Fix various bugs CoPilot put into LXC.

.github/workflows/SDK.Integration.Test.Job.yml

@@ -180,18 +180,6 @@ jobs:
           sudo systemctl start lxc-net
           sudo systemctl is-active --quiet lxc-net
 
-      # A bridged veth reaches the LXC firewall chain only while br_netfilter
-      # delivers bridged packets to iptables, and the backend refuses to
-      # report success for a policy it cannot enforce.
-      - name: Enable bridge netfilter
-        if: matrix.os_label == 'linux'
-        shell: bash
-        run: |
-          set -euo pipefail
-          sudo modprobe br_netfilter
-          sudo sysctl -w net.bridge.bridge-nf-call-iptables=1
-          sudo sysctl -w net.bridge.bridge-nf-call-ip6tables=1
-
       - name: Restore execute permission on mxc-exec-mac
         if: matrix.os_label == 'macos'
         shell: bash

.github/workflows/lxc-e2e.yml

@@ -36,16 +36,6 @@ jobs:
           sudo DEBIAN_FRONTEND=noninteractive apt-get install -y \
             lxc lxc-templates lxc-utils iptables debootstrap uidmap bridge-utils
 
-      # A bridged veth only reaches the FORWARD chain while br_netfilter is
-      # delivering bridged packets to iptables. Without it the firewall rules
-      # install cleanly and never fire, so the network policy tests would pass
-      # against a firewall that filters nothing.
-      - name: Enable bridge netfilter
-        run: |
-          sudo modprobe br_netfilter
-          sudo sysctl -w net.bridge.bridge-nf-call-iptables=1
-          sudo sysctl -w net.bridge.bridge-nf-call-ip6tables=1
-
       # GitHub-hosted runners ship Docker, and Docker sets the IPv4 FORWARD
       # policy to DROP. That breaks these tests twice over.
       #
@@ -95,9 +85,6 @@ jobs:
           echo "--- forward policy (must be ACCEPT, or deny cases pass vacuously) ---"
           sudo iptables -S FORWARD | head -1
           sudo ip6tables -S FORWARD | head -1
-          echo "--- bridge netfilter ---"
-          cat /proc/sys/net/bridge/bridge-nf-call-iptables || echo "MISSING bridge-nf-call-iptables"
-          cat /proc/sys/net/bridge/bridge-nf-call-ip6tables || echo "MISSING bridge-nf-call-ip6tables"
           echo "--- host ipv6 ---"
           cat /proc/net/if_inet6 || echo "no /proc/net/if_inet6 (IPv6 disabled)"
 
@@ -118,6 +105,15 @@ jobs:
           MXC_LXC_TESTS_REQUIRE_EXECUTION: "1"
         run: sudo --preserve-env=MXC_LXC_TESTS_REQUIRE_EXECUTION bash tests/scripts/run_lxc_all_tests.sh
 
+      # The shell suite above does not cover the capability confinement, and the
+      # Linux build lane runs this crate without LXC installed, so these tests
+      # skip everywhere else.
+      - name: Run LXC Rust E2E tests
+        working-directory: src
+        env:
+          MXC_LXC_TESTS_REQUIRE_EXECUTION: "1"
+        run: sudo --preserve-env=MXC_LXC_TESTS_REQUIRE_EXECUTION,PATH,HOME "$(command -v cargo)" test -p wxc_e2e_tests --test e2e_lxc_network_capability
+
       - name: Show leftover firewall state on failure
         if: failure()
         run: |

scripts/ci/prepare-linux-host.sh

@@ -221,26 +221,7 @@ ensure_bridge_nat() {
     fi
 }
 
-# Container network policy is programmed as iptables rules reached from
-# FORWARD, which only sees bridged traffic when br_netfilter is loaded and
-# bridge-nf-call-iptables is enabled. Neither is guaranteed on a fresh image,
-# and without them the backend refuses to report success for a policy it
-# cannot enforce.
-enable_bridge_netfilter() {
-    if ! sudo modprobe br_netfilter 2>/dev/null; then
-        echo "WARNING: could not load br_netfilter; bridged traffic may bypass iptables." >&2
-    fi
 
-    local knob
-    for knob in bridge-nf-call-iptables bridge-nf-call-ip6tables; do
-        if [[ -e "/proc/sys/net/bridge/$knob" ]]; then
-            sudo sysctl -w "net.bridge.$knob=1" >/dev/null ||
-                echo "WARNING: could not enable net.bridge.$knob." >&2
-        else
-            echo "WARNING: /proc/sys/net/bridge/$knob is absent; container network policy cannot be enforced." >&2
-        fi
-    done
-}
 
