fix(cloud-hypervisor): limit device ACL lifetime - #7931
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
lpcox
added
the
cloud-hypervisor-kvm
|
🚀 Security Guard has started processing this pull request |
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The KVM regression assertion does not independently protect the live ACL check that motivated the fix.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review tier: Balanced
Findings: 1
New issues introduced by this change (1)
| Severity | Finding |
|---|---|
 |
scripts/ci/cloud-hypervisor-ci-scripts.test.ts — This assertion does not protect the live ACL check that motivated the PR: /dev/kvm also appears… |
What changed in this PR
Updates Cloud Hypervisor CI smoke checks to inspect device ACLs with root privileges.
Changes:
- Runs
/dev/kvmand/dev/net/tunACL checks throughsudo. - Adds source-level regression assertions for privileged ACL inspection.
| File | Description |
|---|---|
scripts/ci/cloud-hypervisor-live-smoke.sh |
Performs ACL presence and cleanup checks as root. |
scripts/ci/cloud-hypervisor-ci-scripts.test.ts |
Adds regression assertions for privileged ACL reads. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
✅ Copilot review passed with no inline comments. @lpcox Add the |
|
| Metric | Base | PR | Delta |
|---|---|---|---|
| Lines | 93.09% | 93.10% | ➡️ +0.01% |
| Statements | 91.73% | 91.74% | ➡️ +0.01% |
| Functions | 92.19% | 92.17% | 📉 -0.02% |
| Branches | 85.43% | 85.44% | ➡️ +0.01% |
📁 Per-file Coverage Changes (5 files)
| File | Lines (Before → After) | Statements (Before → After) |
|---|---|---|
src/cloud-hypervisor/manager-start.ts |
88.8% → 87.9% (-0.90%) | 88.1% → 87.3% (-0.86%) |
src/cloud-hypervisor/vmm-identity.ts |
99.5% → 99.1% (-0.40%) | 95.3% → 95.3% (-0.04%) |
src/cloud-hypervisor/cleanup-registry.ts |
93.8% → 93.7% (-0.13%) | 90.7% → 90.7% (-0.06%) |
src/capability-filter.ts |
96.4% → 96.4% (+0.06%) | 94.7% → 94.8% (+0.09%) |
src/log-directory-setup.ts |
96.2% → 100.0% (+3.78%) | 96.3% → 100.0% (+3.71%) |
Coverage comparison generated by scripts/ci/compare-coverage.ts
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ Build Test Suite completed successfully!
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 2 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "msfeed25.pkgs.visualstudio.com"
- "registry.npmjs.org"See Network Configuration for more information.
|
|
✅ Contribution Check completed successfully! Code review complete: the PR satisfies the applicable CONTRIBUTING.md guidance in the provided context. The change is in the correct CI script location, includes matching test updates, and the PR description already has a clear summary, related issue reference, and validation notes.
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
|
✅ Contribution Check completed successfully! Contribution check complete: the PR includes tests for the behavioral change, updates the relevant CI script and related docs/comments, and the PR description is clear with context and validation. No guideline issues found that require a review comment.
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓
|
|
✅ Build Test Suite completed successfully!
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (github.com) reachable: Overall: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine — @lpcox
Overall: PASS
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Test: Docker Sbx — @lpcox
Overall: PASS
|
|
✅ Copilot BYOK Smoke Test: PASS Running in direct BYOK mode (
CC: @lpcox
|
|
Smoke Test Results:
Overall: FAIL —
|
Chroot Version Comparison Results
Overall: FAILED — Node.js version mismatch between host and chroot environments.
|
Smoke Test: API Proxy OpenTelemetry Tracing
Overall: All 5 scenarios pass or are expected-pending. No regressions detected in OTEL tracing integration.
|
|
Smoke test for PR #7931
|
|
Add Playwright loopback smoke workflows
|
|
cc @lpcox Add Playwright loopback smoke workflows: ❌ Running in direct BYOK mode (COPILOT_PROVIDER_API_KEY + COPILOT_PROVIDER_BASE_URL) via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) Overall status: FAIL
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS Notes:
|
Summary
/dev/kvmACL with the same root privileges AWF uses to grant and validate it/dev/kvmand/dev/net/tunACL absence as rootContext
The non-skipped live-KVM job for #7929 passed the staged process probes and durable process-death reaper, then consistently failed when the unprivileged harness re-read an ACL that AWF grants and validates as root. #7929 was externally merged before that result completed.
Validation
bash -n scripts/ci/cloud-hypervisor-live-smoke.shnpm run buildnpm run lint