kobako 0.28.0 → 0.30.0

data/crates/kobako-wasmtime/src/trap.rs

@@ -7,12 +7,12 @@
 //! pure function over the error's downcast chain so it can be exercised
 //! from `cargo test` without any frontend.
 
-use std::time::Instant;
+use std::time::{Duration, Instant};
 
-use wasmtime::{StoreContextMut, UpdateDeadline};
+use wasmtime::{Store, StoreHookState, UpdateDeadline};
 
 use crate::invocation::Invocation;
-use crate::limiter::MemoryLimitTrap;
+use kobako_runtime::endpoint::MemoryLimitExceeded;
 use kobako_runtime::error::{SetupError, Trap};
 
 /// Marker error returned from the epoch-deadline callback when the
@@ -41,7 +41,7 @@ pub(crate) const NO_TIMEOUT_EPOCH_DELTA: u64 = u64::MAX / 2;
 /// firing; returning the same long extension keeps it inert as a defence
 /// in depth.
 pub(crate) fn epoch_deadline_callback(
-    ctx: StoreContextMut<'_, Invocation>,
+    ctx: StoreHookState<'_, Invocation>,
 ) -> wasmtime::Result<UpdateDeadline> {
     match ctx.data().deadline() {
         Some(deadline) if Instant::now() >= deadline => Err(wasmtime::Error::new(TimeoutTrap)),
@@ -53,13 +53,33 @@ pub(crate) fn epoch_deadline_callback(
 /// The message leaves out the ABI export symbol, so the Sandbox layer can
 /// attach the caller's verb instead. A cap trap carries its own message,
 /// since wasmtime's backtrace framing is noise there.
-pub(crate) fn trap_from(err: wasmtime::Error) -> Trap {
+pub(crate) fn to_trap(err: wasmtime::Error) -> Trap {
+    cap_trap(&err).unwrap_or_else(|| Trap::Other(other_trap_message(&err)))
+}
+
+/// Arm a Store's wall-clock deadline `limit` from now, or none. Epoch
+/// interruption is on engine-wide and a fresh Store's deadline has already
+/// elapsed, so an unbounded Store names one it cannot reach.
+pub(crate) fn arm_deadline(store: &mut Store<Invocation>, limit: Option<Duration>) {
+    store.epoch_deadline_callback(epoch_deadline_callback);
+    store
+        .data_mut()
+        .set_deadline(limit.map(|limit| Instant::now() + limit));
+    store.set_epoch_deadline(if limit.is_some() {
+        1
+    } else {
+        NO_TIMEOUT_EPOCH_DELTA
+    });
+}
+
+/// The cap trap `err` carries, if a cap fired: a setup step that fails
+/// for any other reason words its own message instead.
+pub(crate) fn cap_trap(err: &wasmtime::Error) -> Option<Trap> {
     if let Some(t) = err.downcast_ref::<TimeoutTrap>() {
-        Trap::Timeout(t.to_string())
-    } else if let Some(t) = err.downcast_ref::<MemoryLimitTrap>() {
-        Trap::MemoryLimit(t.to_string())
+        Some(Trap::Timeout(t.to_string()))
     } else {
-        Trap::Other(other_trap_message(&err))
+        err.downcast_ref::<MemoryLimitExceeded>()
+            .map(|t| Trap::MemoryLimit(t.to_string()))
     }
 }
 
@@ -76,23 +96,23 @@ fn other_trap_message(err: &wasmtime::Error) -> String {
     }
 }
 
-/// The template is built before any invocation, so neither cap can fire:
-/// the memory cap is not yet armed and the probe Store's epoch deadline is
-/// out of reach. Every failure here is a setup fault, not a trap.
+/// The template is built before any invocation, so no invocation cap can
+/// fire: the memory cap is not yet armed, and the probe's own setup
+/// deadline is told apart where it fires. Every failure here is a setup
+/// fault, not a trap.
 pub(crate) fn instantiate_err(err: wasmtime::Error) -> SetupError {
     SetupError::Dead(format!("instantiate: {err}"))
 }
 
 #[cfg(test)]
 mod tests {
-    use super::{other_trap_message, trap_from, TimeoutTrap, NO_TIMEOUT_EPOCH_DELTA};
-    use crate::invocation::Invocation;
-    use crate::limiter::MemoryLimitTrap;
+    use super::{other_trap_message, to_trap, TimeoutTrap, NO_TIMEOUT_EPOCH_DELTA};
+    use kobako_runtime::endpoint::MemoryLimitExceeded;
     use kobako_runtime::error::Trap;
 