 # Verifies the interpreters test suites drive inside the sandbox and reports
 # what the image actually provides, so a tool the image was built without stays
@@ -333,7 +314,6 @@ case "$backend" in
             sudo apparmor_parser -rT /etc/apparmor.d/lxc* 2>/dev/null || true
         fi
         start_lxc_bridge
-        enable_bridge_netfilter
         ensure_bridge_nat
         ;;
     microvm)

sdk/node/tests/integration/linux-process-container.test.ts

@@ -46,6 +46,12 @@ async function runLxc(
   return spawnFromConfigAsync(config, debugSpawnOptions);
 }
 
+function outboundNetwork(version: (typeof supportedVersions)[number]) {
+  return version.compare('0.8.0-alpha') >= 0
+    ? { egress: { default: 'allow' as const } }
+    : { allowOutbound: true };
+}
+
 for (const schemaVersion of supportedVersions) {
 describe(`Linux LXC Container (schema ${schemaVersion})`, {
   skip: lxcSkipReason,
@@ -109,7 +115,7 @@ describe(`Linux LXC Container (schema ${schemaVersion})`, {
   });
 
   it('should allow outbound network access', { skip: lxcNetworkSkipReason }, async () => {
-    const policy = { version: schemaVersion.raw, network: { allowOutbound: true } };
+    const policy = { version: schemaVersion.raw, network: outboundNetwork(schemaVersion) };
     const result = await runLxc(
       `wget -q -T 10 -O /dev/null '${NETWORK_TEST_URL}' && echo 'Network accessible'`,
       policy,
@@ -147,7 +153,7 @@ describe(`Linux LXC Container (schema ${schemaVersion})`, {
     const policy = {
       version: schemaVersion.raw,
       filesystem: { readwritePaths: [tempDir] },
-      network: { allowOutbound: true },
+      network: outboundNetwork(schemaVersion),
     };
     const script =
       `wget -q -T 10 -O ${tempDir}/download.json '${NETWORK_TEST_URL}'` +
@@ -158,7 +164,7 @@ describe(`Linux LXC Container (schema ${schemaVersion})`, {
   });
 
   it('should access HTTPS endpoint', { skip: lxcNetworkSkipReason }, async () => {
-    const policy = { version: schemaVersion.raw, network: { allowOutbound: true } };
+    const policy = { version: schemaVersion.raw, network: outboundNetwork(schemaVersion) };
     const result = await runLxc(
       `wget -q -T 10 -O /dev/null '${NETWORK_TEST_URL}' && echo 'HTTPS endpoint accessible'`,
       policy,
@@ -180,3 +186,32 @@ describe(`Linux LXC Container (schema ${schemaVersion})`, {
   });
 });
 }
+
+describe('Linux LXC Container default-deny network posture', {
+  skip: lxcSkipReason,
+}, () => {
+  it('should give schema 0.8 no network interface when the policy names no network fields', async () => {
+    // `awk` takes the interface names out of /proc/net/dev and strips the
+    // trailing colon; the `ip` call reports whether loopback carries
+    // 127.0.0.1.  The container prints two lines:
+    //   ifaces=[eth0 lo ]
+    //   loopback=up
+    const probe =
+      "echo \"ifaces=[$(awk 'NR>2 {sub(/:.*/, \"\", $1); print $1}' /proc/net/dev | sort | tr '\\n' ' ')]\"; " +
+      "ip -4 addr show lo 2>/dev/null | grep -q '127.0.0.1' && echo 'loopback=up' || echo 'loopback=down'";
+    const result = await runLxc(probe, { version: '0.8.0-alpha' }, 'lxc-deny-080');
+
+    assert.strictEqual(result.exitCode, 0, `Expected the container to run: ${result.stderr}`);
+    assert.ok(
+      result.stdout.includes('ifaces=[lo ]'),
+      `Schema 0.8 promises no network access when the policy names no network fields` +
+        ` (docs/sandbox-policy/0.8.0/policy.md), but the container was given more than` +
+        ` loopback: ${result.stdout}`,
+    );
+    // Taking the network away must not take localhost with it.
+    assert.ok(
+      result.stdout.includes('loopback=up'),
+      `Expected loopback to carry 127.0.0.1: ${result.stdout}`,
+    );
+  });
+});

src/backends/bubblewrap/common/src/bwrap_runner.rs

@@ -32,7 +32,7 @@ use std::path::{Component, Path, PathBuf};
 use std::process::{Child, ChildStdin, Command, Stdio};
 use std::time::Duration;
 
-use lxc_common::network_iptables::NetworkIptablesManager;
+use lxc_common::network_iptables::{EgressHookPoint, NetworkIptablesManager};
 use wxc_common::interruptible_reader::{wrap_pipe, InterruptibleReader, ReadCanceller};
 use wxc_common::logger::Logger;
 use wxc_common::models::{ExecutionRequest, ScriptResponse};
@@ -878,17 +878,13 @@ impl Drop for BubblewrapSandboxProcess {
 
