feat(ses,pass-style): use non-trapping integrity trait for safety #2675

erights · 2024-12-31T21:58:56Z

Staged on #2673

Closes: #XXXX
Refs: #XXXX

Description

Use of the non-trapping integrity level, as provided by the ponyfill and shim at #2673 , for additional safety of both the ses-shim and @endo/pass-style.

Extends permits.js to permit the extra properties introduced by feat(non-trapping-shim): shim of the non-trapping integrity trait #2673 . This includes both
- the trap support ({Object,Reflect}.{isNoTrapping,suppressTrapping})
Modify harden to suppressTrapping at each step, rather than merely freeze
Modify passStyleOf so that it checks isNoTrapping where it currently checks isFrozen.

Security Considerations

The point. By having passStyleOf ensure that copyData (copyList, copyRecord, tagged) is non-trapping, we enable programming patterns that check this pass-style early on suspect parameters. Once those checks pass, we now know we can operate on such copy-data within the function body without the possibility that these operations cause interleaving with foreign code, and thus without vulnerability to reentrancy hazards or attacks.

Scaling Considerations

In addition to those documented at #2673:

Until we get the native harden of XS to do suppressTrapping at each step, we need to remove the shortcut to use the native harden if there is one. This will be expensive. Likely too expensive to use in production.
In fact, avoiding the native hardener is so expensive that for this PR to proceed at all, the main changes will need to be switched by a new config option, likely starting with a default of off.
fix(ses): dont use native harden #2677 doesn't use the native harden, but its CI shows a bunch of resulting errors to be understood and fixed.

Documentation Considerations

Other than those documented at #2673, none

Testing Considerations

Because our checks for acyclic package dependencies does not distinguish between dependencies and devDependencies, if we want to continue to use ses-ava to test @endo/non-trapping-shim, but also have ses depend on @endo/non-trapping-shim for enhancing harden, we will need to move the @endo/non-trapping-shim tests somewhere else. Or find another way to avoid the package-dependency-cycle diagnostic.
We should also write tests that fail with the prior freeze-only harden behavior, especially tests that demonstrate reentrancy attacks, and see that those test newly pass with this PR.

Compatibility Considerations

In addition to those documented at #2673:

Proxies on frozen almost-empty targets often still do useful work in their trap handlers. This is because get and has, for example, if about non-own property names, are still general traps. In addition, apply can ignore the call behavior of its target and just do its own thing. For these cases, we need to be careful not to harden the target or proxy. We need to find and convert these cases to explicitly freeze.

Going the other way, some tests would freeze some inputs to passStyleOf, depending on these freeze calls to make the known-input-structure hardened, or hardened enough. But now that passStyleOf requires non-trapping, this should usually be changed to harden.

Upgrade Considerations

Other than those documented at #2673, none

erights · 2025-01-01T03:59:14Z

@michaelfig Adding you as an additional reviewer. Please look at least at the changes to eventual-send and captp. Thanks!

michaelfig

Your changes to eventual-send and captp LGTM.

Is it too late to change all occurrences of "no-trapping" to "non-trapping"? That would be more consistent with other terms in the integrity levels, like "non-frozen".

packages/captp/src/captp.js

packages/eventual-send/src/E.js

erights · 2025-01-03T00:36:39Z

Is it too late to change all occurrences of "no-trapping" to "non-trapping"? That would be more consistent with other terms in the integrity levels, like "non-frozen".

Done.

mhofman

So I have 2 concerns after looking at this PR and its adoption in agoric-sdk (Agoric/agoric-sdk#10795):

Given the early nature of the non-trapping proposal, I would like SES and endo packages to avoid taking a hard dependency on it. Can we instead feature detect and use non-trapping only if available? Then we can move the shim application to @endo/init?
The changes to harden (and to some extend passStyleOf) are presenting a potential upgrade hazard. We generally consider harden to be part of the platform, which means it may get upgraded independently of the code using it. The problem is that we have some code with harden usages that are no longer valid after this change: any code that was hardening proxies or their target. That means we will not be able to use the same user code with updated XS and/or lockdown bundles that include this change. I am really not sure how we work around this one, besides accepting this breaking change / incompatibility, and require that platforms like agoric-sdk use "repaired" lockdown bundles to skip/undo this change if it needs to load incompatible user code.

packages/pass-style/src/passStyleOf.js

mhofman · 2025-01-05T01:45:50Z

packages/ses/package.json

@@ -85,7 +85,8 @@
    "postpack": "git clean -f '*.d.ts*' '*.tsbuildinfo'"
  },
  "dependencies": {
-    "@endo/env-options": "workspace:^"
+    "@endo/env-options": "workspace:^",
+    "@endo/non-trapping-shim": "^0.1.0"


Suggested change

"@endo/non-trapping-shim": "^0.1.0"

"@endo/non-trapping-shim": "workspace:^"

This might also explain the issues you're trying to work around in #2684

mhofman · 2025-01-05T01:48:20Z

packages/ses/src/commons.js

+import '@endo/non-trapping-shim/shim.js';
+


I kinda wish we could make SES and other endo packages compatible with the shim having been loaded or not, and then, we could move this from ses to @endo/init, at least until we get more clarity on where the proposal is moving.

mhofman · 2025-01-05T01:50:37Z

packages/ses/src/make-hardener.js

+  // TODO Get the native hardener to suppressTrapping at each step,
+  // rather than freeze. Until then, we cannot use it, which is *expensive*!
+  // TODO Comment out the following to skip the native hardener.


