[SYSTEM / ROLE] You are a Principal Security Engineer and Li...

Prompt

[SYSTEM / ROLE] You are a Principal Security Engineer and Linux Systems Architect specializing in gVisor container isolation, local LLM orchestration, and hardened agent sandboxes. Deliver concise, high-density technical analysis. Do not include introductory remarks, generic warnings, or conversational transitions. [CONTEXT SUMMARY] Host: Linux, RTX 3090 (24GB), 64GB RAM. Host inference on 127.0.0.1:8080 via Unix Socket proxy. Sandbox: Rootless Podman + gVisor (`runsc`), 8GB cgroup limit, no GPU passthrough (major 195/226 blocked). Network: nftables drops RFC1918, CGNAT, 127.0.0.0/8 reflection; allows 80, 443, 53. Storage: Btrfs subvolumes (`@agent_code` ro at `/opt/agent`, `@workspace_vault` rw at `/workspace/data`). Agent: ReAct supervisor/worker loop currently restricted to text-based web scraping and CLI truncation. [OBJECTIVES] 1. HARDENING AUDIT: Identify host escape paths, IPC hijacking risks, and side-channel leaks in this specific setup. 2. CAPABILITY EXTENSION - ARBITRARY SOFTWARE & PACKAGES: Recommend an architecture allowing the agent to install missing CLI/GUI packages persistently without compromising the immutable rootfs or breaking gVisor syscall emulation. 3. CAPABILITY EXTENSION - VISION & COMPUTER USE: Design an end-to-end multimodal pipeline (CDP screenshots -> Base64 OpenAI-compatible format -> Vision ReAct loop) integrating with local vision models. 4. DEFECT REMEDIATION: Fix syntax bugs and broken network/IPC assumptions in the provided operations manual. [OUTPUT FORMAT] Respond strictly using this schema: ## 1. Vulnerability & Design Flaw Matrix | Component | Vulnerability / Bottleneck | Severity (High/Med/Low) | Concrete Remediation | |---|---|---|---| ## 2. Architecture Enhancements - Provide brief rationale (<3 sentences per topic) for: a) Package persistence (e.g., Rootless Nix / Conda vs overlayfs). b) Headless GUI / Vision harness (e.g., Xvfb + VNC vs pure CDP). c) Egress DNS exfiltration mitigation. ## 3. Implementation Diffs Provide unified diffs (`diff -u`) or drop-in code snippets for: - IPC socket isolation hardening. - Vision snapshot capture and formatting in `orchestrator.py` & `agent_browser.py`. === SYSTEM ARCHITECTURE & CRITICAL CONFIGS === 1. Boundary & Sandboxing Configs: - Podman Flags: --runtime=runsc --cgroup-slice=agent-sandbox.slice --host-uds=all --ignore-cgroups - Systemd Slice (/etc/systemd/system/agent-sandbox.slice): [Slice] MemoryHigh=6G MemoryMax=8G MemoryOOMGroup=yes - GPU/Device Restrictions: DevicePolicy=strict (major 195/226 blocked) - Mounts: /mnt/agent_storage/@workspace_vault -> /workspace/data:rw /mnt/agent_storage/@agent_code -> /opt/agent:ro - Network Rules (/etc/nftables.conf): Drops: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16, 100.64.0.0/10, fc00::/7, fe80::/10, 127.0.0.0/8 Accepts: tap-agent on TCP/UDP 53, TCP 80, TCP 443 2. Host Inference IPC Proxy (/usr/local/bin/strata_proxy.py): ```python HOST_INFERENCE_PORT = 8080 SOCKET_PATH = "/mnt/agent_storage/@workspace_vault/strata.sock" # Handshake / Routing checks if method != "POST" or path != "/v1/chat/completions": writer.write(b"HTTP/1.1 403 Forbidden\r\n\r\n403 Access Denied") return if content_length > 2 * 1024 * 1024: writer.write(b"HTTP/1.1 413 Payload Too Large\r\n\r\n") return # Forwarding logic: hconn = http.client.HTTPConnection("127.0.0.1", HOST_INFERENCE_PORT, timeout=120) hconn.request("POST", "/v1/chat/completions", body=body, headers=forward_headers) ``` 3. Browser & HITL Subsystem (/opt/agent/agent_browser.py): ```python # Launch flags: browser = await p.chromium.launch( headless=True, args=[ "--no-sandbox", "--disable-setuid-sandbox", "--disable-dev-shm-usage", "--disable-gpu", "--headless=new", "--disable-blink-features=AutomationControlled" ] ) # Human-In-The-Loop solver: server = await websockets.serve(lambda ws: serve_cdp_screencast(page, ws), "127.0.0.1", 8765) # Streams frames from Page.startScreencast and accepts mouse/key actions over CDP ``` 4. Tool Dispatch & Circuit Breaker (/opt/agent/orchestrator.py): ```python # Execution guard loop detection: action_sig = f"{tool_name}:{tool_args}" for prev in self.failed_history: if SequenceMatcher(None, action_sig, prev).ratio() >= 0.95: return False, "LOOP_DETECTED: Repeated action pattern matches a recent failure." # Tools: web_search, web_browse, spawn_subagent (depth 1 max), bash, memory_search, memory_save ```