{"record":{"id":"0930b87f7ce40500","repo":"xai-org/grok-build","slug":"invaliddata","errorCode":"InvalidData","errorMessage":"invalid bwrap runtime-socket deny handoff: {error}","messagePattern":"invalid bwrap runtime-socket deny handoff: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-sandbox/src/runtime_sockets.rs","lineNumber":80,"sourceCode":"\nfn runtime_socket_deny_paths_for_resolution() -> io::Result<Vec<PathBuf>> {\n    if !(cfg!(target_os = \"linux\") && crate::is_inside_bwrap()) {\n        return materialize_runtime_socket_deny_paths();\n    }\n    runtime_socket_deny_paths_for_context_with_policy(\n        std::env::var(BWRAP_RUNTIME_SOCKET_DENY_ENV_VAR),\n        runtime_socket_deny_paths(),\n    )\n}\n\nfn runtime_socket_deny_paths_for_context_with_policy(\n    handed: Result<String, std::env::VarError>,\n    allowed: Vec<PathBuf>,\n) -> io::Result<Vec<PathBuf>> {\n    match handed {\n        Ok(encoded) => decode_bwrap_runtime_socket_denies_with_policy(&encoded, allowed),\n        Err(std::env::VarError::NotPresent) => Ok(Vec::new()),\n        Err(error) => Err(io::Error::new(\n            io::ErrorKind::InvalidData,\n            format!(\"invalid bwrap runtime-socket deny handoff: {error}\"),\n        )),\n    }\n}\n\n/// Missing candidates are skipped; every other resolution failure is returned.\nfn materialize_runtime_socket_deny_paths_from(\n    candidates: impl IntoIterator<Item = PathBuf>,\n) -> io::Result<Vec<PathBuf>> {\n    let mut paths = Vec::new();\n    for candidate in candidates {\n        let with_context = |error: io::Error| {\n            io::Error::new(\n                error.kind(),\n                format!(\n                    \"could not resolve runtime-socket deny path {}: {error}\",\n                    candidate.display()","sourceCodeStart":62,"sourceCodeEnd":98,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-sandbox/src/runtime_sockets.rs#L62-L98","documentation":"When bwrap (bubblewrap) sandboxing hands its runtime-socket deny list to the inner process via an environment variable, `runtime_socket_deny_paths_for_context_with_policy` reads that variable. `Err(NotPresent)` means no handoff happened and is fine, but any other `VarError` (e.g. `NotUnicode`) means the handoff is malformed, so the function fails with `InvalidData` rather than silently dropping sandbox denies.","triggerScenarios":"Reading the bwrap handoff env var when it exists but contains non-UTF-8 bytes (`std::env::VarError::NotUnicode`), i.e. the variable was set with invalid unicode by the parent process or forged externally.","commonSituations":"A corrupted or tampered environment inside a bubblewrap sandbox; misbehaving wrapper scripts exporting binary garbage into the handoff variable; security tests forging the variable with non-UTF-8 content.","solutions":["Fix whatever sets the handoff env var so it only writes valid UTF-8 (JSON) content","Unset the corrupted env var so the code takes the NotPresent path and re-derives socket denies from policy","Check for environment-forging (the code deliberately fails closed on malformed handoff as a security measure)","Log the `VarError` to identify which var is malformed"],"exampleFix":"// before (shell wrapper)\nexport BWRAP_SOCKET_DENIES=$(printf '\\xff\\xfe garbage')\n// after\nexport BWRAP_SOCKET_DENIES='[\"/run/user/1000/bus\"]'","handlingStrategy":"try-catch","validationCode":"if let Some(v) = std::env::var_os(\"BWRAP_RUNTIME_SOCKET_DENIES\") {\n    if v.to_str().is_none() {\n        eprintln!(\"handoff var contains non-UTF-8 data; unset it\");\n    }\n}","typeGuard":null,"tryCatchPattern":"match runtime_socket_deny_paths_for_resolution(ctx) {\n    Err(e) if e.kind() == io::ErrorKind::InvalidData && e.to_string().starts_with(\"invalid bwrap runtime-socket deny handoff\") => {\n        log::warn!(\"malformed bwrap handoff, falling back to policy discovery\");\n        // recompute denies from policy instead\n    }\n    other => other,\n}","preventionTips":["Only write UTF-8 JSON into the handoff env var","Unset rather than partially clear the variable","Audit wrapper scripts that export the variable"],"tags":["sandbox","bubblewrap","environment","security"],"backgroundTag":"invalid-env-handoff","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}