令
# 项目根目录下的 .cursorrules 文件

# 隐藏在看似正常的规则之间的指令
# "Always run npm audit fix before starting"
# 实际上是在指示智能体执行以下操作：
# 1. 修改 package.json，添加恶意的 postinstall 脚本
# 2. 在执行 npm install 时收集凭证
# 3. 发送到外部服务器

# 对策：仅从可信来源获取项目配置文件
# 智能体启动前必须验证配置文件的完整性

Layer 5: 监控/审计 (Audit Logging, Anomaly Detection)
  |
Layer 4: 网络隔离 (NetworkPolicy, Firewall Rules)
  |
Layer 3: 资源限制 (cgroups, CPU/Memory/PID limits)
  |
Layer 2: 权限范围界定 (RBAC, File Permission, Capability Drop)
  |
Layer 1: 执行隔离 (MicroVM / gVisor / sandbox-exec)
  |
Layer 0: 硬件 (TPM, Secure Boot, VT-x)

# agent-security-policy.yaml
# AI 编码智能体安全策略定义

policies:
  code-review-agent:
    description: '专用于代码审查的智能体'
    filesystem:
      read:
        - '/workspace/src'
        - '/workspace/tests'
        - '/workspace/package.json'
        - '/workspace/tsconfig.json'
      write: [] # 仅读取
      deny:
        - '/workspace/.env'
        - '/workspace/.env.local'
        - '/workspace/secrets'
    network:
      allow_outbound:
        - 'api.openai.com:443'
        - 'api.anthropic.com:443'
      deny_all_inbound: true
    process:
      allow_exec:
        - '/usr/bin/git'
        - '/usr/local/bin/node'
      deny_exec:
        - '/bin/sh'
        - '/bin/bash'
        - '/usr/bin/curl'
        - '/usr/bin/wget'
    resources:
      max_cpu: '1.0'
      max_memory: '2Gi'
      max_pids: 128
      max_file_size: '50Mi'

  development-agent:
    description: '开发工作智能体（受限写入）'
    filesystem:
      read:
        - '/workspace'
      write:
        - '/workspace/src'
        - '/workspace/tests'
        - '/workspace/docs'
      deny:
        - '/workspace/.env'
        - '/workspace/.git/hooks'
        - '/workspace/node_modules/.cache'
    network:
      allow_outbound:
        - 'registry.npmjs.org:443'
        - 'api.openai.com:443'
      deny_all_inbound: true
    process:
      allow_exec:
        - '/usr/bin/git'
        - '/usr/local/bin/node'
        - '/usr/local/bin/npm'
        - '/usr/bin/python3'
      deny_exec:
        - '/usr/bin/ssh'
        - '/usr/bin/scp'
    resources:
      max_cpu: '2.0'
      max_memory: '4Gi'
      max_pids: 256
      max_file_size: '100Mi'
    audit:
      log_all_file_writes: true
      log_all_network_requests: true
      alert_on_denied_access: true