zara-shell: default-deny model supplied environment variables #144

New issue

Closed

opened 2026-09-08 02:03:04 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-08 02:03:04 +00:00

Owner

Security problem

shell.run accepts a model-supplied env mapping and ShellRunner forwards every bounded string key/value directly to an allowlisted executable. The argv allowlist is therefore bypassable through process-loader/interpreter controls such as LD_PRELOAD, PYTHONPATH, and other program-specific environment hooks.

No shell interpolation is required for this bypass.

Required contract

environment keys are default-deny;
operator configuration may explicitly allow exact environment variable names when a command genuinely requires them;
undeclared keys fail before process creation with a typed ShellError;
size/type bounds remain enforced;
status/docs expose the configured environment-key count, never values;
deterministic RED proves an undeclared loader variable cannot reach execution;
full plugin/registry/compatibility/Nix package gates pass.

Do not add a model-controlled escape hatch, arbitrary shell/eval, or Core changes. Explicit cancellation remains separately blocked on Zara Core #388.

## Security problem `shell.run` accepts a model-supplied `env` mapping and `ShellRunner` forwards every bounded string key/value directly to an allowlisted executable. The argv allowlist is therefore bypassable through process-loader/interpreter controls such as `LD_PRELOAD`, `PYTHONPATH`, and other program-specific environment hooks. No shell interpolation is required for this bypass. ## Required contract - environment keys are default-deny; - operator configuration may explicitly allow exact environment variable names when a command genuinely requires them; - undeclared keys fail before process creation with a typed `ShellError`; - size/type bounds remain enforced; - status/docs expose the configured environment-key count, never values; - deterministic RED proves an undeclared loader variable cannot reach execution; - full plugin/registry/compatibility/Nix package gates pass. Do not add a model-controlled escape hatch, arbitrary shell/eval, or Core changes. Explicit cancellation remains separately blocked on Zara Core #388.

nsaspy

2026-09-08 02:03:04 +00:00