Yeah IMO this is another reason to optionally support non-trapping, as it's currently incompatible with a native hardener.

mhofman · 2025-01-05T01:53:21Z

packages/ses/src/make-hardener.js

          freezeTypedArray(obj);
+          if (isFrozen(obj)) {


Should we modify freezeTypedArray to make it return whether the typedArray got fully frozen ?

mhofman · 2025-01-05T01:54:03Z

packages/ses/src/make-hardener.js

-                    // @ts-expect-error TS should know FERAL_STACK_GETTER
-                    // cannot be `undefined` here.


Very confused why this is no longer necessary.

mhofman · 2025-01-05T01:54:50Z

yarn.lock

The changes to this files are unexpected and would be reverted if the deps of ses above are fixed.

packages/pass-style/test/passStyleOf.test.js

erights · 2025-01-15T20:24:29Z

Converting to draft while we wait for draft #2684 to settle down

Closes: #XXXX Refs: Agoric/agoric-sdk#10795 ## Description Prepare for anticipated introduction and use of the non-trapping integrity trait as explained at https://github.com/endojs/endo/blob/b12eb434b6672f0ceae41be55aac7f24c4562b7b/packages/ses/docs/preparing-for-stabilize.md These preparations must work now, before these traits are introduced, and should continue to work after these traits are introduced and used. ### Security Considerations Some things that had been deeply frozen automatically by `harden` are now manually frozen by explicit calls to `freeze`. We need to review these carefully to ensure that nothing has inadvertently be left unfrozen as a result of the changes in this PR. Some proxies will become unhardenable, but they will still be hardenable as of now, so mistaken hardenings will not be detected. ### Scaling Considerations For this PR by itself, none. Using the shim-based implementation of the non-trapping trait will have scaling consequences: #2675 ### Documentation Considerations https://github.com/endojs/endo/blob/b12eb434b6672f0ceae41be55aac7f24c4562b7b/packages/ses/docs/preparing-for-stabilize.md will need to be reflected in developer docs. ### Testing Considerations Since this PR by itself should be a pure refactor with no observable changes, there is nothing to test at this stage. The testing burden will come with #2675 to see how adequate these preparations were. ### Compatibility Considerations The point. This changes to coding patterns that should be compat both with the current status quo and with #2675 ### Upgrade Considerations As a pure refactor, none.

erights self-assigned this Dec 31, 2024

erights mentioned this pull request Dec 31, 2024

feat(non-trapping-shim): shim of the non-trapping integrity trait #2673

Open

erights force-pushed the markm-use-no-trapping-shim branch from c0354eb to 6bbdc1a Compare December 31, 2024 22:54

erights force-pushed the markm-no-trapping-shim branch from aed8d00 to cb1e1f6 Compare December 31, 2024 23:03

erights force-pushed the markm-use-no-trapping-shim branch from 6bbdc1a to dcf739c Compare December 31, 2024 23:04

erights force-pushed the markm-no-trapping-shim branch from cb1e1f6 to 5c38d8c Compare December 31, 2024 23:11

erights force-pushed the markm-use-no-trapping-shim branch from dcf739c to 128ef21 Compare December 31, 2024 23:11

erights force-pushed the markm-no-trapping-shim branch from 98e6396 to f7d527c Compare January 1, 2025 00:05

erights force-pushed the markm-use-no-trapping-shim branch 2 times, most recently from 7f44397 to dde0022 Compare January 1, 2025 01:26

erights requested review from kriskowal, gibson042 and mhofman January 1, 2025 01:41

erights force-pushed the markm-use-no-trapping-shim branch 7 times, most recently from 49d9dfb to 5bc9589 Compare January 1, 2025 03:09

erights marked this pull request as ready for review January 1, 2025 03:31

erights requested a review from michaelfig January 1, 2025 03:57

erights force-pushed the markm-use-no-trapping-shim branch from c0d1ae2 to 7c0edb8 Compare January 1, 2025 04:29

erights mentioned this pull request Jan 1, 2025

fix(ses): dont use native harden #2677

Draft

michaelfig reviewed Jan 2, 2025

View reviewed changes

packages/captp/src/captp.js Outdated Show resolved Hide resolved

packages/captp/src/captp.js Outdated Show resolved Hide resolved

packages/eventual-send/src/E.js Outdated Show resolved Hide resolved

erights changed the title ~~feat(ses,pass-style): use no-trapping integrity level for safety~~ feat(ses,pass-style): use non-trapping integrity trait for safety Jan 2, 2025

