chore: import upstream snapshot with attribution

Sources/Containerization/SandboxOverrides.swift

@@ -0,0 +1,100 @@
+//===----------------------------------------------------------------------===//
+// Copyright © 2026 Apple Inc. and the Containerization project authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//   https://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//===----------------------------------------------------------------------===//
+
+#if os(Linux)
+import Foundation
+
+/// Per-component opt-ins to weaken the upstream-secure spawn flags for
+/// cloud-hypervisor and virtiofsd. Each flag is independent so an operator
+/// can target the minimum hardening that needs to come off — e.g. running
+/// inside apple/container's `--virtualization` dev container needs both,
+/// but a future bare-metal Linux host with a custom seccomp policy might
+/// only need one.
+///
+/// Read once per process at first reference. Default false (secure).
+///
+/// **Legacy alias.** `CONTAINERIZATION_RELAXED_SANDBOX=1` continues to flip
+/// every flag here for back-compat with the original combined toggle. New
+/// callers should prefer the per-component vars below.
+enum SandboxOverrides {
+    /// When set, cloud-hypervisor is launched with `--seccomp false`.
+    /// Disables CH's userspace seccomp BPF filter; the kernel's filter
+    /// (whatever the host policy is) still applies.
+    ///
+    /// Env: `CONTAINERIZATION_NO_CH_SECCOMP=1`
+    static let chSeccompDisabled: Bool =
+        boolEnv("CONTAINERIZATION_NO_CH_SECCOMP") || legacyRelaxedSandbox
+
+    /// When set, virtiofsd is launched with `--sandbox none`. Disables
+    /// virtiofsd's userns + pivot_root + seccomp setup. Combined with the
+    /// vendored cap-drop patch (`scripts/patches/virtiofsd-skip-cap-drop-with-sandbox-none.patch`)
+    /// at build time, the daemon retains its parent's capabilities — so
+    /// only enable this when the parent process is the trust boundary you
+    /// want.
+    ///
+    /// Env: `CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX=1`
+    static let virtiofsdSandboxDisabled: Bool =
+        boolEnv("CONTAINERIZATION_NO_VIRTIOFSD_SANDBOX") || legacyRelaxedSandbox
+
+    /// True if any override is currently in effect — used by callers that
+    /// want to log a single banner regardless of which flag is set.
+    static var anyEnabled: Bool {
+        chSeccompDisabled || virtiofsdSandboxDisabled
+    }
+
+    /// Back-compat alias: enables every per-component flag in one shot.
+    private static let legacyRelaxedSandbox: Bool =
+        boolEnv("CONTAINERIZATION_RELAXED_SANDBOX")
+
+    private static func boolEnv(_ name: String) -> Bool {
+        ProcessInfo.processInfo.environment[name] == "1"
+    }
+}
+
+/// Minimal environment allowlist for child processes we spawn (`CHProcess`,
+/// `VirtiofsdProcess`). Inheriting the parent's full env exposes any
+/// secrets the calling tool happens to have set (`AWS_*`, `KUBE_*`,
+/// `*_TOKEN`, etc.) to a binary that has no use for them. Only the
+/// variables below are forwarded — extend this list when a new spawn-time
+/// dependency surfaces, and document why.
+///
+/// - `PATH`, `HOME`: minimum POSIX hygiene; some libc/setuid paths look at
+///   these even for self-contained binaries.
+/// - `RUST_LOG`, `RUST_BACKTRACE`: cloud-hypervisor and virtiofsd are Rust
+///   binaries; pass these through if the operator has set them so
+///   debugging is unimpaired.
+enum ChildEnvironment {
+    /// Construct a minimal environment for the child as `KEY=value` strings
+    /// suitable for `Command.environment`. Variables not present in the
+    /// parent env are simply omitted.
+    static func minimal() -> [String] {
+        let allowlist = ["PATH", "HOME", "RUST_LOG", "RUST_BACKTRACE"]
+        let parent = ProcessInfo.processInfo.environment
+        var entries: [String] = []
+        // PATH falls back to a sane default since Command's execve needs an
+        // absolute path anyway, but child Rust binaries occasionally probe
+        // PATH for helper tools.
+        let path = parent["PATH"] ?? "/usr/sbin:/usr/bin:/sbin:/bin"
+        entries.append("PATH=\(path)")
+        for key in allowlist where key != "PATH" {
+            if let value = parent[key] {
+                entries.append("\(key)=\(value)")
+            }
+        }
+        return entries
+    }
+}
+#endif