hermes - 💡(How to fix) Fix security: code execution sandbox runs with same UID and no seccomp/network isolation [1 pull requests]

Summary

tools/code_execution_tool.py spawns a Python subprocess.Popen with a scrubbed environment, but the child process runs with the same UID/GID as the parent Hermes process. There is no seccomp-bpf, no chroot, no network namespace, and no capability dropping.

Impact

User-supplied Python code (via execute_code) can:

• Read any file the OS user can access (e.g., ~/.ssh/id_rsa, /proc/<ppid>/environ)
• Exfiltrate data over the network
• Dump the parent process memory via /proc/<ppid>/mem
• Install persistence mechanisms (cron jobs, systemd units, SSH keys)
• Spawn additional processes outside the agent's control

Recommendation

Run execute_code in a proper sandbox:

• Docker container with --network=none, limited volume mounts, a seccomp profile, and AppArmor/SELinux labels
• At minimum: use a separate unprivileged user, a chroot jail, and drop all unnecessary capabilities
• Consider using gVisor, Firecracker, or nsjail for stronger isolation

Files

• tools/code_execution_tool.py
• tools/environments/local.py

Severity: HIGH