 /// Build the iptables manager for a Bubblewrap sandbox.
 ///
-/// Unprivileged bwrap has no veth: the sandbox either shares the host network
-/// namespace or gets a private one, and neither leaves a host-side interface
-/// for a chain to match on (see `local_network_diagnostic` in
-/// `bwrap_command`). The absence is structural, not a lookup that failed, and
-/// that distinction is the whole of what makes it safe to accept here: there
-/// is no case in this backend where a veth was expected and went missing, so
-/// accepting one cannot mask a discovery that broke.
+/// Unprivileged bwrap has no container network namespace MXC can enforce in:
+/// the sandbox either shares the host's, where a chain would filter the host
+/// itself, or holds a private one bwrap created and MXC does not manage (see
+/// `local_network_diagnostic` in `bwrap_command`). The chain is built and
+/// never hooked, which leaves this backend's egress policy unenforced.
 fn build_firewall_manager(container_name: &str) -> NetworkIptablesManager {
-    let mut mgr = NetworkIptablesManager::new(container_name);
-    mgr.allow_missing_veth_interface();
-    mgr
+    NetworkIptablesManager::new(container_name, EgressHookPoint::Unhooked)
 }
 
 /// Best-effort iptables cleanup. Called on both success and error paths.
@@ -1405,17 +1401,17 @@ mod tests {
     }
 
     #[test]
-    fn the_firewall_manager_tolerates_the_veth_bubblewrap_never_has() {
-        // bwrap never calls set_veth_interface, so the shared manager's
-        // fail-closed path would refuse every firewall-mode sandbox at startup.
-        // The manager this backend builds must therefore have declared the
-        // absence up front.
+    fn the_firewall_manager_this_backend_builds_has_nowhere_to_enforce() {
+        // Unprivileged bwrap leaves MXC no container namespace to hook, so the
+        // manager must say so at construction. A manager that claimed a
+        // namespace would hook an OUTPUT chain in whatever namespace the
+        // process happens to be in -- the host's -- and filter the host itself.
         let mgr = build_firewall_manager("bwrap-cov");
 
         assert!(
-            mgr.veth_scoping_is_optional(),
-            "Bubblewrap has no veth, so the manager it builds must declare that a \
-             missing one is expected -- otherwise firewall-mode sandboxes cannot start"
+            !mgr.is_hooked(),
+            "Bubblewrap has no namespace to enforce in, so the manager it builds \
+             must not claim one"
         );
     }
 

src/backends/lxc/common/src/availability.rs

@@ -1,23 +1,15 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT License.
 
-//! LXC host-availability probe (ports the SDK's `isLxcAvailable()`).
-
 use std::process::{Child, Command, Stdio};
 use std::sync::OnceLock;
 use std::time::{Duration, Instant};
 
-/// Upper bound on the `lxc-ls --version` probe. A version check returns almost
-/// instantly; anything slower is treated as unavailable rather than allowed to
-/// block discovery.
+/// A version check returns almost instantly; anything slower than this should not block discovery.
 const PROBE_TIMEOUT: Duration = Duration::from_secs(3);
 
-/// How often to poll the child while waiting for it to exit.
 const POLL_INTERVAL: Duration = Duration::from_millis(25);
 
-/// Outcome of running `lxc-ls --version`. Only `ExitedSuccess` means available;
-/// the other variants are distinct for clarity but map to unavailable. The exit
-/// code isn't retained — nothing reads it, and keeping it would be dead code.
 #[derive(Debug, Clone, PartialEq, Eq)]
 enum LxcLsOutcome {
     ExitedSuccess,
@@ -26,11 +18,7 @@ enum LxcLsOutcome {
     TimedOut,
 }
 
-/// Whether the LXC backend looks usable on this host.
-///
-/// Runs `lxc-ls --version`; only a clean exit counts as available. A shallow
-/// check — it proves `lxc-ls` is on `PATH`, not that a container can start.
-/// Probed once and cached for the process lifetime.
+/// Runs `lxc-ls --version`; only a clean exit counts as available.
 pub fn is_lxc_available() -> bool {
     static AVAILABLE: OnceLock<bool> = OnceLock::new();
     *AVAILABLE.get_or_init(|| available_from(probe_lxc_ls()))
@@ -49,8 +37,6 @@ fn probe_lxc_ls() -> LxcLsOutcome {
     }
 }
 
-/// Wait up to `timeout` for `child`; if it overruns, kill and reap it so a hung
-/// `lxc-ls` can't block the probe (or leak a zombie) indefinitely.
 fn wait_bounded(child: &mut Child, timeout: Duration) -> LxcLsOutcome {
     let deadline = Instant::now() + timeout;
     loop {
@@ -70,8 +56,6 @@ fn wait_bounded(child: &mut Child, timeout: Duration) -> LxcLsOutcome {
     }
 }
 
-/// Split from the I/O half so the decision is testable without an `lxc-ls`
-/// binary on the host.
 fn available_from(outcome: LxcLsOutcome) -> bool {
     matches!(outcome, LxcLsOutcome::ExitedSuccess)
 }