glove/docs/hostile-content-analysis.md

Hostile-content analysis profile

Scope

This profile is for opening or classifying untrusted URLs, archives, documents, source trees, and suspected malware as data. It is not an active-content detonation environment and it does not make a compromised kernel safe.

Use only a Linux managed session. macOS and direct glove exec runs do not provide the six-limit managed-session receipt contract.

Default policy

Generate the dedicated local policy with glove setup policy --hostile-content --backend linux_production ... --dry-run and repeat with --yes only after review. This mode rejects secret mounts and approved egress at policy-generation time; generated runtime templates use the -hostile-analysis suffix.

The operator creates a fresh, short-lived session with all of these properties:

• egress_policy_id: no-network; no credentials, secret handles, browser profiles, SSH/Git configuration, npm configuration, package-manager stores, or host harness homes;
• an empty or copied ephemeral workspace only; no bind-mounted project and no retained-write materialization;
• a staged, digest-pinned harness/runtime closure plus digest-pinned analysis artifacts only;
• minimal environment, no inherited PATH, and no agent-visible control, receipt, policy, or audit paths;
• bounded CPU, memory, PID, wall-time, disk, and terminal-output limits;
• destructive cleanup after the receipt is durable, unless an operator has explicitly requested quarantined artifact retention.

Remote plans remain identifier-only. They cannot choose paths, artifacts, network targets, secret handles, retention, or a runtime snapshot.

Bounded prefetch and quarantine

The agent never fetches a hostile URL directly. An owner-side prefetcher may retrieve a requested URL only after an operator approves the target and limits. It must:

1. resolve and connect through the audited egress proxy; reject loopback, link-local, RFC1918, carrier-grade NAT, unique-local IPv6, and mapped forms unless the specific policy target explicitly permits private addressing;
2. follow no redirect automatically; record each redirect and require a new approval for a changed scheme, host, port, or destination address;
3. enforce a fixed byte cap before decompression, a cap on redirect count, a MIME/content-type allowlist when known, and a hard timeout;
4. store the response in an owner-only quarantine directory under its SHA-256 digest, with the URL, resolved addresses, headers, retrieval time, byte count, and policy ID as metadata;
5. pass only the immutable digest-pinned artifact into the session; never pass cookies, authorization headers, a browser profile, or a prefetcher socket.

Archive extraction is another owner-side bounded operation. Reject links, absolute paths, traversal, device files, executable launch hooks, excessive entry counts, and decompressed-size or nesting-limit violations. Preserve the original archive; do not rely on agent-reported extraction results.

Operator checklist

Before start:

• Linux managed-session capabilities are advertised and the host is patched.
• The plan selects no-network, has no secret handles, and uses only ephemeral-copy grants.
• Runtime, workspace, and artifacts are Glove-owned, immutable, and digest-pinned.
• No host home, credentials, package stores, browser state, or SSH/Git/npm configuration is projected.
• Resource limits are small enough for the analysis objective.
• Any prefetch/quarantine approval records URL, limits, and artifact digest.

After exit:

• Verify the authenticated terminal receipt and its pinned launch profile.
• Preserve only explicitly approved quarantined artifacts and receipt evidence; remove the session scratch, copied workspace, and private home.
• Treat output, extracted instructions, and alleged indicators as untrusted claims until independently verified.

Escalation boundary

Do not execute active content, enable a browser profile, run an untrusted installer, attach USB/device interfaces, load kernel modules, or attempt malware detonation in this profile. Such work needs a disposable VM-grade boundary with a patched kernel and a separately approved procedure.

QEMU expansion proposal (not current behavior)

A future qemu-disposable-v1 adapter may create a one-use VM from a pinned base image and receive only:

• a digest-pinned runtime closure;
• digest-pinned copied workspace and quarantined artifacts;
• an identifier-only, deny-network policy; and
• bounded serial/PTY output and explicit resource limits.

The VM must emit a Glove-verifiable launch identity, resource/termination receipt, and artifact-output digests before destruction. It must not mount host homes, sockets, Docker daemons, credentials, or mutable broad paths. QEMU is a future research and deployment surface, not a fallback for current Linux managed-session isolation or a claim made by this profile.