[Ubuntu 24.04][Security] DCode connect probe executes sandbox-user login profile before failing closed #8624

Activity

1. mercl-lau

   added

   NV QABugs found by the NVIDIA QA TeamBugs found by the NVIDIA QA Team

   needs: triageAwaiting maintainer classificationAwaiting maintainer classification

   on Aug 8, 2026
2. mercl-lau

   added the

   Bug

   issue type on Aug 8, 2026
3. Dongni-Yang

   self-assigned this

   on Aug 10, 2026
4. Dongni-Yang commented on Aug 10, 2026

   

   Dongni-Yang

   on Aug 10, 2026

   Contributor

   More actions

   The root cause of the login-profile execution is upstream in OpenShell, not in NemoClaw. I filed it as NVIDIA/OpenShell#2668.

   openshell sandbox exec never delivers argv to the sandbox as argv. It flattens the command vector and every --env pair into a single shell string (crates/openshell-server/src/grpc/sandbox.rs:1776-1798), relays that string over the supervisor SSH transport (stream_exec_over_relay, same file, 1800-1806), and the supervisor spawns it with a login shell (crates/openshell-supervisor-process/src/ssh.rs:992-996):

   |command| {
       let mut c = Command::new("/bin/bash");
       // Use login shell (-l) so that .profile/.bashrc are sourced and
       // tool-specific env vars (VIRTUAL_ENV, UV_PYTHON_INSTALL_DIR, etc.)
       // are available without hardcoding them here.
       c.arg("-lc").arg(command);
       c
   }

   The PTY path does the same at 833-835. Both are unconditional, so no flag or environment value changes them.

   That explains the exact wording in this report — the profile runs before the managed probe command — and it means two mitigations already in the tree cannot work:

   • The dcode-managed-exec launcher cannot prevent it. The profile is sourced before the launcher's first instruction runs.
   • --env BASH_ENV= and --env ENV= cannot prevent it. They become command-prefix assignments inside the string handed to bash -lc, so they apply only after the login shell has already sourced the profile.

   Two observations on the existing behavior, both of which look correct as designed:

   • The probe failing after a profile is planted is intended. #6192 deliberately rejects contaminated probe evidence rather than parsing past it.
   • The managed route probe itself does not add a login shell; #6191 pins that argv.

   PR #8670 removes the one login shell I could attribute to NemoClaw in this flow: runAgentSmokeCommands wrapped Deep Agents Code smoke commands in sh -lc, nesting a second profile sourcing inside the managed boundary. It is reachable because a probe result with any stderr resolves to null rather than false (src/lib/actions/sandbox/inference-route-health.ts:53-62) and only an explicit false short-circuits (src/lib/actions/sandbox/terminal-connect-probe.ts:40), so an indeterminate route falls through to smoke.

   That PR is Refs, not Closes, on purpose. It is defense-in-depth. A planted /sandbox/.bash_profile will still run and still leave its marker until the upstream change lands, so this issue's "executes without a login shell" acceptance criterion is not reachable from NemoClaw today.

   Caveat on my evidence: I verified the upstream behavior by reading OpenShell main at 5e2f0d1, not by running it. This host cannot start a gateway, so I did not reproduce the sandbox-side execution directly.

   @mercl-lau one detail would help confirm the chain end to end: in your run, which command emitted the startup-profile output — the route probe, the smoke command, or the direct dcode-managed-exec cleanup?

   Signed-off-by: Dongni Yang [email protected]
5. Dongni-Yang

   added a commit that references this issue on Aug 10, 2026

   test(sandbox): read the smoke command from the end of the stub argv

   ...

   245da7c
6. wscurran

   added

   area: sandboxOpenShell sandbox lifecycle, runtime, config, or recoveryOpenShell sandbox lifecycle, runtime, config, or recovery

   area: securitySecurity controls, permissions, secrets, or hardeningSecurity controls, permissions, secrets, or hardening

   integration: dcodeLangChain Deep Code integration behaviorLangChain Deep Code integration behavior

   platform: ubuntuAffects Ubuntu Linux environmentsAffects Ubuntu Linux environments

   security

   and removed

   needs: triageAwaiting maintainer classificationAwaiting maintainer classification

   on Aug 10, 2026
7. apurvvkumaria

   assigned

   apurvvkumaria

   and unassigned

   Dongni-Yang

   on Aug 11, 2026
8. apurvvkumaria

   added a commit that references this issue on Aug 12, 2026

   fix(agent): narrow smoke hardening scope

   ...

   7540048
9. github-actions

   assigned

   Dongni-Yang

   on Aug 12, 2026
10. prekshivyas

    closed this as completedin #8670on Aug 13, 2026
11. prekshivyas

    added a commit that references this issue on Aug 13, 2026

    fix(sandbox): protect DCode managed login probes (#8670)

    ...

    This issue will close once commit 5e7d8a0 is merged into the 'main' branch.

    5e7d8a0
12. ericksoa

    added a commit that references this issue on Sep 12, 2026

    fix(connect): verify DeepAgents inference before session (#11546)

    ...

    e6b28e6
13. wscurran

    removed

    security

    on Oct 29, 2026