     // The no-timeout priming delta is added to the engine's current
     // epoch inside wasmtime, and the process-wide ticker advances that
-    // epoch from the first `shared_engine` call on — so the sum must
+    // epoch from the first `load_engine` call on — so the sum must
     // stay in range for a long-lived engine, not just a fresh one.
     // `increment_epoch` stands in for the ticker to make the ticked
     // state deterministic; under debug overflow checks an overflowing
@@ -100,34 +120,34 @@ mod tests {
     // @behavior S-119
     #[test]
     fn no_timeout_delta_survives_a_ticked_engine_epoch() {
-        let engine = crate::cache::shared_engine().expect("shared engine must be constructible");
+        let engine = crate::cache::load_engine().expect("shared engine must be constructible");
         engine.increment_epoch();
-        let mut store = wasmtime::Store::new(engine, Invocation::new(None));
+        let mut store = wasmtime::Store::new(engine, ());
         store.set_epoch_deadline(NO_TIMEOUT_EPOCH_DELTA);
     }
 
     // @behavior OC-032
     #[test]
-    fn trap_from_routes_timeout_trap_to_timeout() {
+    fn to_trap_routes_timeout_trap_to_timeout() {
         let err = wasmtime::Error::new(TimeoutTrap);
         let expected = TimeoutTrap.to_string();
-        assert!(matches!(trap_from(err), Trap::Timeout(msg) if msg == expected));
+        assert!(matches!(to_trap(err), Trap::Timeout(msg) if msg == expected));
     }
 
     // @behavior OC-033
     #[test]
-    fn trap_from_routes_memory_limit_trap_to_memory_limit() {
-        let trap = MemoryLimitTrap::new(1 << 20, 1 << 19);
+    fn to_trap_routes_memory_limit_exceeded_to_memory_limit() {
+        let trap = MemoryLimitExceeded::new(1 << 20, 1 << 19);
         let expected = trap.to_string();
         let err = wasmtime::Error::new(trap);
-        assert!(matches!(trap_from(err), Trap::MemoryLimit(msg) if msg == expected));
+        assert!(matches!(to_trap(err), Trap::MemoryLimit(msg) if msg == expected));
     }
 
     // @behavior OC-028
     #[test]
-    fn trap_from_falls_back_to_other_for_unknown_errors() {
+    fn to_trap_falls_back_to_other_for_unknown_errors() {
         let err = wasmtime::Error::msg("some other wasmtime fault");
-        assert!(matches!(trap_from(err), Trap::Other(_)));
+        assert!(matches!(to_trap(err), Trap::Other(_)));
     }
 
