From b1397465eedec67333a37bfd297fecfcd8ca7142 Mon Sep 17 00:00:00 2001 From: "Timothy J. Aveni" Date: Wed, 7 Oct 2026 21:14:55 -0700 Subject: [PATCH] Admit checked restricted artifacts without individual code approvals --- artifacts.nix | 13 +--- build-artifacts.mjs | 45 ++++++++++-- build-service.mjs | 61 ++-------------- restricted-execution/default.nix | 12 ++++ restricted-execution/identity-launcher.c | 88 ++++++++++++++++++++++++ restricted-execution/identity-module.nix | 28 ++++++++ restricted-execution/sandbox.c | 2 +- restricted-execution/service.mjs | 29 +++++--- restricted-execution/service.test.mjs | 18 +++-- restricted-execution/workerd.nix | 4 +- 10 files changed, 209 insertions(+), 91 deletions(-) create mode 100644 restricted-execution/identity-launcher.c create mode 100644 restricted-execution/identity-module.nix diff --git a/artifacts.nix b/artifacts.nix index 735df8e..5249ced 100644 --- a/artifacts.nix +++ b/artifacts.nix @@ -96,18 +96,7 @@ let esbuild = "${pkgs.esbuild}/bin/esbuild"; shell = "${pkgs.runtimeShell}"; serviceAdapter = ./portable-service.mjs; - restricted = - if service.restricted or false then - let - executor = import ./restricted-execution { inherit pkgs core; }; - in - { - runtime = "${executor.runtime}/bin/quixos-restricted-registry"; - sdk = "${executor.sdk}/core.mjs"; - limits = service.limits or { }; - } - else - null; + restrictedSDK = "${(import ./restricted-execution { inherit pkgs core; }).sdk}/core.mjs"; } ); compiled = diff --git a/build-artifacts.mjs b/build-artifacts.mjs index 4715d82..6a71be2 100644 --- a/build-artifacts.mjs +++ b/build-artifacts.mjs @@ -128,8 +128,7 @@ for (const { target, mode, settings } of builds) { const bundlePath = mode === "remote" ? "share/quixos/remote/server/module.mjs" : `share/quixos/portable/${target}/module.mjs`; await fs.mkdir(path.dirname(path.join(output, bundlePath)), { recursive: true }); - const restricted = !!config.restricted && target === "server"; - const coreImport = target === "browser" ? coreURL : restricted ? config.restricted.sdk : coreServer; + const coreImport = target === "browser" ? coreURL : coreServer; const metadata = path.join(work, "bundle-meta.json"); measureBuild("portable-bundle", { package: pkg.revision, target, mode }, () => execFileSync( @@ -137,7 +136,7 @@ for (const { target, mode, settings } of builds) { [ entry, "--bundle", - `--platform=${target === "browser" || restricted ? "browser" : "node"}`, + `--platform=${target === "browser" ? "browser" : "node"}`, "--format=esm", "--minify-whitespace", "--target=es2024", @@ -159,7 +158,7 @@ for (const { target, mode, settings } of builds) { (i) => i.external && i.path !== coreImport && - !(target === "server" && !restricted && builtinModules.includes(i.path.replace(/^node:/, ""))), + !(target === "server" && builtinModules.includes(i.path.replace(/^node:/, ""))), ), ) ) @@ -182,6 +181,44 @@ for (const { target, mode, settings } of builds) { files: [await recordFile(bundlePath, "text/javascript"), ...sharedFiles], }; implementations.push({ ...body, contentDigest: compiler.implementationDigest(body) }); + if (target === "server" && mode !== "remote" && exports.length) { + // A closed candidate is not an eligibility claim. The host checks these + // bytes and its exact qualified SDK before admitting it to the sandbox. + // Keep a normal service implementation for unsupported dependencies. + const restrictedPath = "share/quixos/restricted/module.mjs"; + const sdkPath = "share/quixos/restricted/core.mjs"; + const sdkName = "quixos:restricted-sdk/v1"; + await fs.mkdir(path.dirname(path.join(output, restrictedPath)), { recursive: true }); + await fs.copyFile(config.restrictedSDK, path.join(output, sdkPath)); + measureBuild("restricted-bundle", { package: pkg.revision }, () => + execFileSync( + config.esbuild, + [ + entry, + "--bundle", + "--platform=node", + "--format=esm", + "--minify-whitespace", + "--target=es2024", + `--outfile=${path.join(output, restrictedPath)}`, + `--alias:@quixos/camino-replica-core=${sdkName}`, + `--external:${sdkName}`, + ], + { cwd: