forgefirm

682 Commits 1 Branch 7 Tags

2 Commits

Include renames

Author	SHA1	Message	Date
ScottW514	2894269115	The deny rules: the machine itself is never a destination The way through the extension sandbox's deny rules is an allowlist, and an allowlist names addresses. The machine's own LAN address is not a fact anybody can pin: a new DHCP lease can turn a peer's address on some package's list into the machine's, and with it open the Grbl port or forgectrl's listeners to that package. ffx.nft now refuses it structurally. Everything a host sends to one of its own addresses, the LAN one included, leaves through lo, so chain pool refuses `oifname "lo"` before it looks at the allow map; the two refusals (a reset for TCP, a drop for the rest, both counted) move into chain refuse, which pool jumps to from both places. No kernel option is new: oifname is in the nf_tables core. scripts/sandbox-rules-test.py gets a destination that is not the machine: a second network namespace joined by a veth pair, with listeners of its own. A pool uid is refused on loopback, IPv6 loopback, its own LAN address, and the peer; an allow chain opens one port of the peer to one uid and nothing else; with loopback, IPv6 loopback, and the machine's own address added to that list the uid is still refused at all three while the peer still answers; a reload closes it. It needs ip and nsenter now. exthost.platform reads its counters from chain refuse, holds the rule's place ahead of the map, and adds the case on the machine: an allow chain for the last pool uid that names forgectrl on loopback and on the LAN address opens neither, and the chain is removed. Proven. The rules test passes with nft 1.0.9, and four controls each fail it: the range one uid short, the TCP reject turned to accept, the delete-table line removed, and the lo rule removed (the uid then reaches all three of the machine's addresses). On the bench reference, image 20260920211625, this rule file loaded from /tmp with nft -f and this suite file mounted: exthost.platform PASS, uid 831 refused at 127.0.0.1:443 and 172.16.1.97:443 with both on its allowlist, the counters [0, 0] to [12, 4]. Against the image's own rules the same test fails on the rule's absence, which is the control. The image's rules were reloaded after. The unit suite passes (422). Acceptance. exthost.platform gates the rule on the machine; sandbox-ci gates the file. The rule file is layer content, in the platform identity of every fingerprint.	2026-09-20 19:53:05 -04:00
ScottW514	d627ee32f1	The extension sandbox platform: accounts, cgroups, and the deny rules What the image holds ready before any extension package exists, so that the first one starts inside it. forgefirm-sandbox (new recipe, on both images): - the account pool: ffx0 to ffx31, uid and gid 800 to 831, one group each, /nonexistent, /bin/false, locked. Below 1000 on purpose: the forgefirm-users render replaces only the accounts from 1000 up, so an account reset leaves the pool alone and the read-only rootfs never needs an account made at run time. The image's dynamic system ids count down from 999 and stop at 997. - an rcS script at S30: cgroup v2 mounted at /sys/fs/cgroup, the cpu, memory, and pids controllers handed down to /sys/fs/cgroup/ffx, and ffx marked idle-class (cpu.idle; the kernel refuses a cpu.weight on top of it, so none is written). The firmware's processes stay in the root group. `status` reports both halves and exits nonzero when either is missing. - /etc/forgefirm/ffx.nft, loaded by the same script, before the network starts in rc5: table inet ffx, an output-hook filter with policy accept that sends uid 800-831 to chain pool; pool looks the uid up in the verdict map `allow`, then answers TCP with a reset (a drop would leave a connect to time out) and drops the rest (the sender sees EPERM), both counted. The map is the one way through: a uid mapped to a chain of that package's destinations. Loading the file again replaces the table, allowlists included: it fails closed. nftables comes in as its runtime dependency, trimmed in the distro config to the binary and its library with JSON output: no interactive shell, no Python binding. gmp and jansson were on the image; libmnl and libnftnl are new. The release rootfs goes from 34.5 to 34.1 MiB free. scripts/sandbox-rules-test.py, and the workflow sandbox-ci that runs it: the rule file loaded into a network namespace of its own and sent at from real uids. Root, 799, and 832 are not touched; 800, 815, and 831 are refused on 127.0.0.1 and ::1 at once, UDP with EPERM, and a receiver hears nobody from the pool; an allow chain opens one port on one address to one uid and nothing else; a reload closes it. exthost.platform (new suite module exthost.py): the platform proven on a probe process, not read off a config. In a probe group under ffx, as the last pool uid: held to cpu.max, stopped by cgroup.freeze and running again after, stopped at pids.max, killed by the group's own OOM at memory.max while forgectrl keeps its pid. The 32 accounts as the boot's render left them. Pool uids 800 and 831 refused TCP to forgectrl on loopback (both ports, IPv4 and IPv6), to the LAN address, and to the Grbl port, at once, UDP EPERM, with the rules' counters moving by at least the attempts, while root reaches the same listeners. A root probe under landlock loses /etc and TCP connects and keeps /usr; a seccomp filter returns EPERM for the filtered call. The probe group is removed whatever happens. Proven. The rules test passes with nft 1.0.9, the image's version, and three controls each fail it: the range one uid short, the TCP reject turned to accept, the delete-table line removed. The unit suite passes (422) with no undefined name. Image 20260920211625 carries all of it (read back from both rootfs images: 32 accounts in passwd, group, and shadow, S30forgefirm-sandbox, the rule file and the script byte-identical, nft with its libraries and no Python binding). On the bench reference, that image: exthost.platform PASS (5.0 percent of the core under a 5 percent cpu.max, 0 us frozen and 87358 us thawed over 1.5 s each, 5 of 12 forks then EAGAIN, rc -9 with oom_kill 1 at a 24 MiB memory.max, the counters [0, 0] to [12, 4], landlock ABI 6), and forgefirm-sandbox status reports both halves in place. Acceptance. exthost.platform gates the platform; sandbox-ci gates the rule file. The recipe, the rules, and the distro option are layer content, in the platform identity of every fingerprint.	2026-09-20 18:02:31 -04:00

