Relocate reference binary out of workspace for enhanced isolation and symlink protection

- Move reference binary to a root-only directory (`/opt/programbench/reference`) and replace it with a symlink to prevent unauthorized modifications.
- Harden `test.sh` by dropping symlinks that escape or dangle outside the workspace.
- Ensure verifier image wipes relocated reference binaries for cleanroom guarantees.
- Expand testing to cover relocation, verifier cleanup, and symlink drop logic.

Author: Frame17

src/kotlinai/data/harbor/test.sh

@@ -33,7 +33,25 @@ mkdir -p /logs/verifier
 cd "$WORKSPACE" || exit 1
 
 # --- anti-cheat: drop any prebuilt binary and byte-identical gold copies ---
+# rm -f also removes a leftover ./executable symlink (the agent image exposes the
+# reference only through a symlink to a root-only path; the real bytes never sit
+# under /workspace, so nothing recoverable is dropped here).
 rm -f ./executable
+# Defense-in-depth: the artifact could still ship a crafted symlink (named
+# ./executable or anything else) that points outside /workspace or dangles. Since
+# docker cp copies links verbatim, resolving one during the rebuild could surface
+# out-of-workspace bytes. Drop every workspace symlink whose realpath escapes
+# /workspace (dangling links resolve to nothing and are dropped too). Compare
+# against the resolved realpath of /workspace so a symlinked mount point (e.g.
+# /var -> /private/var) doesn't misclassify a link that stays inside.
+ws_real="$(readlink -f "$WORKSPACE" 2>/dev/null || echo "$WORKSPACE")"
+while IFS= read -r -d '' link; do
+  target="$(readlink -f "$link" 2>/dev/null || true)"
+  case "$target" in
+    "$ws_real"/*) : ;;
+    *) rm -fv "$link" ;;
+  esac
+done < <(find "$WORKSPACE" -type l -print0 2>/dev/null)
 if [ -s "$TESTS_DIR/clean_hashes.txt" ]; then
   pat="$(tr '\n' '|' < "$TESTS_DIR/clean_hashes.txt" | sed 's/|$//')"
   find "$WORKSPACE" -type f -exec sha256sum {} + 2>/dev/null \

src/kotlinai/data/templates/harbor_environment.Dockerfile.j2

@@ -23,6 +23,24 @@ RUN sed -i 's#https://snapshot.ubuntu.com/ubuntu/[0-9TZ]*/#http://archive.ubuntu
     && apt-get install -y --no-install-recommends file ripgrep xxd \
     && rm -rf /var/lib/apt/lists/*
 {% endif %}
+# Reference isolation: the cleanroom bakes the execute-only reference binary at
+# /workspace/executable, but /workspace itself is agent-owned, so the agent can
+# `mv` the file (Unix rename permission is on the containing directory, not the
+# file) and Harbor would copy the renamed bytes out as the artifact. Relocate
+# the real bytes to a root-only directory outside /workspace and leave only a
+# symlink behind: the agent can rename or delete the *link*, never the bytes,
+# and `docker cp` (task.toml keeps artifacts=["/workspace"] with no exclusions)
+# copies the link, not its target. Runs as root before sudo is dropped and
+# before the agent takes ownership of /workspace. Conditional so exports without
+# a bundled reference remain a no-op.
+RUN if [ -f /workspace/executable ] && [ ! -L /workspace/executable ]; then \
+        mkdir -p /opt/programbench/reference \
+        && cp -a /workspace/executable /opt/programbench/reference/executable \
+        && rm -f /workspace/executable \
+        && ln -s /opt/programbench/reference/executable /workspace/executable \
+        && chown -R root:root /opt/programbench/reference \
+        && chmod -R go-w /opt/programbench/reference ; \
+    fi
 # The cleanroom image grants the non-root agent NOPASSWD sudo for apt-get, dpkg,
 # pip, npm, cargo and go — each an arbitrary-code-as-root path (e.g. an apt
 # Pre-Invoke hook), which would hand back the ability to read the execute-only

