Repository navigation
feat(policy): support Cedar as an alternate sandbox policy language - #4565
vishwa-raman wants to merge 20 commits into
Conversation
|
All contributors have signed the DCO ✍️ ✅ |
9e11281 to
d9df6d3
Compare
|
I have read the DCO document and I hereby sign the DCO. |
|
/ok to test d9df6d3 |
|
/ok to test dd2c70d |
d9df6d3 to
dd2c70d
Compare
|
🌿 Preview your docs: https://nvidia-preview-pr-4565.docs.buildwithfern.com/openshell |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 1. rust-sdk — No explicit risk acceptance found
2. go-sdk — No explicit risk acceptance foundZero-valued
3. typescript-sdk — No explicit risk acceptance foundRegenerating the exported
Review details
Advisory review; publication gates are unchanged. |
vishwa-raman
added
test:e2e
|
Label |
|
Compatibility risk acceptance for the
These fields are the wire representation of RFC 0020 (#4564) and cannot be deferred without deferring the feature. |
|
/ok to test 55b998e |
dd2c70d to
486f456
Compare
|
/ok to test 486f456 |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 1. rust-sdk — Risk explicitly accepted
2. go-sdk — Risk explicitly acceptedZero-valued
3. typescript-sdk — Risk explicitly acceptedRegenerating the exported
Review details
Advisory review; publication gates are unchanged. |
|
/ok to test 4cdee2a |
486f456 to
4cdee2a
Compare
|
/ok to test 77f4818 |
4cdee2a to
77f4818
Compare
|
@vishwa-raman — aggregated panel review of commit I recommend changes before merge and splitting this PR into four PRs. The panel found six code defects and one required documentation update. I verified and deduplicated these through source and caller tracing; the failure scenarios below were not executed locally.
I recommend this split because the PR combines an existing-engine refactor, a new language implementation, feature activation, and example expansion. Those have different review and rollback boundaries.
PRs 1 and 2 can be reviewed independently; PR 3 depends on both. Keep Cedar acceptance and its complete enforcement path together. Splitting CLI, gateway, and supervisor activation into independently enabled changes would create unsafe intermediate states. Tests needed to establish safe enforcement belong with their implementation. The verification review also identified two limits worth addressing:
The panel comprised independent reviews of Cedar semantics, runtime enforcement, authoring/control-plane integration, and the full parity/example corpus, followed by an independent semantic recheck. No additional concrete filesystem widening, token-grant authorization defect, or YAML regression survived verification. New-gateway/old-supervisor compatibility remains unverified. Reviewed head Local diff and syntax checks passed. At review time, exact-head branch CI had passed Rust tests on Linux/macOS and Go/TypeScript SDK checks; integration CI had passed Cedar and MCP-Cedar E2E. Other runtime jobs were still running at the last review check. Rust/Cargo was unavailable locally, so the new failure scenarios still need executable regression tests. Review status: findings. |
77f4818 to
77d3238
Compare
|
/ok to test 77d3238 |
A sandbox policy can be written in Cedar instead of YAML. The format is chosen once per sandbox: YAML policies keep using the Rego engine unchanged, and a .cedar policy makes Cedar the sole authority for network connections, per-request L7 checks, and Landlock filesystem grants. Policy model and validation: - New crates openshell-policy-cedar-schema (canonical Cedar schema) and openshell-policy-cedar (CedarEngine). Policies are validated in strict mode, and shapes that cannot be enforced exactly as written are rejected at submission in the CLI, the gateway, and the supervisor. - Load-time analysis derives Landlock grants, the endpoints and paths inspected per request (@protocol rest, json-rpc, mcp, graphql, websocket, or websocket-graphql, scoped by @path), native TCP endpoints (@transport("tcp")), and policy DNS eligibility, including delimited host globs. - Delimited like gives YAML-style segment globs for hosts, paths, and binaries. It comes from ai-openshell/cedar, pinned by commit, with a matching deny.toml allow-git exception; its Lean specification is ai-openshell/cedar-spec. - The schema declares only what the supervisor populates: NetworkConnect carries no request fields, Process has no workdir, and a has test on an undeclared attribute is rejected. A filesystem permit must list ReadFile with WriteFile, and resource.host_port names an endpoint for policy DNS. - @enforcement("audit") provides audit endpoints and staged audit policies; decisions name policies by their @id annotation. - Request policies match query parameters through context.query tags; repeated keys are evaluated per combination of values, as YAML matches every value. - context.destination_ip restricts the resolved addresses a connection may reach, the Cedar form of allowed_ips. Permits read it only as fixed isInRange lists; connections are evaluated before DNS and again per resolved address, private addresses need an address-constrained permit or an exact host, and always-blocked destinations stay blocked. - context.binary_aliases matches symlinked binaries, resolved inside the container as YAML does, and context.binary_globs holds the glob patterns that match the calling binary or an ancestor, so YAML binary globs translate exactly. - @enforcement("staged") marks a policy that is only compared against the enforced decision; @enforcement("audit") has YAML's audit-endpoint semantics. An HttpRequest policy may name its host with a delimited glob, inspecting every matching host as a YAML wildcard endpoint does. A GraphQL path is authoritative for the requests it parses. A delimited like whose ** touches other characters, and a GraphQL-over-WebSocket message permit without a GraphQL condition, are rejected at load. Integration: - SandboxPolicy gains cedar_policy_source, the gateway-managed