Repository navigation
Reject relative ProcessContainer filesystem policy paths - #1695
Open
Safet Hrbinic (safmswork) wants to merge 1 commit into
Open
Safet Hrbinic (safmswork) wants to merge 1 commit into
Safet Hrbinic (safmswork) wants to merge 1 commit into
Conversation
Validate all four filesystem policy lists before backend availability checks or native launch, including direct dry-run validation. Add regression-first backend and public SDK coverage, scheduled native controls, and compatibility documentation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 893f07dd-e993-4211-9514-19f718c8eb8f
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The V1 path-validation behavior change needs an explicit maintainer compatibility decision, and validation diagnostics can point callers to the wrong entry after list normalization.
2 open issues
What changed in this PR
This PR tightens ProcessContainer filesystem policy validation within the backend, rejecting relative paths before capability checks or native launch while leaving other backends unchanged.
Changes:
- Validate all four filesystem policy lists, including direct dry-run validation.
- Add backend, public Rust SDK, and native policy-suite regression coverage with readable-file and absolute-deny controls.
- Document caller requirements and the V1 security-servicing compatibility exception.
| File | Description |
|---|---|
tests/scripts/run_processcontainer_policy_tests.ps1 |
Adds native controls and relative-path rejection cases. |
tests/scripts/lib/processcontainer_policy_probe.ps1 |
Adds file-read and denied-access assertions. |
src/mxc-sdk/tests/streaming_processcontainer.rs |
Tests public run/spawn rejection before workload execution. |
src/mxc-sdk/src/backends/process_container/common/probe.rs |
Adapts probe diagnostics to owned rejection messages. |
src/mxc-sdk/src/backends/process_container/common/base_container_runner.rs |
Adds path validation, policy errors, and backend regressions. |
docs/schema.md |
Documents fully qualified filesystem path requirements. |
docs/development/guides/process-container-adding-os-features.md |
Explains backend validation ordering. |
docs/development/build-and-test/ci-validation-infrastructure.md |
Describes native policy-suite regression scenarios. |
docs/development/architecture/versioning.md |
Records the security-servicing compatibility exception. |
Review effort: Balanced
Comment on lines
+473
to
+475
| if let Some(rejection) = Self::filesystem_path_rejection(request) { | ||
| return rejection; | ||
| } |
Comment on lines
+524
to
+525
| if let Some(index) = paths.iter().position(|path| !Path::new(path).is_absolute()) { | ||
| return Some(BaseContainerRequestDecision::InvalidFilesystemPath { field, index }); |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validate all four filesystem policy lists before backend availability checks or native launch, including direct dry-run validation. Add regression-first backend and public SDK coverage, scheduled native controls, and compatibility documentation.
📖 Description
Require fully qualified Windows paths in ProcessContainer's read/write,
read-only, denied, and enumeration-only filesystem policy lists. Reject
unresolved paths before host capability checks and native creation, including
direct backend validation and dry runs. Return a path-specific policy validation
error instead of resolving entries against the launcher or workload directory.
Keep the validation in the ProcessContainer backend. Other backends, published
SDK API shapes, released schemas, and existing absolute-path handling are
unchanged. This is a security-servicing validation fix, not a new feature or API;
no separate feature/API design spec is required. Document the compatibility
exception and caller requirements.
Add backend and public Rust SDK regressions, plus scheduled native policy-suite
coverage with host-readable and absolute-deny controls.
🔗 References
🔍 Validation
✅ Checklist
feature-acceptedCargo.lock, thedependency-feed-checkcheck passes (see pull request builds)📋 Issue Type
Microsoft Reviewers: Open in CodeFlow