erights force-pushed the markm-no-trapping-shim branch from f7d527c to 29223ef Compare January 2, 2025 21:41

erights mentioned this pull request Jan 2, 2025

refactor: prepare for non-trapping integrity trait #2679

Merged

erights force-pushed the markm-no-trapping-shim branch from 85d55f0 to 0c6aa83 Compare January 2, 2025 23:28

erights force-pushed the markm-no-trapping-shim branch 2 times, most recently from 7bcce04 to 29c9d47 Compare January 2, 2025 23:45

erights force-pushed the markm-use-no-trapping-shim branch 3 times, most recently from e8b5035 to 7f4fb5a Compare January 3, 2025 00:12

erights force-pushed the markm-use-no-trapping-shim branch 3 times, most recently from 0d6fc81 to 60157c5 Compare January 3, 2025 01:13

erights mentioned this pull request Jan 3, 2025

feat(ses,pass-style): use non-trapping integrity trait ponyfill for safety #2681

Closed

erights force-pushed the markm-no-trapping-shim branch from d4c5cfb to 4c095c0 Compare January 3, 2025 19:55

erights force-pushed the markm-use-no-trapping-shim branch from 60157c5 to 82e1233 Compare January 3, 2025 19:55

This was referenced Jan 4, 2025

sham non-trapping shim and ponyfill for cross-repo testing #2683

Draft

sham use of sham non-trapping for cross-repo testing #2684

Draft

refactor: prepare for use of non-trapping integrity trait Agoric/agoric-sdk#10795

Open

mhofman reviewed Jan 5, 2025

View reviewed changes

erights force-pushed the markm-no-trapping-shim branch from 4c095c0 to 191ce45 Compare January 15, 2025 20:03

erights force-pushed the markm-use-no-trapping-shim branch 2 times, most recently from d52d176 to 14a3e2b Compare January 15, 2025 20:14

erights marked this pull request as draft January 15, 2025 20:23

erights force-pushed the markm-no-trapping-shim branch 2 times, most recently from b0a98e3 to 8e5af93 Compare January 15, 2025 22:25

erights force-pushed the markm-use-no-trapping-shim branch from 14a3e2b to 1578716 Compare January 15, 2025 22:36

erights force-pushed the markm-no-trapping-shim branch from 8e5af93 to 10e5356 Compare January 18, 2025 02:41

erights added 2 commits January 17, 2025 18:46

feat(ses,pass-style): use non-trapping integrity level for safety

b79c50f

fixup! reviewer suggestion

c5429af

erights force-pushed the markm-use-no-trapping-shim branch from 1578716 to c5429af Compare January 18, 2025 02:48

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(ses,pass-style): use non-trapping integrity trait for safety #2675

feat(ses,pass-style): use non-trapping integrity trait for safety #2675

erights commented Dec 31, 2024 •

edited

Loading

erights commented Jan 1, 2025

michaelfig left a comment

erights commented Jan 3, 2025 •

edited

Loading

mhofman left a comment

mhofman Jan 5, 2025

mhofman Jan 5, 2025

mhofman Jan 5, 2025

mhofman Jan 5, 2025

mhofman Jan 5, 2025

mhofman Jan 5, 2025

erights commented Jan 15, 2025

	"@endo/non-trapping-shim": "^0.1.0"
	"@endo/non-trapping-shim": "workspace:^"

		// @ts-expect-error TS should know FERAL_STACK_GETTER
		// cannot be `undefined` here.

		import '@endo/non-trapping-shim/shim.js';

feat(ses,pass-style): use non-trapping integrity trait for safety #2675

Are you sure you want to change the base?

feat(ses,pass-style): use non-trapping integrity trait for safety #2675

Conversation

erights commented Dec 31, 2024 • edited Loading

Description

Security Considerations

Scaling Considerations

Documentation Considerations

Testing Considerations

Compatibility Considerations

Upgrade Considerations

erights commented Jan 1, 2025

michaelfig left a comment

Choose a reason for hiding this comment

erights commented Jan 3, 2025 • edited Loading

mhofman left a comment

Choose a reason for hiding this comment

mhofman Jan 5, 2025

Choose a reason for hiding this comment

mhofman Jan 5, 2025

Choose a reason for hiding this comment

mhofman Jan 5, 2025

Choose a reason for hiding this comment

mhofman Jan 5, 2025

Choose a reason for hiding this comment

mhofman Jan 5, 2025

Choose a reason for hiding this comment

mhofman Jan 5, 2025

Choose a reason for hiding this comment

erights commented Jan 15, 2025

erights commented Dec 31, 2024 •

edited

Loading

erights commented Jan 3, 2025 •

edited

Loading