work, stdio: "inherit" }, + ), + ); + const restricted = { + id: "restricted-module", + target: "server", + compatibility: "quixos-restricted-module-v1", + path: restrictedPath, + ports: "quixos-transaction-ports-v1", + registryExport: settings.registryExport, + exports, + files: [await recordFile(restrictedPath, "text/javascript"), await recordFile(sdkPath, "text/javascript")], + }; + implementations.push({ ...restricted, contentDigest: compiler.implementationDigest(restricted) }); + } } const components = config.group && !config.components diff --git a/build-service.mjs b/build-service.mjs index 57e2335..a913054 100644 --- a/build-service.mjs +++ b/build-service.mjs @@ -13,62 +13,6 @@ export async function buildService({ recordFile, }) { const relative = compiler.artifactPath; - if (config.restricted) { - if (config.service.entry || pkg.exports.some((e) => e.execution.kind === "remote")) - throw Error( - "Restricted services require portable snapshot/transaction exports; remote/custom services keep their VM path", - ); - const modules = implementations.filter((i) => i.target === "server"); - if (modules.length !== 1 || pkg.exports.some((e) => !modules[0].exports.includes(e.id))) - throw Error("Restricted service requires exactly one checked portable registry covering all exports"); - const limits = config.restricted.limits; - if (!limits || typeof limits !== "object" || Array.isArray(limits)) - throw Error("Restricted limits must be an object"); - if (Object.keys(limits).some((key) => !["deadlineMs", "maxBytes", "maxPortCalls", "maxQueued"].includes(key))) - throw Error("Unknown restricted service limit"); - for (const [key, min, max] of [ - ["deadlineMs", 1, 60000], - ["maxBytes", 1024, 4194304], - ["maxPortCalls", 1, 10000], - ["maxQueued", 0, 64], - ]) - if (limits[key] !== undefined && (!Number.isSafeInteger(limits[key]) || limits[key] < min || limits[key] > max)) - throw Error("Invalid restricted service limit " + key); - await fs.mkdir(path.join(output, "bin"), { recursive: true }); - await fs.mkdir(path.join(output, "share/quixos/service"), { recursive: true }); - const configFile = "share/quixos/service/restricted.json"; - const module = modules[0]; - await fs.writeFile( - path.join(output, configFile), - JSON.stringify({ - module: path.relative("share/quixos/service", module.path), - registryExport: module.registryExport, - exports: module.exports, - sdk: [{ name: config.restricted.sdk, path: config.restricted.sdk }], - ...limits, - }), - ); - await fs.writeFile( - path.join(output, "bin/service"), - `#!${config.shell}\nservice_root=\${0%/*}/..\nexec ${config.restricted.runtime} "$service_root/${configFile}"\n`, - { mode: 0o755 }, - ); - const body = { - id: "service", - target: "server", - compatibility: "quixos-service-v1", - path: "bin/service", - ports: "quixos-transaction-ports-v1", - exports: module.exports, - files: [ - await recordFile("bin/service", "text/x-shellscript"), - await recordFile(configFile, "application/json"), - ...module.files, - ], - }; - implementations.unshift({ ...body, contentDigest: compiler.implementationDigest(body) }); - return; - } if (pkg.exports.length || config.service.entry) { await fs.mkdir(path.join(output, "bin"), { recursive: true }); await fs.mkdir(path.join(output, "share/quixos/service"), { recursive: true }); @@ -78,7 +22,10 @@ export async function buildService({ throw Error("Custom service entry must be JavaScript; use a separate typed/language build before packaging"); serviceEntry = path.join(config.source, relative(config.service.entry)); } else { - const modules = implementations.filter((implementation) => implementation.target === "server"); + const modules = implementations.filter( + (implementation) => + implementation.target === "server" && implementation.compatibility === "quixos-js-module-v1", + ); if (pkg.exports.some((entry) => !modules.some((module) => module.exports.includes(entry.id)))) throw Error("Generated service does not cover every package export; provide a custom service"); if (!modules.length) throw Error("Generated service requires a checked registry"); diff --git a/restricted-execution/default.nix b/restricted-execution/default.nix index 4d12450..0d4a413 100644 --- a/restricted-execution/default.nix +++ b/restricted-execution/default.nix @@ -20,6 +20,17 @@ let runtime = nativeProbe; executable = "${nativeProbe}/bin/probe"; }; + identityLauncher = + pkgs.runCommand "quixos-restricted-identity-launcher" + { + nativeBuildInputs = [ pkgs.stdenv.cc ]; + } + '' + mkdir -p "$out/bin" + $CC -O2 -Wall -Wextra -Werror ${./identity-launcher.c} \ + -DSANDBOX_EXECUTABLE='"${sandbox}/bin/quixos-restricted-sandbox"' \ + -o "$out/bin/quixos-restricted-engine" + ''; # Transaction-port/value adapters do not need the browser's CRDT/Wasm engine. # Keep this surface explicit; it is bundled into checked restricted handlers. sdk = pkgs.runCommand "quixos-restricted-sdk" { nativeBuildInputs = [ pkgs.esbuild ]; } '' @@ -61,6 +72,7 @@ in inherit workerd sandbox + identityLauncher nativeProbeSandbox sdk runtime diff --git a/restricted-execution/identity-launcher.c b/restricted-execution/identity-launcher.c new file mode 100644 index 0000000..296a343 --- /dev/null +++ b/restricted-execution/identity-launcher.c @@ -0,0 +1,88 @@ +#define _GNU_SOURCE +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include +#include + +/* Installed only as a narrowly executable NixOS wrapper. This trusted helper + * accepts no executable, environment, filesystem root or arbitrary UID. The + * caller is platform authority, never a workspace guest or authored Worker. */ +static void fail(const char *message) { + fprintf(stderr, "RESTRICTED_IDENTITY: %s\n", message); + exit(125); +} + +int main(int argc, char **argv) { + const char *root = "/run/quixos-restricted-engines/"; + uid_t caller = getuid(); + gid_t group = getgid(); + struct passwd *owner = getpwnam("quixos-graph"); + if (geteuid() != 0) fail("privileged wrapper unavailable"); + if (!owner) fail("authority identity unavailable"); + if (caller != owner->pw_uid) fail("caller identity mismatch"); + if (argc != 3) fail("invalid arguments"); + char *end; + unsigned long number = strtoul(argv[2], &end, 10); + if (!*argv[2] || *end || number < 610000 || number >= 610064) + fail("invalid engine identity"); + uid_t identity = (uid_t)number; + if (strlen(argv[1]) != strlen(root) + 16 || strncmp(argv[1], root, strlen(root))) + fail("invalid engine directory"); + const char *name = argv[1] + strlen(root); + if (strncmp(name, "qx-engine-", 10) || + strlen(name) != 16 || strspn(name + 10, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789") != 6) + fail("invalid engine directory"); + int parent = open("/run/quixos-restricted-engines", O_RDONLY | O_DIRECTORY | O_NOFOLLOW); + struct stat info; + if (parent < 0 || fstat(parent, &info) || info.st_uid != caller || (info.st_mode & 066)) + fail("invalid engine root"); + int directory = openat(parent, name, O_RDONLY | O_DIRECTORY | O_NOFOLLOW); + if (directory < 0 || fstat(directory, &info) || info.st_uid != caller || (info.st_mode & 077)) + fail("invalid engine owner"); + DIR *entries = fdopendir(dup(directory)); + if (!entries) fail("engine entries"); + struct dirent *entry; + unsigned int files = 0; + while ((entry = readdir(entries))) { + const char *file = entry->d_name; + if (!strcmp(file, ".") || !strcmp(file, "..")) continue; + int socket = !strcmp(file, "broker.sock"); + if ((!socket && strcmp(file, "config.capnp") && strcmp(file, "parent.mjs")) || + fstatat(directory, file, &info, AT_SYMLINK_NOFOLLOW) || info.st_uid != caller || + info.st_nlink != 1 || (socket ? !S_ISSOCK(info.st_mode) : !S_ISREG(info.st_mode)) || + info.st_size > 4 * 1024 * 1024) + fail("unexpected engine file"); + files++; + } + closedir(entries); + if (files != 3) fail("incomplete engine configuration"); + const char *files_to_transfer[] = {"config.capnp", "parent.mjs", "broker.sock"}; + for (size_t i = 0; i < 3; i++) { + if (fchownat(directory, files_to_transfer[i], identity, group, AT_SYMLINK_NOFOLLOW) || + fchmodat(directory, files_to_transfer[i], 