Harden cloud-hypervisor privileged runtime path and add explicit human-review warning

[Copilot]

This change addresses the security review request for the new preview sandbox.agent.runtime: cloud-hypervisor path, where privileged KVM access and newer MCP-gateway topology increase blast radius if misconfigured. It tightens runtime guardrails and adds an explicit compiler-time signal for mandatory human security review.

• KVM access hardening (privileged path)

  • Strengthened host checks to require /dev/kvm as a character device.
  • Added runner UID sanity check (numeric) before ACL mutation.
  • Upgraded ACL verification from implicit access checks to explicit scoped-entry validation for the runner user.

• Bundle extraction and artifact integrity hardening

  • Added pre-extraction archive structure checks to reject unsafe entries (path traversal, absolute paths, symlink/hardlink entries).
  • Extracts with ownership/permission-preserving behavior disabled.
  • Added extracted-file validation to ensure resolved artifacts are regular, non-symlink files within the expected extraction root.

• Governance signal: human review trigger

  • Added a compiler warning when sandbox.agent.runtime: cloud-hypervisor is selected, instructing explicit human security review before merge/rollout.

• Targeted test updates

  • Updated cloud-hypervisor shell-script content tests to assert new KVM and archive hardening checks.
  • Added a focused validator test for the new cloud-hypervisor human-review warning.

# New explicit ACL verification in KVM setup path
acl_output="$(getfacl -cp /dev/kvm || true)"
grep -Eq "^user:${runner_uid}:rw-?$" <<<"${acl_output}" || exit 1

• Fixes [uk-ai-resilience] [UK AI Governance] Security review of new Cloud Hypervisor sandbox runtime (privileged KVM path) #52748

[github-actions]

Great work addressing the security review governance findings for the cloud-hypervisor runtime! 🛡️

This PR demonstrates solid practice for handling privilege escalation risk:

• KVM access hardening with explicit ACL scoping is exactly the right approach for /dev/kvm access control.
• Bundle extraction safety (path traversal checks, symlink rejection, permission constraints) properly raises the bar for artifact integrity.
• Human-review compiler warning creates a clear, enforced checkpoint before any cloud-hypervisor config reaches production.
• Test coverage validates each new check with focused validator and shell-script tests.

The change is tightly scoped, responds to a formal security review request (fixes #52748), and follows the agentic development process. This looks ready for review.

Generated by ✅ Contribution Check · auto · 57.6 AIC · ⌖ 3.6 AIC · ⊞ 8.8K · ◷

[pelikhan]

@lpcox review

[github-actions]

PR Triage

• Category: bug
• Risk: high
• Priority: high (score: 62/100)
• Score breakdown: impact 35/50, urgency 15/30, quality 12/20
• Recommended action: fast_track

Automated triage by PR Triage Agent.

Generated by 🔧 PR Triage Agent · auto · 64.3 AIC · ⌖ 2.94 AIC · ⊞ 7.8K · ◷