B-18 · Medium
planarian @ a924e09 · Spec v4.6 · snapshot main · all versions
The model service escapes its sandbox before I9 is proved, and becomes a process with its uid’s capabilities (it parses untrusted text and drives a GPU)
| Breaks | Status | Mitigation | Closes in |
|---|---|---|---|
| Tamperproof (I9) | Open (v4.5 §20, I9) | Normative sandbox: dynamic uid, no capabilities, strict read-only filesystem, Unix sockets only, syscall allowlist, render node only, proposal socket as the only write path; gym case attempting every other write path | B sandbox and case; E proof |
The guarantees it narrows
I9.