trending/OpenShell
1
0
Fork 0
mirror of https://github.com/NVIDIA/OpenShell.git synced 2026-10-21 06:11:31 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix(isolation): harden runtime boundary controls

Browse Source 
Signed-off-by: Drew Newberry <anewberry@nvidia.com>
This commit is contained in:
Drew Newberry
2026-09-11 15:12:15 -07:00
parent 9d0038f979
commit 1f20080b15
2 changed files with 42 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/openshell-isolation-interface/src/linux/child_seccomp.rs
+13
View File
@@ -193,6 +193,7 @@ pub fn prepare(sandbox_tgid: u32) -> io::Result<ChildHardeningProgram> {
for syscall in [
libc::SYS_prlimit64,
libc::SYS_sched_setaffinity,
libc::SYS_sched_setattr,
libc::SYS_sched_setparam,
libc::SYS_sched_setscheduler,
] {
@@ -418,6 +419,18 @@ mod tests {
{
unsafe { libc::_exit(5) };
}
if unsafe {
libc::syscall(
libc::SYS_sched_setattr,
sandbox_tgid,
std::ptr::null::<libc::c_void>(),
0,
)
} != -1
|| io::Error::last_os_error().raw_os_error() != Some(libc::EPERM)
{
unsafe { libc::_exit(11) };
}
if unsafe { libc::fcntl(libc::STDIN_FILENO, libc::F_SETOWN, sandbox_tgid) } != -1
|| io::Error::last_os_error().raw_os_error() != Some(libc::EPERM)
{
crates/openshell-sandbox-backend/src/runtime.rs
+29 -2
View File
@@ -235,7 +235,7 @@ fn tls_client_config(tls: &BoundaryClientTls) -> Result<rustls::ClientConfig, Ba
"supervisor TLS private-key PEM contains no private key".to_string(),
)
})?;
rustls::ClientConfig::builder()
rustls::ClientConfig::builder_with_protocol_versions(&[&rustls::version::TLS13])
.with_root_certificates(roots)
.with_client_auth_cert(certificate_chain, private_key)
.map_err(|error| {
@@ -1733,6 +1733,12 @@ mod tests {
}
fn test_certificate() -> TestCertificate {
test_certificate_with_protocol_versions(&[&rustls::version::TLS13])
}
fn test_certificate_with_protocol_versions(
protocol_versions: &[&'static rustls::SupportedProtocolVersion],
) -> TestCertificate {
let _ = rustls::crypto::ring::default_provider().install_default();
let material = generate_boundary_mutual_tls_material().expect("generate test material");
let certificates = rustls_pemfile::certs(&mut material.sandbox_certificate_pem.as_bytes())
@@ -1752,7 +1758,7 @@ mod tests {
let verifier = rustls::server::WebPkiClientVerifier::builder(Arc::new(client_roots))
.build()
.expect("build client verifier");
let server_config = rustls::ServerConfig::builder()
let server_config = rustls::ServerConfig::builder_with_protocol_versions(protocol_versions)
.with_client_cert_verifier(verifier)
.with_single_cert(certificates, private_key)
.expect("build test TLS server config");
@@ -2015,6 +2021,27 @@ mod tests {
server.abort();
}
#[tokio::test]
async fn tls_tcp_rejects_tls12_only_server() {
let certificate = test_certificate_with_protocol_versions(&[&rustls::version::TLS12]);
let (address, server) = spawn_tls_boundary(certificate.server_config, "a".repeat(32)).await;
let client_config = tls_client_config(&certificate.client_tls).expect("client TLS config");
let server_name =
rustls::pki_types::ServerName::try_from(certificate.client_tls.server_name.clone())
.expect("server name");
let stream = tokio::net::TcpStream::connect(address)
.await
.expect("connect to TLS test server");
assert!(
tokio_rustls::TlsConnector::from(Arc::new(client_config))
.connect(server_name, stream)
.await
.is_err()
);
server.await.expect("TLS test server task");
}
#[tokio::test]
async fn exec_wait_survives_output_loss_and_reattachment() {
let certificate = test_certificate();