feat(sandbox): enforce CDI policy in workload boundary

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

crates/openshell-core/src/cdi.rs

@@ -105,6 +105,8 @@ pub enum CdiError {
     WritableMountNotFile { path: String, kind: String },
     #[error("CDI device node '{path}' must target a character or block device, found {kind}")]
     DeviceNodeNotDevice { path: String, kind: String },
+    #[error("CDI read-only path '{path}' does not exist in the workload namespace")]
+    ReadOnlyPathMissing { path: String },
     #[error("CDI additionalGids must not contain root GID 0")]
     RootAdditionalGid,
     #[error("CDI mount '{path}' has conflicting ro/rw options")]

crates/openshell-core/src/cdi_linux.rs

@@ -183,6 +183,11 @@ where
             });
         }
     }
+    for path in &requirements.read_only_paths {
+        if path_kind(path).is_none() {
+            return Err(CdiError::ReadOnlyPathMissing { path: path.clone() });
+        }
+    }
     for path in &requirements.read_write_mount_paths {
         if !normalized_allowlist.contains(path) {
             return Err(CdiError::WritableMountNotAllowed { path: path.clone() });
@@ -445,12 +450,8 @@ mod tests {
         let dir = tempfile::tempdir().unwrap();
         write_spec(dir.path(), "nvidia.yaml", spec);
 
-        let requirements = resolve_with_kind(
-            &context(dir.path(), &["nvidia.com/gpu=all"]),
-            &[],
-            fake_device_node,
-        )
-        .unwrap();
+        let requirements =
+            resolve_cdi_context(&context(dir.path(), &["nvidia.com/gpu=all"])).unwrap();
         let baseline = CdiRequirementsBaseline {
             device_node_paths: &requirements.device_node_paths,
             read_only_paths: &requirements.read_only_paths,
@@ -507,12 +508,8 @@ devices:
 "#,
         );
 
-        let requirements = resolve_with_kind(
-            &context(dir.path(), &["nvidia.com/gpu=0"]),
-            &[],
-            fake_device_node,
-        )
-        .unwrap();
+        let requirements =
+            resolve_cdi_context(&context(dir.path(), &["nvidia.com/gpu=0"])).unwrap();
 
         assert_eq!(
             requirements.device_node_paths,
@@ -540,12 +537,8 @@ devices:
 ",
         );
 
-        let requirements = resolve_with_kind(
-            &context(dir.path(), &["nvidia.com/gpu=all"]),
-            &[],
-            fake_device_node,
-        )
-        .unwrap();
+        let requirements =
+            resolve_cdi_context(&context(dir.path(), &["nvidia.com/gpu=all"])).unwrap();
 
         assert_eq!(
             requirements.device_node_paths,
@@ -573,12 +566,8 @@ devices:
 ",
         );
 
-        let requirements = resolve_with_kind(
-            &context(dir.path(), &["nvidia.com/gpu=all"]),
-            &[],
-            fake_device_node,
-        )
-        .unwrap();
+        let requirements =
+            resolve_cdi_context(&context(dir.path(), &["nvidia.com/gpu=all"])).unwrap();
 
         assert_eq!(requirements.device_node_paths, vec!["/dev/dxg"]);
         assert_eq!(requirements.read_only_paths, vec!["/usr/lib/wsl/lib"]);
@@ -618,12 +607,8 @@ devices:
 "#,
         );
 
-        let requirements = resolve_with_kind(
-            &context(dir.path(), &["nvidia.com/gpu=0"]),
-            &[],
-            always_missing,
-        )
-        .unwrap();
+        let requirements =
+            resolve_cdi_context(&context(dir.path(), &["nvidia.com/gpu=0"])).unwrap();
 
         assert_eq!(
             requirements.read_only_paths,
@@ -660,12 +645,8 @@ devices:
 "#,
         );
 
-        let requirements = resolve_with_kind(
-            &context(dir.path(), &["nvidia.com/gpu=0"]),
-            &[],
-            fake_device_node,
-        )
-        .unwrap();
+        let requirements =
+            resolve_cdi_context(&context(dir.path(), &["nvidia.com/gpu=0"])).unwrap();
 
         assert_eq!(requirements.additional_gids, vec![44]);
         assert_eq!(
@@ -950,6 +931,32 @@ devices:
         assert!(matches!(err, CdiError::RootAdditionalGid));
     }
 
+    #[test]
+    fn validates_read_only_paths_in_the_workload_namespace() {
+        let requirements = CdiDerivedRequirements {
+            read_only_paths: vec!["/opt/nvidia/runtime.json".to_string()],
+            ..CdiDerivedRequirements::default()
+        };
+        let writable_file_allowlist = HashSet::<String>::new();
+
+        let err = validate_cdi_requirements_with_path_kind(
+            &requirements,
+            &writable_file_allowlist,
+            always_missing,
+        )
+        .unwrap_err();
+        assert!(matches!(
+            err,
+            CdiError::ReadOnlyPathMissing { path }
+                if path == "/opt/nvidia/runtime.json"
+        ));
+
+        validate_cdi_requirements_with_path_kind(&requirements, &writable_file_allowlist, |_| {
+            Some(CdiPathKind::File)
+        })
+        .unwrap();
+    }
+
     #[test]
     fn rejects_device_node_that_is_not_device() {
         let dir = tempfile::tempdir().unwrap();

crates/openshell-core/src/policy.rs

@@ -83,6 +83,12 @@ pub struct ProcessPolicy {
 
     /// Group name to run the sandboxed process as.
     pub run_as_group: Option<String>,
+
+    /// Linux supplemental groups required from the workload runtime.
+    ///
+    /// Runtime-specific inputs can use different terminology; CDI
+    /// `additionalGids` are converted into this process-level representation.
+    pub supplemental_groups: Vec<u32>,
 }
 
