secure-exec-sidecar 0.3.0

Native Secure Exec sidecar runtime
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

mod support;

use secure_exec_sidecar::wire::{
    CreateVmRequest, GetSignalStateRequest, GuestRuntimeKind, RequestPayload, ResponsePayload,
    RootFilesystemDescriptor,
};
use std::collections::HashMap;
use support::{
    authenticate_wire, create_vm_wire, new_sidecar, open_session_wire, temp_dir, wire_request,
    wire_session, wire_vm,
};

#[test]
fn sessions_and_vms_reject_cross_connection_access() {
    let mut sidecar = new_sidecar("session-isolation");
    let cwd = temp_dir("session-isolation-cwd");

    let connection_a = authenticate_wire(&mut sidecar, "conn-a");
    let connection_b = authenticate_wire(&mut sidecar, "conn-b");

    let session_a = open_session_wire(&mut sidecar, 2, &connection_a);
    let session_b = open_session_wire(&mut sidecar, 3, &connection_b);
    let session_a_other = open_session_wire(&mut sidecar, 4, &connection_a);
    let (vm_a, _) = create_vm_wire(
        &mut sidecar,
        5,
        &connection_a,
        &session_a,
        GuestRuntimeKind::JavaScript,
        &cwd,
    );

    let session_reject = sidecar
        .dispatch_wire_blocking(wire_request(
            5,
            wire_session(&connection_b, &session_a),
            RequestPayload::CreateVmRequest(CreateVmRequest::legacy_test_config(
                GuestRuntimeKind::JavaScript,
                HashMap::from([(String::from("cwd"), cwd.to_string_lossy().into_owned())]),
                RootFilesystemDescriptor {
                    mode: secure_exec_sidecar::wire::RootFilesystemMode::Ephemeral,
                    disable_default_base_layer: false,
                    lowers: Vec::new(),
                    bootstrap_entries: Vec::new(),
                },
                None,
            )),
        ))
        .expect("dispatch mismatched session create_vm");
    match session_reject.response.payload {
        ResponsePayload::RejectedResponse(response) => {
            assert_eq!(response.code, "invalid_state");
            assert!(response.message.contains("not owned"));
        }
        other => panic!("unexpected session rejection response: {other:?}"),
    }

    let vm_reject = sidecar
        .dispatch_wire_blocking(wire_request(
            7,
            wire_vm(&connection_b, &session_b, &vm_a),
            RequestPayload::GetSignalStateRequest(GetSignalStateRequest {
                process_id: String::from("missing"),
            }),
        ))
        .expect("dispatch mismatched vm signal-state");
    match vm_reject.response.payload {
        ResponsePayload::RejectedResponse(response) => {
            assert_eq!(response.code, "invalid_state");
            assert!(response.message.contains("not owned"));
        }
        other => panic!("unexpected vm rejection response: {other:?}"),
    }

    let same_connection_vm_reject = sidecar
        .dispatch_wire_blocking(wire_request(
            8,
            wire_vm(&connection_a, &session_a_other, &vm_a),
            RequestPayload::GetSignalStateRequest(GetSignalStateRequest {
                process_id: String::from("missing"),
            }),
        ))
        .expect("dispatch same-connection mismatched-session signal-state");
    match same_connection_vm_reject.response.payload {
        ResponsePayload::RejectedResponse(response) => {
            assert_eq!(response.code, "invalid_state");
            assert!(response.message.contains("not owned"));
        }
        other => panic!("unexpected same-connection vm rejection response: {other:?}"),
    }

    let owner_signal_state = sidecar
        .dispatch_wire_blocking(wire_request(
            9,
            wire_vm(&connection_a, &session_a, &vm_a),
            RequestPayload::GetSignalStateRequest(GetSignalStateRequest {
                process_id: String::from("missing"),
            }),
        ))
        .expect("dispatch owner signal-state");
    match owner_signal_state.response.payload {
        ResponsePayload::SignalStateResponse(snapshot) => {
            assert_eq!(snapshot.process_id, "missing");
            assert!(snapshot.handlers.is_empty());
        }
        other => panic!("unexpected owner signal-state response: {other:?}"),
    }
}