Repository navigation
test(windows): deny AppContainer verbatim path reads - #55
Merged
Merged
Conversation
Update the vendored tinybus submodule to the latest upstream commit. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Add a Windows AppContainer test that spawns a child probe to read a file outside the granted roots through a verbatim DOS path, asserting the read is denied and the secret never reaches stdout. This guards against verbatim path prefixes bypassing the AppContainer read restrictions. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
…check Add a host-side read of the verbatim secret path so the test fails clearly if the path cannot be resolved, rather than silently passing when the AppContainer probe is denied for the wrong reason. The probe environment value is now passed as an owned string to match the expected type. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Reformat the println in the AppContainer verbatim path read probe to satisfy rustfmt line width limits. No behaviour change. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Downgrade the zip crate to 2.6.1 and the workspace crates to 0.1.5, and refresh transitive dependencies including crc32fast, log, and getrandom. The lockfile now pulls in arbitrary, derive_arbitrary, and zopfli while dropping typed-path. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
The child probe test no longer returns an io::Result since it only prints probe output and never propagates an error, so the signature and its Ok(()) returns were dropped. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Update the vendored tinybus submodule to the latest upstream commit. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
Upgrade the zip crate from 2.6.1 to 9.0.5, which drops the arbitrary and zopfli dependencies and pulls in typed-path and nix instead. The workspace crates are bumped to 0.1.6 to accompany the dependency update. Auto-committed-on: cuttlefish Co-authored-by: Medulla <medulla@tinyhumans.ai>
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds Windows AppContainer acceptance for a path access form called out in tinybox#27's Windows jail matrix. The existing live test checks an ordinary DOS path outside the granted roots; this test starts the same test binary inside AppContainer and attempts to read the outside file through a
\\?\verbatim DOS path. A host-side read control confirms the alias resolves before the confined child is launched. The child must report an access error and never print the secret contents.Windows CPU remains typed
Unsupported; no CPU enforcement is added.Validation:
cargo fmt --all -- --checkgit diff --checkCC_x86_64_pc_windows_gnu=x86_64-w64-mingw32-gcc AR_x86_64_pc_windows_gnu=x86_64-w64-mingw32-ar ../../scripts/ci-cancel-aware.sh cargo check --locked --offline --target x86_64-pc-windows-gnu -p tinybox-jail --testsThe Windows runtime assertion needs the hosted Windows acceptance jobs. A local MSVC-target check could not run because
lib.exeis unavailable. The cross-target Clippy attempt also reported existing findings inwindows_tests.rsoutside this change (appcontainer_owned_termination_stops_descendants_after_parent_exitand its_parent_stdout/_parent_stderrbindings); the added probe's unnecessary return warning was fixed.Refs tinyhumansai#27
Part of tinyhumansai/openhuman#7328