     // A guest hard trap reaches the host as a wasmtime error whose Display is

data/crates/kobako-wasmtime/src/wasi.rs

@@ -0,0 +1,333 @@
+//! The guest's WASI context for one instance: the Preamble on stdin,
+//! a capture pipe for each of stdout and stderr, the ambient authority
+//! the instance's purpose grants, and a preopen for each Mount an
+//! invocation was handed.
+
+use wasmtime_wasi::p1::WasiP1Ctx;
+use wasmtime_wasi::WasiCtxBuilder;
+
+use crate::ambient::{self, Clocks};
+use crate::config::Config;
+use crate::descriptors::Descriptors;
+use kobako_runtime::endpoint;
+use kobako_runtime::error::Trap;
+use std::sync::Arc;
+
+use kobako_runtime::filesystem::{create_pipe_files, PipeInodeInfo};
+use kobako_runtime::grant::Grant;
+use kobako_runtime::mount::Mount;
+use kobako_runtime::profile::Profile;
+use kobako_runtime::security::prepare_creds_within;
+use kobako_runtime::vfs::Cred;
+
+/// The Cred an invocation's Mounts open as: kobako's own rules, then each
+/// module the Driver was built with, its Filesystems holding at most the
+/// memory the Driver allots, as Linux's `prepare_creds` gives a task the
+/// LSMs it booted with.
+fn prepare_creds(config: &Config) -> Arc<Cred> {
+    prepare_creds_within(&config.security, config.memory_limit)
+}
+
+/// One instance's WASI context: its descriptor table, the clocks its
+/// waits pass on, and the capture pipes stdout and stderr write into, so
+/// the captures are read back from the same owner that wired them.
+pub(crate) struct Wasi {
+    ctx: WasiP1Ctx,
+    descriptors: Descriptors,
+    clocks: Clocks,
+    stdout: Arc<PipeInodeInfo>,
+    stderr: Arc<PipeInodeInfo>,
+}
+
+impl Wasi {
+    /// An invocation's context, granting the posture the Sandbox requested
+    /// and presenting each of the invocation's Mounts as a preopen, from
+    /// descriptor 3 in order.
+    pub(crate) fn for_invocation(
+        config: &Config,
+        stdin: Vec<u8>,
+        grants: &[Grant],
+    ) -> Result<Self, Trap> {
+        Self::new(
+            stdin,
+            config.stdout_limit,
+            config.stderr_limit,
+            config.open_file_limit,
+            prepare_creds(config),
+            config.profile,
+            grants.iter().filter_map(to_mount).collect(),
+        )
+    }
+
+    /// A compile's context, at the strongest posture whatever the Sandbox
+    /// requested: compiling the Snippets needs no ambient authority, so
+    /// it is granted none.
+    pub(crate) fn for_compile(config: &Config, stdin: Vec<u8>) -> Result<Self, Trap> {
+        Self::new(
+            stdin,
+            config.stdout_limit,
+            config.stderr_limit,
+            config.open_file_limit,
+            prepare_creds(config),
+            Profile::Hermetic,
+            Vec::new(),
+        )
+    }
+
+    /// The ABI version probe's context. Instantiating it runs the
+    /// artifact's start section, yet reading a version needs no input, no
+    /// ambient authority, and no output: the probe takes an empty stdin, the
+    /// strongest posture, and pipes sized to keep nothing.
+    pub(crate) fn for_probe() -> Result<Self, Trap> {
+        Self::new(
+            Vec::new(),
+            Some(0),
+            Some(0),
+            None,
+            prepare_creds_within(&[], None),
+            Profile::Hermetic,
+            Vec::new(),
+        )
+    }
+
+    /// An uncapped output channel has no ceiling on the host: a guest
+    /// rewriting one buffer grows the pipe, not its own memory.
+    fn new(
+        stdin: Vec<u8>,
+        stdout_limit: Option<usize>,
+        stderr_limit: Option<usize>,
+        open_file_limit: Option<usize>,
+        opener: Arc<Cred>,
+        profile: Profile,
+        mounts: Vec<Mount>,
+    ) -> Result<Self, Trap> {
+        let stdout = PipeInodeInfo::new(endpoint::pipe_capacity(stdout_limit));
+        let stderr = PipeInodeInfo::new(endpoint::pipe_capacity(stderr_limit));
+
+        // stdio lives in kobako's descriptor table, which answers every
+        // call that reads a descriptor (`crate::preview1`); the builder
+        // keeps only what the remaining imports read.
+        let descriptors = Descriptors::new(
+            create_pipe_files(&PipeInodeInfo::from_bytes(stdin), &opener).0,
+            create_pipe_files(&stdout, &opener).1,
+            create_pipe_files(&stderr, &opener).1,
+            mounts,
+            open_file_limit,
+            opener,
+            profile,
+        )
+        .map_err(|err| Trap::Other(format!("a Mount's root did not open: {err:?}")))?;
+
+        let mut builder = WasiCtxBuilder::new();
+        // The profile decides the ambient authority granted: the
+        // hermetic rung denies the preview1 time and entropy imports (see
+        // `ambient`), the permissive rung leaves the live WASI sources.
+        // Ambient filesystem, environment, and network stay absent on both rungs —
+        // the builder grants none unless asked. The exhaustive match makes
+        // a future ladder rung a compile error here, not authority granted
+        // silently.
+        let clocks = match profile {
+            Profile::Hermetic => {
+                builder.wall_clock(ambient::FrozenWallClock);
+                builder.monotonic_clock(ambient::FrozenMonotonicClock);
+                builder.secure_random(ambient::deterministic_rng());
+                Clocks::Frozen
+            }
+            Profile::Permissive => {
+                let monotonic = ambient::LiveMonotonicClock::new();
+                builder.monotonic_clock(monotonic);
+                Clocks::Live(monotonic)
+            }
+        };
+
+        Ok(Self {
+            ctx: builder.build_p1(),
+            descriptors,
+            clocks,
+            stdout,
+            stderr,
+        })
+    }
+
+    pub(crate) fn ctx_mut(&mut self) -> &mut WasiP1Ctx {
+        &mut self.ctx
+    }
+
+    pub(crate) fn descriptors(&self) -> &Descriptors {
+        &self.descriptors
+    }
+
+    pub(crate) fn descriptors_mut(&mut self) -> &mut Descriptors {
+        &mut self.descriptors
+    }
+
+    pub(crate) fn clocks(&self) -> Clocks {
+        self.clocks
+    }
+
+    pub(crate) fn stdout_bytes(&self) -> Vec<u8> {
+        self.stdout.contents()
+    }
+
