[chxmxii]

Closes #28. Part of the v0.5 milestone.

box inspect <name> --security-report states what a sandbox's VMM can and cannot touch. --security-report=json gives the same for CI and audits.

What makes it trustworthy

• Read from what box applies, not from the Boxfile. The report calls the same builders that launch the VM — vmArgs (podman), krunSpec (krun), fcSpec (the Firecracker jail) — and reads capabilities, no_new_privs, seccomp, namespaces, limits, the UID mapping, mounts and the network back out of their output. It cannot describe a confinement box does not apply.
• Checked against the running VMM. When the sandbox is up, the VMM's /proc entry is read (UID, capability mask, no_new_privs, seccomp, network namespace). Any difference is a fail finding and the command exits 1. Anything unreadable counts as a difference, never as a match.
• The escape suite checks the report against what it reads from /proc itself.

Example (podman, strict, running)

VMM
  runs as        host UID 524288 (strict slot 0, owns nothing of yours or of another sandbox)
  capabilities   CHOWN DAC_OVERRIDE FOWNER NET_BIND_SERVICE SETGID SETUID
  no_new_privs   yes
  seccomp        podman's default filter
...
running VMM
  matches        yes, everything above

findings
  WARN  full internet egress: anything the guest can read, including /data and mounts, can leave. Per-sandbox allowlists are planned (#7).

Fixed on the way

• The escape suite's network-namespace check could pass without reading anything. A VMM running as another UID hides its /proc/<pid>/ns/net link, and the empty result never equals the host's, so the check passed blind. It now reads the link through podman's namespace and fails if it still can't.
• Firecracker with a long BOX_HOME failed with only "never opened its API socket". It now names the socket path and says to shorten BOX_HOME.

Tests

• Unit: capability masks and names; every kind of live difference (UID, extra capability, no_new_privs, seccomp, host network namespace, unreadable namespace) is caught on its own; findings fail on real problems and not on a sound sandbox; the krun and Firecracker specs report what they configure.
• Real VMs: podman strict, Firecracker strict (no capabilities at all), krun standard — up and down — report matches the running VMM.
• Escape suite on all three: the report matches, the network namespace is actually read, no escapes.