src/kotlinai/data/templates/harbor_verifier.Dockerfile.j2

@@ -27,8 +27,10 @@ ENV PATH="${KOTLIN_HOME}/bin:${PATH}"
 {% endif %}
 # The separate verifier must not inherit anything the agent left behind: wipe
 # /workspace at build time. Harbor then restores only the handed-off artifacts
-# (the agent's /workspace minus ./executable) on top before test.sh runs.
-RUN rm -rf /workspace && mkdir -p /workspace
+# (the agent's /workspace minus ./executable) on top before test.sh runs. Also
+# wipe /opt/programbench/reference (where the environment image relocated the
+# real reference binary) so the verifier image holds no recoverable copy either.
+RUN rm -rf /workspace /opt/programbench/reference && mkdir -p /workspace
 WORKDIR /workspace
 # In separate-verifier mode Harbor does not upload the tests dir (the verifier
 # runs with skip_tests_upload=True), so the image must own /tests: bake in

tests/test_harbor.py

@@ -167,6 +167,50 @@ def test_agent_image_ships_inspection_tools_and_drops_sudo(tmp_path):
     assert "rm -f /etc/sudoers.d/agent-packages" in dockerfile
 
 
+def test_environment_image_relocates_reference_out_of_workspace(tmp_path):
+    out = convert_instance(_calc_instance(), tmp_path, target_language="Kotlin")
+    dockerfile = (out / "environment" / "Dockerfile").read_text()
+
+    # The real reference bytes are copied to a root-only dir outside /workspace,
+    # the original is dropped, and only a symlink is left in its place.
+    assert "cp -a /workspace/executable /opt/programbench/reference/executable" in dockerfile
+    assert "rm -f /workspace/executable" in dockerfile
+    assert "ln -s /opt/programbench/reference/executable /workspace/executable" in dockerfile
+    # The relocated dir/file is root-owned and not group/other writable, so the
+    # agent (who owns /workspace) can only rename/delete the symlink, not the bytes.
+    assert "chown -R root:root /opt/programbench/reference" in dockerfile
+    assert "chmod -R go-w /opt/programbench/reference" in dockerfile
+    # Conditional so exports without a bundled reference stay a no-op.
+    assert "if [ -f /workspace/executable ] && [ ! -L /workspace/executable ]; then" in dockerfile
+
+    # The relocation must run as root before sudo is dropped (otherwise the
+    # chown/relocate could no longer be guaranteed to run privileged).
+    assert dockerfile.index("cp -a /workspace/executable") < dockerfile.index(
+        "rm -f /etc/sudoers.d/agent-packages"
+    )
+
+
+def test_verifier_image_wipes_relocated_reference(tmp_path):
+    out = convert_instance(_calc_instance(), tmp_path, target_language="Kotlin")
+    verifier_dockerfile = (out / "tests" / "Dockerfile").read_text()
+
+    # The verifier wipes both /workspace and the relocated reference dir so no
+    # recoverable copy of the reference survives on the verification side either.
+    assert "rm -rf /workspace /opt/programbench/reference" in verifier_dockerfile
+
+
+def test_test_sh_drops_escaping_and_dangling_symlinks(tmp_path):
+    test_sh = (harbor.HARBOR_DATA / "test.sh").read_text()
+
+    # Still drops a leftover ./executable (now possibly a symlink).
+    assert "rm -f ./executable" in test_sh
+    # Hardened cleanup: resolve every workspace symlink and drop any whose
+    # realpath escapes /workspace (dangling links resolve to nothing => dropped).
+    assert 'find "$WORKSPACE" -type l -print0' in test_sh
+    assert 'target="$(readlink -f "$link" 2>/dev/null || true)"' in test_sh
+    assert '"$ws_real"/*) : ;;' in test_sh
+
+
 def test_convert_instance_exports_root_agent_for_oracle_verification(tmp_path):
     out = convert_instance(_calc_instance(), tmp_path, agent_user="root")