fix: add nosuid/nodev to /code mount and block Landlock syscalls

Move /code bind mount from CLI -B flag to nsjail protobuf config using
prefix_src_env so nosuid/nodev flags can be set (N-2). Block
landlock_create_ruleset, landlock_add_rule, and landlock_restrict_self
syscalls in seccomp policy to reduce kernel attack surface (S-2).

Co-Authored-By: Claude <noreply@anthropic.com>

Author: koki-develop

e2e/tests/security/bind_mount_flags.yml

@@ -79,3 +79,24 @@ tests:
               exit_code: 0
               status: "OK"
               signal: null
+
+  - name: "/code bind mount has nosuid and nodev flags"
+    requests:
+      - input:
+          runtime: bash
+          files:
+            - name: main.sh
+              type: plain
+              content: |
+                grep ' /code ' /proc/mounts | tr ' ' '\n' | sed -n '4p' | tr ',' '\n' | grep -E '^(nosuid|nodev)$' | sort
+        output:
+          status: 200
+          body:
+            compile: null
+            run:
+              stdout: "nodev\nnosuid\n"
+              stderr: ""
+              output: "nodev\nnosuid\n"
+              exit_code: 0
+              status: "OK"
+              signal: null

e2e/tests/security/seccomp_misc.yml

@@ -81,3 +81,66 @@ tests:
               exit_code: 159
               status: "SIGNAL"
               signal: "SIGSYS"
+
+  - name: "landlock_create_ruleset is blocked with SIGSYS"
+    requests:
+      - input:
+          runtime: ruby
+          files:
+            - name: main.rb
+              type: plain
+              content: |
+                syscall(444, 0, 0, 0)
+        output:
+          status: 200
+          body:
+            compile: null
+            run:
+              stdout: ""
+              stderr: ""
+              output: ""
+              exit_code: 159
+              status: "SIGNAL"
+              signal: "SIGSYS"
+
+  - name: "landlock_add_rule is blocked with SIGSYS"
+    requests:
+      - input:
+          runtime: ruby
+          files:
+            - name: main.rb
+              type: plain
+              content: |
+                syscall(445, 0, 0, 0)
+        output:
+          status: 200
+          body:
+            compile: null
+            run:
+              stdout: ""
+              stderr: ""
+              output: ""
+              exit_code: 159
+              status: "SIGNAL"
+              signal: "SIGSYS"
+
+  - name: "landlock_restrict_self is blocked with SIGSYS"
+    requests:
+      - input:
+          runtime: ruby
+          files:
+            - name: main.rb
+              type: plain
+              content: |
+                syscall(446, 0, 0, 0)
+        output:
+          status: 200
+          body:
+            compile: null
+            run:
+              stdout: ""
+              stderr: ""
+              output: ""
+              exit_code: 159
+              status: "SIGNAL"
+              signal: "SIGSYS"

internal/sandbox/configs/nsjail.cfg

@@ -1,7 +1,8 @@
 # Static nsjail configuration for the code execution sandbox.
-# All settings here are identical across every invocation. Per-invocation
-# settings (runtime bind mounts, user code directory, resource limits,
-# timeout, environment variables, command) are passed as CLI flags.
+# The user code directory source path varies per request via the
+# NSJAIL_WORKING_DIR environment variable. Other per-invocation settings
+# (runtime bind mounts, resource limits, timeout, environment variables,
+# command) are passed as CLI flags.
 
 # Run the sandboxed process exactly once, then exit.
 mode: ONCE
@@ -181,6 +182,18 @@ mount {
     is_symlink: true
 }
 
+# User code directory (read-write, per-invocation). The source path is set
+# dynamically via the NSJAIL_WORKING_DIR environment variable, which the Go
+# process sets to the per-request temporary directory before launching nsjail.
+mount {
+    prefix_src_env: "NSJAIL_WORKING_DIR"
+    dst: "/code"
+    is_bind: true
+    rw: true
+    nosuid: true
+    nodev: true
+}
+
 # -- UID/GID mapping --
 # Map host UID 0 (root inside the Docker container) to nobody (65534) inside
 # the sandbox. outside_id is omitted, defaulting to "" which resolves to the

internal/sandbox/configs/seccomp.kafel

@@ -195,6 +195,13 @@ POLICY blocked {
         // always wins), but block as defense-in-depth.
         seccomp,
 
+        // -- Landlock LSM (Linux 5.13+) --
+        // Non-privileged access control. Sandboxed code has no legitimate use
+        // for Landlock; block to reduce kernel attack surface.
+        landlock_create_ruleset,
+        landlock_add_rule,
+        landlock_restrict_self,
+
         // -- I/O privilege (x86_64 only) --
         // Direct I/O port access bypasses all OS-level protection.
         ioperm ON x86_64,

internal/sandbox/execution.go

@@ -56,7 +56,6 @@ func (e *execution) buildArgs() []string {
 	}
 
 	args = append(args,
-		"-B", e.tmpDir+":/code", // user code directory (read-write, per-invocation)
 		// Per-invocation resource limits: vary by runtime and execution step.
 		"--rlimit_as", e.limits.Rlimits.AS,
 		"--rlimit_fsize", e.limits.Rlimits.Fsize,
@@ -142,6 +141,7 @@ func (e *execution) closeReadEnds() {
 
 func (e *execution) start(ctx context.Context, args []string) (*exec.Cmd, error) {
 	cmd := exec.CommandContext(ctx, nsjailPath, args...)
+	cmd.Env = append(os.Environ(), "NSJAIL_WORKING_DIR="+e.tmpDir)
 
 	cmd.Stdout = e.stdoutW
 	cmd.Stderr = e.stderrW

internal/sandbox/sandbox_test.go

@@ -133,7 +133,6 @@ func TestExecution_buildArgs(t *testing.T) {
 	want := []string{
 		"-C", "/etc/nsjail/nsjail.cfg",
 		"-R", "/mise/installs/node/24:/mise/installs/node/24",
-		"-B", "/tmp/sandbox-code:/code",
 		"--rlimit_as", "4096",
 		"--rlimit_fsize", "64",
 		"--rlimit_nofile", "64",