+    pub(crate) fn stderr_bytes(&self) -> Vec<u8> {
+        self.stderr.contents()
+    }
+}
+
+/// A Mount as this invocation presents it. A kind this driver does not
+/// support has no descriptor to stand behind; `Driver::supports` keeps a
+/// frontend from handing one over.
+fn to_mount(grant: &Grant) -> Option<Mount> {
+    match grant {
+        Grant::Mount(mount) => Some(mount.clone()),
+        _ => None,
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    //! Witness what an invocation's context grants at each profile rung:
+    //! `wasi:clocks` / `wasi:random` frozen under `Hermetic` and live
+    //! under `Permissive`, and no ambient filesystem, environment, or
+    //! socket under either.
+    use wasmtime::{AsContextMut, Module, Store};
+
+    use super::*;
+    use crate::cache::load_engine;
+    use crate::imports;
+    use crate::invocation::Invocation;
+
+    /// Preview1 `errno` for a descriptor the context does not hold.
+    const ERRNO_BADF: i64 = 8;
+
+    /// Preview1 probe with one export per ambient source: `clock_ns`
+    /// reads the realtime clock, `random_word` reads eight entropy bytes,
+    /// `environ_count` counts environment variables, and `prestat_errno`
+    /// / `accept_errno` ask descriptor 3 for a directory and a
+    /// connection. Preview1 numbers preopens from 3, so nothing there
+    /// means no directory and no socket was granted.
+    const PROBE_WAT: &str = r#"
+        (module
+          (import "wasi_snapshot_preview1" "clock_time_get"
+            (func $clock (param i32 i64 i32) (result i32)))
+          (import "wasi_snapshot_preview1" "random_get"
+            (func $random (param i32 i32) (result i32)))
+          (import "wasi_snapshot_preview1" "environ_sizes_get"
+            (func $environ (param i32 i32) (result i32)))
+          (import "wasi_snapshot_preview1" "fd_prestat_get"
+            (func $prestat (param i32 i32) (result i32)))
+          (import "wasi_snapshot_preview1" "sock_accept"
+            (func $accept (param i32 i32 i32) (result i32)))
+          (memory (export "memory") 1)
+          (func (export "clock_ns") (result i64)
+            (drop (call $clock (i32.const 0) (i64.const 1) (i32.const 0)))
+            (i64.load (i32.const 0)))
+          (func (export "random_word") (result i64)
+            (drop (call $random (i32.const 8) (i32.const 8)))
+            (i64.load (i32.const 8)))
+          (func (export "environ_count") (result i64)
+            (drop (call $environ (i32.const 16) (i32.const 20)))
+            (i64.extend_i32_u (i32.load (i32.const 16))))
+          (func (export "prestat_errno") (result i64)
+            (i64.extend_i32_u (call $prestat (i32.const 3) (i32.const 24))))
+          (func (export "accept_errno") (result i64)
+            (i64.extend_i32_u (call $accept (i32.const 3) (i32.const 0) (i32.const 24)))))
+    "#;
+
+    /// Instantiate the probe over an invocation's WASI context built at
+    /// `profile` and return a reader for its exports.
+    fn probe(profile: Profile) -> impl FnMut(&str) -> i64 {
+        let engine = load_engine().expect("shared engine must be constructible");
+        let config = Config {
+            timeout: None,
+            setup_timeout: None,
+            memory_limit: None,
+            stdout_limit: None,
+            stderr_limit: None,
+            open_file_limit: None,
+            profile,
+            security: Vec::new(),
+        };
+        let wasi = Wasi::for_invocation(&config, Vec::new(), &[]).expect("WASI context must build");
+        let mut store = Store::new(engine, Invocation::new(None, wasi));
+        store.set_epoch_deadline(crate::trap::NO_TIMEOUT_EPOCH_DELTA);
+
+        let linker = imports::linker().expect("host imports must link");
+        let module = Module::new(engine, PROBE_WAT).expect("probe module must compile");
+        let instance = linker
+            .instantiate(&mut store, &module)
+            .expect("probe module must instantiate");
+
+        move |name| {
+            instance
+                .get_typed_func::<(), i64>(store.as_context_mut(), name)
+                .expect("probe export must resolve")
+                .call(store.as_context_mut(), ())
+                .expect("probe export must run")
+        }
+    }
+
+    /// Assert that the context built at `profile` grants no ambient
+    /// directory, environment variable, or socket.
+    fn assert_grants_no_ambient_resource(profile: Profile) {
+        let mut read = probe(profile);
+        assert_eq!(
+            read("prestat_errno"),
+            ERRNO_BADF,
+            "a {profile:?} guest's WASI context must preopen no directory"
+        );
+        assert_eq!(
+            read("environ_count"),
+            0,
+            "a {profile:?} guest's WASI context must carry no environment variable"
+        );
+        assert_eq!(
+            read("accept_errno"),
+            ERRNO_BADF,
+            "a {profile:?} guest's WASI context must hold no socket"
+        );
+    }
+
+    // @behavior RT-047 RT-048
+    #[test]
+    fn hermetic_denies_ambient_time_and_entropy() {
+        let mut read = probe(Profile::Hermetic);
+        assert_eq!(
+            read("clock_ns"),
+            0,
+            "a hermetic guest's wasi:clocks must read the Unix epoch, not host time"
+        );
+        assert_eq!(
+            read("random_word"),
+            0,
+            "a hermetic guest's wasi:random must yield the constant stream, not host entropy"
+        );
+    }
+
+    // @behavior RT-049 RT-050
+    #[test]
+    fn permissive_grants_live_ambient_time_and_entropy() {
+        let mut read = probe(Profile::Permissive);
+        assert!(
+            read("clock_ns") > 0,
+            "a permissive guest's wasi:clocks must read live host time"
+        );
+        assert_ne!(
+            read("random_word"),
+            0,
+            "a permissive guest's wasi:random must yield host entropy"
+        );
+    }
+
+    // @behavior RT-067
+    #[test]
+    fn hermetic_grants_no_ambient_resource() {
+        assert_grants_no_ambient_resource(Profile::Hermetic);
+    }
+
+    // @behavior RT-067
+    #[test]
+    fn permissive_grants_no_ambient_resource() {
+        assert_grants_no_ambient_resource(Profile::Permissive);
+    }
+}

