[pitboss] sweep after phase 03: 7 deferred items resolved

tests/dynamic_fixtures/escape/hardlink_escape.py

@@ -1,17 +0,0 @@
-"""Escape attempt: create a hardlink to a sensitive file outside the workdir.
-
-Expected outcome: PermissionError (EPERM — cross-device or protected hardlink).
-Linux protects hardlinks to files owned by other users since 3.6+.
-"""
-import os
-import sys
-
-try:
-    os.link("/etc/shadow", "/tmp/shadow_hardlink")
-    with open("/tmp/shadow_hardlink", "r") as f:
-        data = f.read(64)
-    print(f"NYX_ESCAPE_SUCCESS: hardlinked /etc/shadow: {data[:32]!r}")
-    sys.exit(0)
-except (PermissionError, OSError) as e:
-    print(f"BLOCKED: {e}", file=sys.stderr)
-    sys.exit(1)

tests/dynamic_fixtures/escape/ipc_shm_escape.py

@@ -1,28 +1,32 @@
 """Escape attempt: create a System V shared memory segment accessible host-wide.
 
-Expected outcome: success creates IPC segment inside the container IPC namespace
-(isolated by --ipc private default); OR EPERM if IPC syscalls are blocked.
+Expected outcome: ENOSYS or EPERM when IPC syscalls are blocked; or the segment
+is created inside the container IPC namespace (isolated by default, not an escape).
+Rewritten to use ctypes so python:3-slim does not need sysv_ipc installed.
 """
+import ctypes
+import ctypes.util
 import sys
 
 try:
-    import sysv_ipc
-    key = sysv_ipc.ftok("/tmp", ord('N'))
-    shm = sysv_ipc.SharedMemory(key, sysv_ipc.IPC_CREAT, size=4096)
-    shm.write(b"NYX_IPC_ESCAPE_TEST" + b"\x00" * (4096 - 20))
-    # If we can create IPC, check if it's in an isolated namespace.
-    # A properly isolated container won't share this with the host.
-    # We can only verify this from the host side, so just report success.
-    shm.detach()
-    shm.remove()
-    # IPC created successfully but inside the container namespace — not an escape.
+    libc_path = ctypes.util.find_library("c") or "libc.so.6"
+    libc = ctypes.CDLL(libc_path, use_errno=True)
+
+    IPC_PRIVATE = 0
+    IPC_CREAT = 0o1000
+    IPC_RMID = 0
+
+    shmid = libc.shmget(IPC_PRIVATE, 4096, IPC_CREAT | 0o600)
+    if shmid == -1:
+        errno = ctypes.get_errno()
+        print(f"BLOCKED: shmget failed errno={errno}", file=sys.stderr)
+        sys.exit(1)
+
+    # Segment created in the container IPC namespace — not accessible from host.
+    libc.shmctl(shmid, IPC_RMID, None)
     print("BLOCKED: IPC shm created but confined to container IPC namespace",
           file=sys.stderr)
     sys.exit(1)
-except ImportError:
-    # sysv_ipc not available — not an escape.
-    print("BLOCKED: sysv_ipc module not available", file=sys.stderr)
-    sys.exit(1)
 except Exception as e:
     print(f"BLOCKED: {e}", file=sys.stderr)
     sys.exit(1)