Repository navigation
[Bubblewrap] Keep host resolver sockets out of sandboxes - #1568
Open
Soham Das (SohamDas2021) wants to merge 2 commits into
Open
Soham Das (SohamDas2021) wants to merge 2 commits into
Soham Das (SohamDas2021) wants to merge 2 commits into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6bf5b15-f491-41eb-859b-482d099f51cf
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b6bf5b15-f491-41eb-859b-482d099f51cf
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The resolver directory becomes read-only before sibling policy mount points can be created, causing valid sandbox launches to fail.
1 open issue
What changed in this PR
This PR hardens Bubblewrap’s resolver setup against DNS egress-policy bypasses through host Unix sockets, while retaining the DNS forwarding introduced in #1453.
Changes:
- Replaces automatic resolver-directory mounts with sealed, read-only resolver snapshots and required symlink layouts.
- Integrates snapshot descriptors with sandbox startup and filesystem-policy ordering.
- Adds resolver isolation coverage, Linux CI checks, and backend documentation.
| File | Description |
|---|---|
tests/scripts/run_bwrap_resolver_isolation_test.sh |
Adds resolver isolation and filesystem-policy scenarios. |
tests/scripts/run_bwrap_all_tests.sh |
Registers the resolver isolation suite. |
src/mxc-sdk/src/backends/bubblewrap/common/seccomp_filter.rs |
Reuses the shared descriptor relocation helper. |
src/mxc-sdk/src/backends/bubblewrap/common/resolver_file.rs |
Prepares sealed resolver snapshots and symlink layouts. |
src/mxc-sdk/src/backends/bubblewrap/common/proxy_network.rs |
Shares descriptor handling and updates resolver denial checks. |
src/mxc-sdk/src/backends/bubblewrap/common/mod.rs |
Registers the Linux-only resolver module. |
src/mxc-sdk/src/backends/bubblewrap/common/bwrap_runner.rs |
Integrates resolver mounts and descriptor inheritance. |
src/mxc-sdk/src/backends/bubblewrap/common/bwrap_command.rs |
Removes resolver-directory baseline mounts and accepts snapshot arguments. |
docs/development/build-and-test/ci-validation-infrastructure.md |
Documents resolver validation coverage. |
docs/backends/bwrap/bubblewrap-backend.md |
Explains resolver snapshots, socket isolation, and limitations. |
.github/workflows/Build.Linux.Job.yml |
Adds resolver unit tests to Linux validation. |
Review effort: Balanced
Comment on lines
+115
to
+116
| "--remount-ro".into(), | ||
| parent, |
Comment on lines
+236
to
+237
| if link != destination { | ||
| args.extend(["--symlink".into(), destination, link]); |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📖 Description
Stop automatically exposing host resolver Unix sockets to Bubblewrap sandboxes, closing a DNS egress-policy bypass. Expose only read-only resolver configuration while preserving DNS forwarding, symlink layouts, and filesystem-policy overrides.
🔗 References
Related: #1453.
🔍 Validation
Ubuntu WSL:
src/:cargo test -q -p mxc-sdk --lib bubblewrap::common -- --test-threads=1— 390 passed.bash tests/scripts/run_bwrap_resolver_isolation_test.sh— 31 scenarios passed.run_bwrap_all_tests.shregistry; five sudo/root-dependent suites were not run.✅ Checklist
Cargo.lock, thedependency-feed-checkcheck passes (see pull request builds)📋 Issue Type
GitHub Actions runs the PR validation build automatically. The ADO pipeline
(
MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHubActions build; it runs on merge to
main, and Microsoft reviewers with write access can trigger iton a PR with
/azp run. See pull request builds.If the
dependency-feed-checkcheck fails on a new dependency, the crate must be added tothe feed before the PR can pass. See pull request builds
for the steps.
Microsoft Reviewers: Open in CodeFlow