mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-25 06:42:52 +08:00
Russell Bryant
c5d1d76d94
Migrate all sandbox and VM driver network policy enforcement from iptables to nftables. nftables provides atomic ruleset loading, a cleaner rule syntax, and is the standard netfilter interface in modern kernels. Sandbox bypass enforcement (openshell-sandbox): - Replace iptables chain of individual rule insertions with a single atomic nftables ruleset load via nft -f - New nft_ruleset module with pure functions for ruleset generation and unit tests - Combine log and reject rules in one inet family table (handles both IPv4 and IPv6 in a single ruleset) - Fall back to reject-only ruleset when kernel lacks nft_log support - Enable net.netfilter.nf_log_all_netns so log rules work from non-init network namespaces - Use temp file for nft ruleset loading instead of stdin for compatibility with minimal VM guest environments VM TAP networking (openshell-driver-vm): - Replace iptables NAT/forwarding rules with nftables equivalents - New nft_ruleset module for TAP network rule generation with unit tests - Atomic table-per-TAP-device lifecycle (create/destroy) - Host-side rules provide NAT infrastructure and defense-in-depth isolation (input chain restricts VM to gateway port only, forward chain blocks unsolicited inbound); primary security enforcement happens inside the VM guest via the sandbox supervisor's own rules VM init script: - Load nft kernel modules at sandbox init - Enable nf_log_all_netns sysctl for bypass detection logging OCSF / docs: - Update firewall rule engine references from iptables to nftables - Document host firewall interaction model and two-layer enforcement architecture in VM driver README and compute drivers reference Closes #1335 Signed-off-by: Russell Bryant <rbryant@redhat.com>
99 lines
2.2 KiB
TOML
99 lines
2.2 KiB
TOML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
[package]
|
|
name = "openshell-sandbox"
|
|
description = "OpenShell process sandbox and monitor"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
rust-version.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[[bin]]
|
|
name = "openshell-sandbox"
|
|
path = "src/main.rs"
|
|
|
|
[dependencies]
|
|
openshell-core = { path = "../openshell-core" }
|
|
openshell-ocsf = { path = "../openshell-ocsf" }
|
|
openshell-policy = { path = "../openshell-policy" }
|
|
openshell-router = { path = "../openshell-router" }
|
|
|
|
# Async runtime
|
|
tokio = { workspace = true }
|
|
|
|
# gRPC
|
|
tonic = { workspace = true, features = ["channel", "tls"] }
|
|
tokio-stream = { workspace = true }
|
|
|
|
# CLI
|
|
clap = { workspace = true }
|
|
|
|
# Error handling
|
|
miette = { workspace = true }
|
|
thiserror = { workspace = true }
|
|
anyhow = { workspace = true }
|
|
hmac = "0.12"
|
|
sha2 = { workspace = true }
|
|
hex = "0.4"
|
|
russh = "0.57"
|
|
rand_core = "0.6"
|
|
|
|
# OPA policy evaluation (no default features — full-opa pulls in opa-runtime which requires git in build)
|
|
regorus = { version = "0.9", default-features = false, features = ["std", "arc", "glob", "yaml"] }
|
|
|
|
# TLS
|
|
tokio-rustls = { workspace = true }
|
|
rustls = { workspace = true }
|
|
rustls-pemfile = { workspace = true }
|
|
rcgen = { workspace = true }
|
|
webpki-roots = { workspace = true }
|
|
|
|
# HTTP
|
|
bytes = { workspace = true }
|
|
|
|
# UUID
|
|
uuid = { workspace = true }
|
|
|
|
# Encoding
|
|
base64 = { workspace = true }
|
|
flate2 = "1"
|
|
sha1 = "0.10"
|
|
|
|
# IP network / CIDR parsing
|
|
ipnet = "2"
|
|
|
|
# Serialization
|
|
serde = { workspace = true }
|
|
serde_json = { workspace = true }
|
|
serde_yml = { workspace = true }
|
|
apollo-parser = { workspace = true }
|
|
glob = { workspace = true }
|
|
|
|
# Logging
|
|
tracing = { workspace = true }
|
|
tracing-subscriber = { workspace = true }
|
|
tracing-appender = { workspace = true }
|
|
|
|
# Unix/Process
|
|
nix = { workspace = true }
|
|
|
|
[target.'cfg(unix)'.dependencies]
|
|
libc = "0.2"
|
|
|
|
[target.'cfg(target_os = "linux")'.dependencies]
|
|
landlock = "0.4"
|
|
seccompiler = "0.5"
|
|
tempfile = "3"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
temp-env = "0.3"
|
|
tokio-tungstenite = { workspace = true }
|
|
futures = { workspace = true }
|
|
|
|
[lints]
|
|
workspace = true
|