provider_credential_rules, and endpoint_settings. Attached providers supply credentials and token grants on requests Cedar allows but never grant access; their allowed_ips only narrow addresses. Provider rules are compiled into Cedar policies tagged with their token-grant owner, so owner selection is decided by Cedar. - The CLI accepts .cedar policies and a separate --middleware file that also carries endpoint settings (TLS skip, body limits, MCP versions, persisted queries) and the process identity; policy get renders the Cedar text, middleware, endpoint settings, process identity, and provider rules. - The gateway rejects format switches, Cedar global policies, and removal of Cedar-derived Landlock grants on live sandboxes. - Cedar sandboxes run without an OPA engine or Rego. The supervisor builds the Cedar engine at startup admission, which owns middleware state and its own generation, commits Cedar, credentials, and middleware together on reload, and applies the policy validation failure mode to Cedar. Every network decision point, including the Windows host proxy, routes through the PolicyEngine enum; Cedar tunnels pin Cedar's generation. Middleware selection is shared Rust, the data both engines hand to the proxy is typed Rust with the Rego output converted at one boundary, and engine-neutral types move out of opa.rs. - The supervisor maps JSON-RPC, MCP, GraphQL, and WebSocket requests into Cedar requests the way the YAML engine sees them: uppercase methods, calls and response frames only in a POST, and one evaluation per call, GraphQL operation, or WebSocket message. - Cedar decisions report the policy DNS records that cover a connection, so transparent TCP correlation works as for YAML. - Cedar support is the default cedar feature of openshell-policy; crates that never handle Cedar policies disable it. The Go SDK carries the new fields. - The RPM vendor archive captures the git source replacement tables cargo vendor prints, so the offline RPM build resolves the Cedar dependency. Testing and documentation: - Unit tests for the Cedar crates and supervisor integration, and an e2e:cedar suite run by mise run e2e and the Docker E2E matrix. - A parity harness runs paired YAML and Cedar policies through both engines. It ports 258 of the 260 existing YAML decision tests; the remaining one that is valid YAML needs a Cedar language change. On Linux, 2,904 of 2,909 cases agree; the 5 differences are deliberate and recorded with their reasons, an evaluation error on either side fails a case, and load rejections are asserted. Token-grant owners match YAML for every shipped provider profile. - Every example and e2e directory with a YAML policy has a Cedar version beside it, and its scripts accept POLICY_FORMAT=cedar; a parity test runs each pair through both engines. - User documentation for Cedar policies, and a crate README. Signed-off-by: Vishwanath Raman <vishwanathr@nvidia.com>
|
/ok to test 15921fc |
77d3238 to
15921fc
Compare
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Keep WebSocket assembly admission shared across tunnels and policy reloads. Derive configured MCP descriptors once for routing and passive endpoint reporting, preserving wildcard selectors, provider ports, and scoped paths. Correct wildcard L7 parity coverage and assert allow/deny behavior on a second host through the relay. Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test cd26841 |
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 32c4ff5 |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 2. rust-sdk — No explicit risk acceptance found
5. typescript-sdk — No explicit risk acceptance foundThe raw generated
Review details
Advisory review; publication gates are unchanged. |
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 3253a33 |
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test b81bd1e |
Compatibility review (advisory)New or updated breaking changes; see the full report for all findings. 6. cli — No explicit risk acceptance found
Review details
Advisory review; publication gates are unchanged. |
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
Signed-off-by: Johnny Greco <jogreco@nvidia.com>
|
/ok to test 2995fb5 |
This branch has not been deployed
2 participants
Summary
Implements RFC 0020 (#4564): a sandbox policy can be written in Cedar instead of YAML, chosen once per sandbox and enforced by Cedar alone. YAML sandboxes are unchanged. Draft while the RFC is under review; it is otherwise complete and verified.
Cedar comes from
ai-openshell/cedar, the project's own Cedar in the OpenShell CNCF workspace, pinned by commit. OpenShell iterates on policy-language features there with the Cedar team (delimitedliketoday, tracked upstream as cedar-policy/rfcs#115), and does not depend on those features reaching the upstream Cedar release.Related Issue
Closes #4411
Changes
openshell-policy-cedar-schemaandopenshell-policy-cedar: the canonical schema, strict validation, load-time analysis (Landlock grants, inspected endpoints and paths, policy DNS eligibility, native TCP, address ranges, binary aliases and globs, query keys), evaluation with audit and staged policies, and the token-grant compiler for provider rules.SandboxPolicyfieldscedar_policy_source,provider_credential_rules(gateway-managed), andendpoint_settings..cedarpolicies, the--middlewarefile (middleware, endpoint settings, process identity), one shared validation, format-switch rejection, and aPolicyEnginethat is OPA or Cedar; a Cedar sandbox builds no OPA engine and shares only typed Rust data with the YAML path.POLICY_FORMAT=cedarin their scripts; thee2e/cedarsuite and its CI matrix entry.docs/how-it-works/policies/cedar.mdx, the middleware configuration page, and the crate README.Testing
-D warnings,cargo deny,mise run pre-commit; unit tests on macOS and Linux; Windows cross-compile of the supervisor network crate; Go SDK CI)mise run e2e:cedar, 26 checks)Checklist
🤖 Generated with Claude Code