spec: strengthen filesystem-confinement guidance (§15.7) - #54
Merged
Conversation
Recasts the resource_path confinement guidance as property-normative with mechanisms illustrative, so the guidance states the guarantee a receiving system must provide rather than prescribing one platform's API. - Two normative properties: validation completes before any destructive effect; and under the deployment's stated attacker model, execution causes no filesystem effect outside the confinement boundary and a refused operation leaves the outside unmodified. - Makes the concurrent-mutation threat model a normative prerequisite: the confinement property is undefined without stating which principals may rename, link, or replace objects under the root during an operation. A design sound against a static tree is unsound against a peer that can swap a path component mid-operation. - Explains why resolve-then-open-then-clean-up by path cannot establish the property under concurrent mutation (the open follows a swapped intermediate before any check; cleanup by path acts through the same swapped path), and that descriptor-relative resolution rooted at a trusted directory descriptor, with cleanup relative to a held descriptor, is what satisfies it. Mechanisms are illustrative (openat2/RESOLVE_* on Linux, equivalents elsewhere, plus isolation or a sandbox where an untrusted principal can mutate the tree); no platform API is mandated. - Separates the no-effect-on-refusal property from the atomicity contract for I/O failures after an authorized write begins, so a short write or interrupted syscall is not silently described as mutation-free unless atomic replacement is implemented. Documentation only; no protocol, wire-format, or fixture change. Signed-off-by: chuks <891251+chuks@users.noreply.github.com>
Signed-off-by: chuks <891251+chuks@users.noreply.github.com>
…ance Signed-off-by: chuks <891251+chuks@users.noreply.github.com>
The prior wording scoped the no-effect-on-refusal property to outside the confinement boundary and required validation to complete before any create. That left a gap (a refusal could leave empty intermediate directories inside the root) and contradicted the temp-file-and-rename atomicity mechanism, which necessarily creates an artifact before it commits. Restated so the property attributes effects to the refused operation: - A confinement or policy refusal reached before the write commits leaves no object created by that operation, inside or outside the boundary, modifies or removes no pre-existing object, and writes no payload. - Implementations MAY create temporary or internal artifacts, provided a refusal leaves no externally persistent effect. Cleanup acts only on artifacts this invocation created whose identity still matches what it created and which remain safe to remove, and never traverses or removes an object a concurrent principal substituted. - New conformance obligation: a refusal test must attribute effects to the operation rather than assert blanket snapshot equality. Blanket equality is unsatisfiable under a concurrent mutator and also passes an implementation that leaves partial artifacts behind on refusal. - Mid-commit I/O failure stays under the separate write-atomicity contract. Documentation only; no protocol, wire-format, or fixture change. Signed-off-by: chuks <891251+chuks@users.noreply.github.com>
…mmit ordering) Follow-up to the attribution-aware rewrite: - Conformance: the check "every pre-existing object is unchanged" reintroduced non-attributable blanket equality, which a concurrent adversary can violate by altering a pre-existing object itself. Restated to attribute effects to the refused operation, and the harness must account separately for adversary mutations. - Ordering: property (1) protected only a refusal reached before commit, leaving a loophole where an implementation commits a visible write, then detects a violation and reports the refusal as "after commit." Added a normative ordering rule: all checks that can produce a security, policy, or confinement refusal must complete against the commit objects before the destination write is committed, and an implementation must not commit and then report such a refusal. Staging artifacts remain allowed under the identity-safe cleanup rule. Documentation only; no protocol, wire-format, or fixture change. Signed-off-by: chuks <891251+chuks@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation-only. Recasts the
resource_pathfilesystem-confinement guidance in §15.7 as property-normative, mechanism-illustrative, so it states the guarantee a receiving system must provide rather than prescribing one platform.Change
No protocol, wire-format, or fixture change.
check-release-syncandcheck-readme-syncpass.