nono Sandbox Escape via Unix Domain Socket Access (systemd D-Bus)

Technical Analysis

The nono sandbox relies on Landlock and seccomp policies to restrict what a running AI agent process can access on the host. These policies did not account for Unix domain sockets (both concrete filesystem-backed and abstract-namespace sockets), leaving a gap that permits the sandboxed process to connect to the user's systemd D-Bus socket. Since D-Bus is a privileged IPC mechanism used to control systemd units and other system services, an agent or any code it executes (including attacker-controlled tool output or injected instructions) could use this channel to invoke systemd operations outside the sandbox, effectively breaking out of the isolation the sandbox was designed to enforce. The entry point is any AI agent workload running inside nono that can execute arbitrary or attacker-influenced commands; the attacker gains a path from a constrained agent execution context to host-level D-Bus/systemd control, crossing the tool/execution sandbox boundary into the underlying OS.

Affected Systems

nono

Detection Signatures

• Unexpected connections to /run/user/<uid>/bus or abstract-namespace sockets from sandboxed agent processes
• Process execution logs showing dbus-send, gdbus, or busctl invoked from within a nono sandbox
• seccomp/Landlock audit logs showing allowed AF_UNIX socket connect() calls to systemd-related paths
• Anomalous systemd unit start/stop/restart events correlated with agent sandbox process IDs

Remediation Steps

1. 1

   Upgrade nono

   Update to nono version 0.55.0 or later, which patches the Landlock/seccomp policy gap blocking Unix domain socket access.

2. 2

   Restrict D-Bus access

   Where upgrading is not immediately possible, apply additional AppArmor/SELinux policies or network namespace isolation to block access to the systemd user D-Bus socket from agent sandboxes.

3. 3

   Audit sandbox escapes

   Review logs for any prior sandboxed agent processes that connected to Unix domain sockets, especially systemd D-Bus, to detect potential exploitation.

4. 4

   Principle of least privilege for agents

   Run AI agents under dedicated low-privilege users with minimal systemd/D-Bus permissions independent of sandbox enforcement, providing defense in depth.