feat(sandbox): derive policy from CDI context

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

architecture/security-policy.md

@@ -23,10 +23,20 @@ dynamic and can be hot-reloaded when the new policy validates successfully.
 
 Before applying Landlock, the supervisor enriches baseline filesystem paths that
 the runtime needs. Missing baseline paths are skipped so one absent runtime path
-does not weaken the whole ruleset. When GPU devices are present, GPU baseline
-enrichment adds existing GPU device nodes as read-write paths and promotes
-`/proc` to read-write because CUDA workloads write thread metadata under
-`/proc/<pid>/task/<tid>/comm`.
+does not weaken the whole ruleset. When GPU devices are present without a CDI
+context, GPU baseline enrichment adds existing GPU device nodes as read-write
+paths. GPU sandboxes with CDI context use CDI-derived paths instead of the
+hard-coded GPU baseline. Both paths promote `/proc` to read-write because CUDA
+workloads write thread metadata under `/proc/<pid>/task/<tid>/comm`.
+
+GPU/CDI sandboxes can also carry a supervisor-only CDI context from the compute
+driver. The supervisor resolves selected CDI IDs from mounted CDI specs and
+adds derived device nodes, library mount destinations, and supplemental GIDs
+before agent exec. CDI host paths are ignored for policy. Derived mount
+destinations default to read-only; writable CDI single-file mounts require an
+exact `filesystem_policy.read_write` opt-in, and writable CDI directory mounts
+fail closed. CDI resolution errors are security-relevant startup failures and
+emit OCSF findings.
 
 Landlock rules are tailored to the inode type reported by the already-opened
 path descriptor. Directories retain the requested directory and file rights;

crates/openshell-core/src/cdi.rs

@@ -9,6 +9,12 @@ use serde::{Deserialize, Serialize};
 
 pub const CDI_CONTEXT_VERSION: u32 = 1;
 
+/// Absolute supervisor path for the CDI context file mounted by a compute driver.
+pub const CDI_CONTEXT_PATH: &str = "/run/openshell/supervisor/cdi-context.json";
+
+/// Base supervisor path under which compute drivers mount CDI specification directories.
+pub const CDI_SPEC_DIR_BASE: &str = "/run/openshell/supervisor/cdi-specs";
+
 #[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
 pub struct CdiContext {
     pub version: u32,

crates/openshell-core/src/policy.rs

@@ -83,6 +83,12 @@ pub struct ProcessPolicy {
 
     /// Group name to run the sandboxed process as.
     pub run_as_group: Option<String>,
+
+    /// Linux supplemental groups to apply before dropping privileges.
+    ///
+    /// Runtime-specific inputs can use different terminology; CDI
+    /// `additionalGids` are converted into this process-level representation.
+    pub supplemental_groups: Vec<u32>,
 }
 
 #[derive(Debug, Clone, Default)]
@@ -162,6 +168,7 @@ impl From<ProtoProcessPolicy> for ProcessPolicy {
             } else {
                 Some(proto.run_as_group)
             },
+            supplemental_groups: Vec::new(),
         }
     }
 }