Repository navigation
Hardening gVisor sandbox configuration against CPU side-channel risks and binary mismatches #2136
Description
Moving some internal security review bugs to github.
Summary
Untrusted workloads executing within the Substrate environment rely on the gVisor sandbox (runsc) for guest isolation. To prevent cross-tenant and host-level leakage and maintain sandbox integrity across upgrades, the sandbox runtime configuration should be hardened against CPU side-channel attacks and auxiliary binary version divergence.
Technical Details
-
CPU Core-Sharing Side Channels (SMT):
Processors utilizing Simultaneous Multithreading (SMT / Hyper-Threading) are susceptible to CPU core-sharing side-channel attacks (e.g., L1TF, MDS) when untrusted code co-locates on sibling logical cores.runscsupports theenable-core-tagsflag to isolate guest execution using core scheduling tags. On hardware architectures with SMT enabled, enabling core tagging prevents information leakage across sibling threads. -
Sandbox Component Version Alignment:
runscresolves auxiliary sidecar binaries located in adjacent directories. If underlying host files or sidecar binaries diverge across upgrades, protocol mismatches or partial patching can weaken sandbox boundaries. Setting--sidecar-release-enforcement-policy=ALWAYSensures that all spawned auxiliary helper binaries match the exact release build of the mainrunscbinary.
Code Context
cmd/ateom-gvisor/runsc.go: Spawns and configuresrunscexecution flags for container creation, startup, checkpoint, and restore.
Proposed Mitigations
- Evaluate and conditionally set
enable-core-tags=trueincmd/ateom-gvisor/runsc.gowhen running on platforms with hyperthreading / SMT enabled. - Configure
--sidecar-release-enforcement-policy=ALWAYSforrunscinvocations to guarantee atomic version alignment across runtime binaries.
Activity
Update default runsc flags configuration
zlammerts-svg commentedon Oct 12, 2026
Fabricio Voznika (@fvoznika) checking on this one, do you have more planned changes to close this out? Thank you!
zlammerts-svg commentedon Oct 13, 2026
PR: #2361
Update default runsc flags configuration
Update default runsc flags configuration
Update default runsc flags configuration
Update default runsc flags configuration
Update default runsc flags configuration
Update default runsc flags configuration (agent-substrate#2361)
BenTheElder commentedon Oct 17, 2026
#2361 is merged
zlammerts-svg commentedon Oct 19, 2026
Thanks Fabricio Voznika (@fvoznika) and Benjamin Elder (@BenTheElder)!!
fvoznika commentedon Oct 20, 2026
Benjamin Elder (@BenTheElder) there is one more PR to enable core tags (#2887).
destijl commentedon Oct 21, 2026
🤖 Reopening: neither of the two mitigations from the issue description has landed on
mainyet:--enable-core-tags): Pending in open PR Enable runsc core tagging when supported by the kernel #2887 (Fabricio Voznika (@fvoznika)).--sidecar-release-enforcement-policy=ALWAYS): PR Update default runsc flags configuration #2361 addedallow-suidandhost-settings=ignoretocmd/ateworker-gvisor/kodata/internal_flags.json, but omitted"sidecar-release-enforcement-policy": "ALWAYS", and PR Enable runsc core tagging when supported by the kernel #2887 does not include it either.cc Fabricio Voznika (@fvoznika) Benjamin Elder (@BenTheElder)
fvoznika commentedon Oct 21, 2026
Quick update:
Core tags: Changes are ready in PR #2887
Sidecar version check: while the policy verifies that the reported runsc version string is consistent, a version check is not an integrity check—it does not verify that the runsc binary itself is unmodified, nor does it protect any other binaries in the container image from tampering. Because this check executes on every runsc invocation, it introduces a recurring performance penalty without meaningfully improving security.
bootsieh commentedon Oct 21, 2026
Greg Castle (@destijl) if there isn't a cross tenant attack risk here, do we need the version check for M3? Or is there an exploit you are concerned about?
BenTheElder commentedon Oct 23, 2026
#2887 got kicked from the queue repeatedly for test failures, they're for the egress tests so asked networking team to follow up just as a way to load-shed making progress here.
EItanya commentedon Oct 27, 2026
bump Greg Castle (@destijl), getting to the wire in terms of M3 requirements
Enable runsc core tagging when supported by the kernel (agent-substra…