feat(proxy): secret-injection outbound proxy + faccessat2 syscall fix - #279
Closed
kuangmi-bit wants to merge 2 commits into
Closed
feat(proxy): secret-injection outbound proxy + faccessat2 syscall fix#279kuangmi-bit wants to merge 2 commits into
kuangmi-bit wants to merge 2 commits into
Conversation
added 2 commits
July 21, 2026 12:11
…elists glibc >= 2.33 uses faccessat2 instead of faccessat for access() / faccessat() calls. Without this syscall in the seccomp whitelist, Python os.access(), pathlib.Path.exists(), and Node.js file permission checks fail with EACCES on modern kernels. Affected: Python amd64/arm64, Node.js amd64/arm64 Refs: langgenius#276
…dening Add an HTTP proxy layer that resolves placeholder env-var values into real secrets at the network boundary, so real credentials never enter the agent's process address space. Design: langgenius/dify#39278 Package internal/core/proxy/: - types: ProviderProfile, SecretMapping, DomainRule, InjectionRule - config: LoadConfig + BuildEnv + validation (providers.yaml) - handler: InjectionHandler (http.Handler) + InjectionRoundTripper - StripSecretsFromEnv: replaces real secrets with placeholders Security properties: - Placeholder model: agent sees __secret:<provider>:<env>__ - Domain allowlist: secrets only injected for matching hosts - Structured rejection: 403 on non-allowlisted domains (no silent-strip) - Path traversal prevention: '..' in value_file rejects - Audit logging: every injection/rejection via slog Config (config.yaml): secret_injection: enabled: true providers_path: /etc/dify-sandbox/providers.yaml secret_root: /run/secrets/session-1 Conformance: 12 tests covering fixtures 1-6 from the design doc, plus nil-config passthrough, path traversal, config validation, BuildEnv, StripSecretsFromEnv, and RoundTripper integration.
kuangmi-bit
changed the title
5 tasks
Contributor
|
Will close this one. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes in this PR
1. Secret-Injection Outbound Proxy (new)
Implements the credential-hardening proxy proposed in dify#39278. Real API keys are replaced with placeholders in the agent process and resolved at the network boundary.
New package:
internal/core/proxy/types.go— ProviderProfile, SecretMapping, DomainRule, InjectionRuleconfig.go— providers.yaml parsing, validation, BuildEnvhandler.go— InjectionHandler + InjectionRoundTripper + StripSecretsFromEnvhandler_test.go— 12 conformance tests (covers fixtures 1-6 from review)Security invariants:
2. faccessat2 Seccomp Fix
Adds
faccessat2(syscall 439) to Python and Node.js seccomp whitelists (amd64 + arm64). Fixes "operation not permitted" on glibc ≥ 2.33 (Ubuntu 22.04+, Debian 12+, RHEL 9+).Tests (20 total)