Skip to content

C-WCOW: SecurityPolicy implementation and tests #2508

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ambarve merged 9 commits into from
Sep 19, 2025
Merged

C-WCOW: SecurityPolicy implementation and tests #2508

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
5901338
C-WCOW: Implement SecurityPolicy enforcement
MahatiC Jan 7, 2025
cec74fc
C-WCOW: Add SecurityPolicy tests
MahatiC Jul 14, 2025
3ddb303
C-WCOW: Fix lint errors
MahatiC Aug 27, 2025
e4407ad
C-WCOW: Runtime logging enforcement, misc cleanup
MahatiC Aug 29, 2025
0621400
C-WCOW: CI test and misc cleanup
MahatiC Sep 4, 2025
1b56509
C-WCOW: Remove obsolete policy CI and clean up
MahatiC Sep 4, 2025
d744385
C-WCOW: Use existing policy related function
MahatiC Sep 16, 2025
77fec0e
CWCOW: Fix rebase conflict
MahatiC Sep 18, 2025
24fcf74
C-WCOW: Address review comments
MahatiC Sep 18, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -249,9 +249,6 @@ jobs:
- name: Install gotestsum
run: go install gotest.tools/gotestsum@${{ env.GOTESTSUM_VERSION }}

- name: Test standard security policy
run: ${{ env.GOTESTSUM_CMD }} -timeout=30m -gcflags=all=-d=checkptr ./pkg/securitypolicy/...

- name: Test rego security policy
run: ${{ env.GOTESTSUM_CMD }} -tags=rego -timeout=30m -gcflags=all=-d=checkptr ./pkg/securitypolicy/...

Expand Down Expand Up @@ -314,6 +311,9 @@ jobs:
& '${{ github.workspace }}/bin/psexec' -accepteula -nobanner cmd /c "exit 0"

# run tests
- name: Test rego security policy
run: ${{ env.GOTESTSUM_CMD }} -tags=rego -timeout=30m -gcflags=all=-d=checkptr ./pkg/securitypolicy/...

- name: Test repo
run: ${{ env.GOTESTSUM_CMD }} -gcflags=all=-d=checkptr -tags admin -timeout=20m ./...

Expand Down
3 changes: 1 addition & 2 deletions cmd/gcs-sidecar/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,6 @@ func main() {
logrus.Fatal(err)
}
logrus.SetLevel(level)
logrus.SetOutput(logFileHandle)
trace.ApplyConfig(trace.Config{DefaultSampler: trace.AlwaysSample()})
trace.RegisterExporter(&oc.LogrusExporter{})

Expand Down Expand Up @@ -227,7 +226,7 @@ func main() {
initialEnforcer := &securitypolicy.ClosedDoorSecurityPolicyEnforcer{}

// 3. Create bridge and initializa
brdg := sidecar.NewBridge(shimCon, gcsCon, initialEnforcer)
brdg := sidecar.NewBridge(shimCon, gcsCon, initialEnforcer, logFileHandle)
brdg.AssignHandlers()

// 3. Listen and serve for hcsshim requests.
Expand Down
34 changes: 26 additions & 8 deletions internal/gcs-sidecar/bridge.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,9 @@ import (

type Bridge struct {
mu sync.Mutex
pendingMu sync.Mutex
pending map[sequenceID]*prot.ContainerExecuteProcessResponse

hostState *Host
// List of handlers for handling different rpc message requests.
rpcHandlerList map[prot.RPCProc]HandlerFunc
Expand All @@ -44,6 +47,9 @@ type Bridge struct {
// and send responses back to hcsshim respectively.
sendToGCSCh chan request
sendToShimCh chan bridgeResponse

// logging target
logWriter io.Writer
}

// SequenceID is used to correlate requests and responses.
Expand Down Expand Up @@ -74,22 +80,17 @@ type request struct {
message []byte
}

func NewBridge(shimConn io.ReadWriteCloser, inboxGCSConn io.ReadWriteCloser, initialEnforcer securitypolicy.SecurityPolicyEnforcer) *Bridge {
func NewBridge(shimConn io.ReadWriteCloser, inboxGCSConn io.ReadWriteCloser, initialEnforcer securitypolicy.SecurityPolicyEnforcer, logWriter io.Writer) *Bridge {
hostState := NewHost(initialEnforcer)
return &Bridge{
pending: make(map[sequenceID]*prot.ContainerExecuteProcessResponse),
rpcHandlerList: make(map[prot.RPCProc]HandlerFunc),
hostState: hostState,
shimConn: shimConn,
inboxGCSConn: inboxGCSConn,
sendToGCSCh: make(chan request),
sendToShimCh: make(chan bridgeResponse),
}
}

func NewPolicyEnforcer(initialEnforcer securitypolicy.SecurityPolicyEnforcer) *SecurityPolicyEnforcer {
return &SecurityPolicyEnforcer{
securityPolicyEnforcerSet: false,
securityPolicyEnforcer: initialEnforcer,
logWriter: logWriter,
}
}

Expand Down Expand Up @@ -448,6 +449,23 @@ func (b *Bridge) ListenAndServeShimRequests() error {
_ = sendWithContextCancel(ctx, sidecarErrChan, recverr)
return
}
// If this is a ContainerExecuteProcessResponse, notify

@rawahars rawahars Sep 15, 2025

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Instead of this approach, we can use channels for capturing the process response.
Approach would be-

  • Create a channel on which you write the response to when the same is received in ListenAndServeShimRequests method.
  • Same channel is used in executeProcess method. We listens on the channel with a deadline of 5 seconds. If you don't hear back then return an error message. If we hear back about another exec then we skip and keep waiting for next response.

With this approach, you won't need- b.pending, b.pendingMu and other polling logic.

const MsgExecuteProcessResponse prot.MsgType = prot.MsgTypeResponse | prot.MsgType(prot.RPCExecuteProcess)

if header.Type == MsgExecuteProcessResponse {
logrus.Tracef("Printing after inbox exec resp")
var procResp prot.ContainerExecuteProcessResponse
if err := json.Unmarshal(message, &procResp); err != nil {
logrus.Tracef("unmarshal failed")
}

b.pendingMu.Lock()
if _, exists := b.pending[header.ID]; exists {
logrus.Tracef("Header ID in pending exists")
b.pending[header.ID] = &procResp
}
b.pendingMu.Unlock()
}

// Forward to shim
resp := bridgeResponse{
Expand Down
Loading