fix(sandbox): make peer-binary resolution netns-robust

crates/openshell-sandbox/src/bypass_monitor.rs

@@ -22,7 +22,7 @@ use openshell_ocsf::{
     FindingInfo, NetworkActivityBuilder, Process, SeverityId, ocsf_emit,
 };
 use std::sync::Arc;
-use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::atomic::{AtomicU32, AtomicU64, Ordering};
 use tokio::sync::mpsc;
 use tracing::debug;
 
@@ -117,6 +117,7 @@ fn hint_for_event(event: &BypassEvent) -> &'static str {
 pub fn spawn(
     namespace_name: String,
     entrypoint_pid: Arc<AtomicU32>,
+    sandbox_netns_inode: Arc<AtomicU64>,
     denial_tx: Option<mpsc::UnboundedSender<DenialEvent>>,
 ) -> Option<tokio::task::JoinHandle<()>> {
     use std::io::BufRead;
@@ -196,9 +197,10 @@ pub fn spawn(
 
             // Attempt process identity resolution (best-effort, TCP only).
             let pid = entrypoint_pid.load(Ordering::Acquire);
+            let netns_ino = sandbox_netns_inode.load(Ordering::Acquire);
             let (binary, binary_pid, ancestors) =
                 if event.proto == "tcp" && event.src_port > 0 && pid > 0 {
-                    resolve_process_identity(pid, event.src_port)
+                    resolve_process_identity(pid, event.src_port, event.dst_port, netns_ino)
                 } else {
                     ("-".to_string(), "-".to_string(), "-".to_string())
                 };
@@ -292,12 +294,22 @@ pub fn spawn(
 ///
 /// Returns `(binary_path, pid, ancestors)` as display strings.
 /// Falls back to `("-", "-", "-")` on any failure (race condition, etc.).
-fn resolve_process_identity(entrypoint_pid: u32, src_port: u16) -> (String, String, String) {
+fn resolve_process_identity(
+    entrypoint_pid: u32,
+    src_port: u16,
+    dst_port: u16,
+    sandbox_netns_inode: u64,
+) -> (String, String, String) {
     #[cfg(target_os = "linux")]
     {
         use crate::procfs;
 
-        match procfs::resolve_tcp_peer_socket_owners(entrypoint_pid, src_port) {
+        match procfs::resolve_tcp_peer_socket_owners(
+            entrypoint_pid,
+            src_port,
+            dst_port,
+            sandbox_netns_inode,
+        ) {
             Ok(socket_owners) => {
                 let mut identities = Vec::new();
                 for owner in &socket_owners.owners {
@@ -371,7 +383,7 @@ fn resolve_process_identity(entrypoint_pid: u32, src_port: u16) -> (String, Stri
 
     #[cfg(not(target_os = "linux"))]
     {
-        let _ = (entrypoint_pid, src_port);
+        let _ = (entrypoint_pid, src_port, dst_port, sandbox_netns_inode);
         ("-".to_string(), "-".to_string(), "-".to_string())
     }
 }
@@ -559,7 +571,14 @@ mod tests {
             std::thread::sleep(Duration::from_millis(20));
         }
 
-        let (binary, pid, ancestors) = resolve_process_identity(std::process::id(), peer_port);
+        let test_netns_ino = std::fs::metadata("/proc/self/ns/net")
+            .map(|m| {
+                use std::os::unix::fs::MetadataExt;
+                m.ino()
+            })
+            .expect("stat /proc/self/ns/net");
+        let (binary, pid, ancestors) =
+            resolve_process_identity(std::process::id(), peer_port, listener_port, test_netns_ino);
 
         // libc/syscall FFI requires unsafe
         #[allow(unsafe_code)]

crates/openshell-sandbox/src/lib.rs

@@ -36,7 +36,7 @@ use std::sync::LazyLock;
 #[cfg(any(target_os = "linux", test))]
 use std::sync::Mutex;
 use std::sync::OnceLock;
-use std::sync::atomic::{AtomicU32, Ordering};
+use std::sync::atomic::{AtomicU32, AtomicU64, Ordering};
 use std::time::Duration;
 use tokio::time::timeout;
 use tracing::{debug, info, trace, warn};
@@ -560,6 +560,25 @@ pub async fn run_sandbox(
     // the entrypoint process's /proc/net/tcp for identity binding.
     let entrypoint_pid = Arc::new(AtomicU32::new(0));
 
+    // Kernel-level nsfs inode of the sandbox network namespace, used by
+    // the proxy to confirm that processes resolved during peer-binary
+    // attribution actually live inside this sandbox. Zero means "no netns
+    // gate available" — the proxy then keeps the legacy entrypoint-PID-only
+    // behaviour and refuses to cross into other namespaces during fallback.
+    let sandbox_netns_inode = Arc::new(AtomicU64::new(0));
+    #[cfg(target_os = "linux")]
+    if let Some(ns) = netns.as_ref() {
+        match ns.ns_inode() {
+            Ok(inode) => sandbox_netns_inode.store(inode, Ordering::Release),
+            Err(e) => {
+                tracing::warn!(
+                    error = %e,
+                    "Failed to stat sandbox netns inode; peer-binary fallback will be disabled",
+                );
+            }
+        }
+    }
+
     let (_proxy, denial_rx, bypass_denial_tx) = if matches!(policy.network.mode, NetworkMode::Proxy)
     {
         let proxy_policy = policy.network.proxy.as_ref().ok_or_else(|| {
@@ -609,6 +628,7 @@ pub async fn run_sandbox(
             engine,
             cache,
             entrypoint_pid.clone(),
+            sandbox_netns_inode.clone(),
             tls_state,
             inference_ctx,
             Some(provider_credentials.clone()),
@@ -629,6 +649,7 @@ pub async fn run_sandbox(
         bypass_monitor::spawn(
             ns.name().to_string(),
             entrypoint_pid.clone(),
+            sandbox_netns_inode.clone(),
             bypass_denial_tx,
         )
     });