mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-11-01 07:53:42 +08:00
Prashant S Khodade
9deb7e6f7b
Address the three blocking findings from the automated review of
NVIDIA/OpenShell#3296 (head 550b81af):
- Already-expired static provider credentials were silently withheld by
the shared resolver before the create-time fail-closed check ran, so
an MXC sandbox could be created without the configured credential
instead of rejecting the request. Track withheld expired keys
separately in ProviderEnvironment so the MXC create-time validator
can still reject them.
- Provider credential environment keys that collided case-insensitively
with each other, or with the reserved TLS trust env vars injected
later, were not validated before staging, producing an ambiguous or
silently overwritten sandbox environment on Windows. Reject these
synchronously at CreateSandbox instead.
- The Global Policy Override docs said the global payload only supplies
dynamic policy fields, but the implementation replaces the complete
effective policy except UI. Corrected the description.
Signed-off-by: Prashant S Khodade <pkhodade@nvidia.com>