0660, 0)) + fail("engine file ownership"); + } + if (fchown(directory, identity, group) || fchmod(directory, 0770)) + fail("engine directory ownership"); + close(directory); + close(parent); + struct rlimit core = {0, 0}; + if (setrlimit(RLIMIT_CORE, &core) || setgroups(0, NULL) || + setresgid(identity, identity, identity) || setresuid(identity, identity, identity) || + prctl(PR_SET_DUMPABLE, 0) || prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) + fail("identity confinement"); + /* The containing directory grants only its owner and authority access. A + * socket created by workerd must also admit authority's different UID/GID. */ + umask(0000); + char *args[] = {SANDBOX_EXECUTABLE, argv[1], NULL}; + clearenv(); + execv(SANDBOX_EXECUTABLE, args); + fail("sandbox launch"); +} diff --git a/restricted-execution/identity-module.nix b/restricted-execution/identity-module.nix new file mode 100644 index 0000000..3aa0ba7 --- /dev/null +++ b/restricted-execution/identity-module.nix @@ -0,0 +1,28 @@ +{ + executor, + enable, + controlGroup, +}: +{ config, lib, ... }: +{ + config = lib.mkIf enable { + assertions = [ + { + assertion = lib.all (user: user.uid == null || user.uid < 610000 || user.uid >= 610064) ( + builtins.attrValues config.users.users + ); + message = "UIDs 610000–610063 are reserved for restricted engine identities."; + } + ]; + systemd.tmpfiles.rules = [ + "d /run/quixos-restricted-engines 0711 quixos-graph ${controlGroup} -" + ]; + security.wrappers.quixos-restricted-engine = { + source = "${executor.identityLauncher}/bin/quixos-restricted-engine"; + owner = "root"; + group = controlGroup; + permissions = "u+rx,g+rx,o-rwx"; + setuid = true; + }; + }; +} diff --git a/restricted-execution/sandbox.c b/restricted-execution/sandbox.c index 775e5e1..b4ee59b 100644 --- a/restricted-execution/sandbox.c +++ b/restricted-execution/sandbox.c @@ -19,7 +19,7 @@ int main(int argc, char **argv) { struct stat info; if (argc != 2 || argv[1][0] != '/' || strstr(argv[1], "/../") || lstat(argv[1], &info) || !S_ISDIR(info.st_mode) || - info.st_uid != getuid() || (info.st_mode & 077)) + info.st_uid != getuid() || (info.st_mode & 007)) fail("invalid engine directory"); char gate; if (read(STDIN_FILENO, &gate, 1) != 1 || gate != 1) diff --git a/restricted-execution/service.mjs b/restricted-execution/service.mjs index b3de72b..c8efc7d 100644 --- a/restricted-execution/service.mjs +++ b/restricted-execution/service.mjs @@ -42,6 +42,8 @@ export class RestrictedEngineBudget { })()); release.attach = resource.attach; release.usage = resource.usage; + release.kill = resource.kill; + release.uid = resource.uid; return release; } catch (error) { this.#leases.delete(lease); @@ -82,6 +84,7 @@ export async function serveRestrictedRegistry(config, io = process) { !absolute(config.worker) || !absolute(config.module) || (config.sandbox !== undefined && !absolute(config.sandbox)) || + (config.sandboxIdentity !== undefined && typeof config.sandboxIdentity !== "boolean") || !/^[$A-Z_a-z][$\w]*$/.test(config.registryExport) || !Array.isArray(config.exports) || !config.exports.length || @@ -280,10 +283,13 @@ export async function serveRestrictedRegistry(config, io = process) { if (index >= 0) idleEngines.splice(index, 1); engine.current = null; if (engine.child?.pid) { - try { - process.kill(-engine.child.pid, "SIGKILL"); - } catch (error) { - if (error.code !== "ESRCH") throw error; + if (engine.release.kill) await engine.release.kill(); + else { + try { + process.kill(-engine.child.pid, "SIGKILL"); + } catch (error) { + if (error.code !== "ESRCH") throw error; + } } await engine.exited; } @@ -397,9 +403,13 @@ export async function serveRestrictedRegistry(config, io = process) { const file = join(engine.directory, "config.capnp"); await writeFile(file, configuration); if (!call.open) return; + if (config.sandboxIdentity && !Number.isSafeInteger(engine.release.uid)) + throw fixedError("RESTRICTED_IDENTITY_UNAVAILABLE"); engine.child = spawn( config.sandbox ?? config.workerd, - config.sandbox ? [engine.directory] : ["serve", "--experimental", file], + config.sandbox + ? [engine.directory, ...