 #[derive(Debug, Clone, Default)]
@@ -185,6 +191,7 @@ impl From<ProtoProcessPolicy> for ProcessPolicy {
             } else {
                 Some(proto.run_as_group)
             },
+            supplemental_groups: Vec::new(),
         }
     }
 }

crates/openshell-driver-docker/src/isolation.rs

@@ -118,6 +118,7 @@ impl DockerBoundarySpec {
                 },
                 resource_claims: resource_claims.clone(),
                 resource_claim_files: BTreeMap::new(),
+                cdi_context: None,
                 workload_identity: self.workload_identity.clone(),
                 outer_fence: outer_fence.clone(),
                 child_env: self.child_env,

crates/openshell-driver-kubernetes/src/isolation.rs

@@ -274,6 +274,7 @@ impl KubernetesSandboxRuntimeBoundarySpec {
                     "kubernetes.workload_pod_uid".to_string(),
                     self.workload_pod_uid_path,
                 )]),
+                cdi_context: None,
                 workload_identity: self.workload_identity.clone(),
                 outer_fence: outer_fence.clone(),
                 child_env: self.child_env,

crates/openshell-driver-podman/src/isolation.rs

@@ -277,6 +277,7 @@ pub fn bootstrap_archives(
         },
         resource_claims: resource_claims.clone(),
         resource_claim_files: BTreeMap::new(),
+        cdi_context: None,
         workload_identity: identity.clone(),
         outer_fence: outer_fence.clone(),
         child_env: child_env.clone(),

crates/openshell-driver-vm/src/isolation/mod.rs

@@ -118,6 +118,7 @@ impl VmBoundarySpec {
                 },
                 resource_claims: resource_claims.clone(),
                 resource_claim_files: BTreeMap::new(),
+                cdi_context: None,
                 workload_identity: workload_identity.clone(),
                 outer_fence: outer_fence.clone(),
                 child_env: self.child_env,

crates/openshell-sandbox-backend/src/boundary_protocol.rs

@@ -510,6 +510,12 @@ pub struct BoundaryConfig {
     /// Downward API. Other drivers may leave the map empty.
     #[serde(default)]
     pub resource_claim_files: std::collections::BTreeMap<String, PathBuf>,
+    /// Driver-protected CDI selection and workload-local specification projections.
+    ///
+    /// The sandbox runtime resolves this context inside the workload mount
+    /// namespace before applying launch-time filesystem controls.
+    #[serde(default)]
+    pub cdi_context: Option<openshell_core::cdi::CdiContext>,
     /// Exact identity already applied by the runtime to the sandbox process.
     pub workload_identity: openshell_isolation_interface::contract::ResolvedWorkloadIdentity,
     /// Backend-neutral projection of the validated outer network fence.
@@ -540,6 +546,7 @@ impl fmt::Debug for BoundaryConfig {
             .field("listener", &self.listener)
             .field("resource_claims", &self.resource_claims)
             .field("resource_claim_files", &self.resource_claim_files)
+            .field("has_cdi_context", &self.cdi_context.is_some())
             .field("workload_identity", &self.workload_identity)
             .field("outer_fence", &self.outer_fence)
             .field("child_env_keys", &self.child_env.keys().collect::<Vec<_>>())
@@ -1191,6 +1198,8 @@ pub struct SandboxPolicyWire {
     pub landlock: LandlockCompatibilityWire,
     pub run_as_user: Option<String>,
     pub run_as_group: Option<String>,
+    #[serde(default)]
+    pub supplemental_groups: Vec<u32>,
 }
 
 impl From<SandboxPolicy> for SandboxPolicyWire {
@@ -1215,6 +1224,7 @@ impl From<SandboxPolicy> for SandboxPolicyWire {
         let ProcessPolicy {
             run_as_user,
             run_as_group,
+            supplemental_groups,
         } = process;
         Self {
             version,
@@ -1226,6 +1236,7 @@ impl From<SandboxPolicy> for SandboxPolicyWire {
             landlock: LandlockCompatibilityWire::from(compatibility),
             run_as_user,
             run_as_group,
+            supplemental_groups,
         }
     }
 }
@@ -1252,6 +1263,7 @@ impl From<SandboxPolicyWire> for SandboxPolicy {
             process: ProcessPolicy {
                 run_as_user: policy.run_as_user,
                 run_as_group: policy.run_as_group,
+                supplemental_groups: policy.supplemental_groups,
             },
         }
     }