data/crates/kobako-wasmtime/tests/integration/compile_posture.rs

@@ -0,0 +1,43 @@
+//! A compile reads no host time or entropy, whatever posture the Sandbox
+//! requested. Compiling runs no script, so the bundled guest has no way to
+//! show what its clock read; a fixture guest whose compile answers the
+//! ambient bytes it read shows it instead.
+
+use std::path::Path;
+
+use kobako_runtime::{Profile, Runtime};
+use kobako_transport::envelope::{Preamble, Snippet, Snippets};
+use kobako_wasmtime::{Config, Driver};
+
+const FIXTURE: &str = concat!(
+    env!("CARGO_MANIFEST_DIR"),
+    "/../../test/fixtures/minimal_compile_ambient.wat"
+);
+
+// @behavior RT-072
+#[test]
+fn a_compile_reads_no_host_time_or_entropy_under_a_permissive_request() {
+    let mut config = Config::default();
+    config.timeout = None;
+    config.setup_timeout = None;
+    config.memory_limit = None;
+    config.stdout_limit = None;
+    config.stderr_limit = None;
+    config.open_file_limit = None;
+    config.profile = Profile::Permissive;
+    let driver = Driver::new(Path::new(FIXTURE), config).expect("the fixture guest must load");
+    let mut preamble = Preamble::default();
+    preamble.snippets = Snippets {
+        entries: vec![Snippet::Source {
+            name: "Only".into(),
+            body: "1".into(),
+        }],
+    };
+
+    assert_eq!(
+        driver.compile(&preamble),
+        Some(vec![vec![0; 16]]),
+        "a permissive request through Driver#compile must read the Unix epoch and the \
+         constant stream, not host time and entropy"
+    );
+}