(config.sandboxIdentity ? [String(engine.release.uid)] : [])] + : ["serve", "--experimental", file], { detached: true, env: { TZ: "UTC", LANG: "C.UTF-8" }, @@ -414,16 +424,16 @@ export async function serveRestrictedRegistry(config, io = process) { }); engine.child.stdin?.on("error", () => engine.current?.terminate("RESTRICTED_START_FAILED")); call.child = engine.child; - await engine.release.attach?.(engine.child.pid); - if (config.sandbox && call.open) engine.child.stdin.end(Buffer.from([1])); - watchCPU(call); let diagnostics = 0; engine.child.stderr.on("data", (chunk) => { if ((diagnostics += chunk.length) > 65536) { if (engine.current?.open) engine.current.terminate("RESTRICTED_DIAGNOSTIC_LIMIT"); else void destroyEngine(engine).catch(fail); - } + } else config.diagnostics?.(chunk); }); + await engine.release.attach?.(engine.child.pid); + if (config.sandbox && call.open) engine.child.stdin.end(Buffer.from([1])); + watchCPU(call); engine.child.once("error", () => engine.current?.terminate("RESTRICTED_START_FAILED")); void engine.exited.then(() => { if (engine.current?.open) engine.current.terminate("RESTRICTED_ENGINE_EXITED"); @@ -535,6 +545,7 @@ export async function serveRestrictedRegistry(config, io = process) { await finish(call, fixedError("INVOCATION_ENDED"), reply); metrics.completed++; } catch (error) { + config.diagnostics?.(Buffer.from(`RESTRICTED_HOST_ERROR:${error.code ?? error.name}\n`)); if (call.open) { const code = /^RESTRICTED_[A-Z_]+$/.test(error.code ?? "") ? error.code : "RESTRICTED_PACKAGE_FAILED"; await finish(call, error, { invocation: message.invocation, status: "failed", error: { code, message: code } }); diff --git a/restricted-execution/service.test.mjs b/restricted-execution/service.test.mjs index 4cbdbed..b9c258d 100644 --- a/restricted-execution/service.test.mjs +++ b/restricted-execution/service.test.mjs @@ -437,15 +437,21 @@ test("bounded FIFO rejects overload without losing active or queued frames", asy test("queue wait consumes the deadline and cancelled work never reaches its ports", async () => { const f = await fixture( registry("return await channel({portId:'read',action:{kind:'state',primitive:'read'},input:null});"), - { deadlineMs: 350, maxActive: 1 }, + { deadlineMs: 4000, maxActive: 1 }, ); try { const first = f.start(); - await f.receive(); - const queued = f.start(); - const replies = [await f.receive(), await f.receive()]; - assert.deepEqual(new Set(replies.map((x) => x.invocation)), new Set([first.invocation, queued.invocation])); - assert.ok(replies.every((x) => x.error.code === "RESTRICTED_DEADLINE")); + assert.equal((await f.receive()).kind, "port"); + // Expire while the first call is deliberately blocked. Two equal relative + // deadlines let fast startup legitimately begin the queued call first. + const queued = f.start(null, { root: "queued-deadline", deadlineMs: 50, depth: 1, calls: 10 }); + const expired = await f.receive(); + assert.equal(expired.invocation, queued.invocation); + assert.equal(expired.error.code, "RESTRICTED_DEADLINE"); + f.send({ kind: "cancel", ...first }); + const cancelled = await f.receive(); + assert.equal(cancelled.invocation, first.invocation); + assert.equal(cancelled.kind, "cancelled"); const fresh = f.start(); const port = await f.receive(); assert.equal(port.invocation, fresh.invocation); diff --git a/restricted-execution/workerd.nix b/restricted-execution/workerd.nix index 35a1014..7b25035 100644 --- a/restricted-execution/workerd.nix +++ b/restricted-execution/workerd.nix @@ -1,6 +1,6 @@ # Pinned upstream engine. This binary supplies an import/capability boundary; -# production execution additionally requires OS limits and platform approval -# for shared placement, or a workspace VM for unreviewed application code. +# production execution additionally requires the qualified OS identity, +# namespace, syscall, cgroup and invocation-broker boundaries. { pkgs }: let version = "1.20261005.1";