Author

SHA1

Message

Date

ScottW514

2894269115

The deny rules: the machine itself is never a destination

The way through the extension sandbox's deny rules is an allowlist, and an
allowlist names addresses. The machine's own LAN address is not a fact
anybody can pin: a new DHCP lease can turn a peer's address on some
package's list into the machine's, and with it open the Grbl port or
forgectrl's listeners to that package.

ffx.nft now refuses it structurally. Everything a host sends to one of its
own addresses, the LAN one included, leaves through lo, so chain pool
refuses `oifname "lo"` before it looks at the allow map; the two refusals
(a reset for TCP, a drop for the rest, both counted) move into chain
refuse, which pool jumps to from both places. No kernel option is new:
oifname is in the nf_tables core.

scripts/sandbox-rules-test.py gets a destination that is not the machine:
a second network namespace joined by a veth pair, with listeners of its
own. A pool uid is refused on loopback, IPv6 loopback, its own LAN address,
and the peer; an allow chain opens one port of the peer to one uid and
nothing else; with loopback, IPv6 loopback, and the machine's own address
added to that list the uid is still refused at all three while the peer
still answers; a reload closes it. It needs ip and nsenter now.

exthost.platform reads its counters from chain refuse, holds the rule's
place ahead of the map, and adds the case on the machine: an allow chain
for the last pool uid that names forgectrl on loopback and on the LAN
address opens neither, and the chain is removed.

Proven. The rules test passes with nft 1.0.9, and four controls each fail
it: the range one uid short, the TCP reject turned to accept, the
delete-table line removed, and the lo rule removed (the uid then reaches
all three of the machine's addresses). On the bench reference, image
20260920211625, this rule file loaded from /tmp with nft -f and this suite
file mounted: exthost.platform PASS, uid 831 refused at 127.0.0.1:443 and
172.16.1.97:443 with both on its allowlist, the counters [0, 0] to
[12, 4]. Against the image's own rules the same test fails on the rule's
absence, which is the control. The image's rules were reloaded after. The
unit suite passes (422).

Acceptance. exthost.platform gates the rule on the machine; sandbox-ci
gates the file. The rule file is layer content, in the platform identity
of every fingerprint.

2026-09-20 19:53:05 -04:00

ScottW514

d627ee32f1

The extension sandbox platform: accounts, cgroups, and the deny rules

What the image holds ready before any extension package exists, so that
the first one starts inside it.

forgefirm-sandbox (new recipe, on both images):
  - the account pool: ffx0 to ffx31, uid and gid 800 to 831, one group
    each, /nonexistent, /bin/false, locked. Below 1000 on purpose: the
    forgefirm-users render replaces only the accounts from 1000 up, so an
    account reset leaves the pool alone and the read-only rootfs never
    needs an account made at run time. The image's dynamic system ids
    count down from 999 and stop at 997.
  - an rcS script at S30: cgroup v2 mounted at /sys/fs/cgroup, the cpu,
    memory, and pids controllers handed down to /sys/fs/cgroup/ffx, and
    ffx marked idle-class (cpu.idle; the kernel refuses a cpu.weight on
    top of it, so none is written). The firmware's processes stay in the
    root group. `status` reports both halves and exits nonzero when
    either is missing.
  - /etc/forgefirm/ffx.nft, loaded by the same script, before the network
    starts in rc5: table inet ffx, an output-hook filter with policy
    accept that sends uid 800-831 to chain pool; pool looks the uid up in
    the verdict map `allow`, then answers TCP with a reset (a drop would
    leave a connect to time out) and drops the rest (the sender sees
    EPERM), both counted. The map is the one way through: a uid mapped to
    a chain of that package's destinations. Loading the file again
    replaces the table, allowlists included: it fails closed.

nftables comes in as its runtime dependency, trimmed in the distro config
to the binary and its library with JSON output: no interactive shell, no
Python binding. gmp and jansson were on the image; libmnl and libnftnl are
new. The release rootfs goes from 34.5 to 34.1 MiB free.

scripts/sandbox-rules-test.py, and the workflow sandbox-ci that runs it:
the rule file loaded into a network namespace of its own and sent at from
real uids. Root, 799, and 832 are not touched; 800, 815, and 831 are
refused on 127.0.0.1 and ::1 at once, UDP with EPERM, and a receiver hears
nobody from the pool; an allow chain opens one port on one address to one
uid and nothing else; a reload closes it.

exthost.platform (new suite module exthost.py): the platform proven on a
probe process, not read off a config. In a probe group under ffx, as the
last pool uid: held to cpu.max, stopped by cgroup.freeze and running again
after, stopped at pids.max, killed by the group's own OOM at memory.max
while forgectrl keeps its pid. The 32 accounts as the boot's render left
them. Pool uids 800 and 831 refused TCP to forgectrl on loopback (both
ports, IPv4 and IPv6), to the LAN address, and to the Grbl port, at once,
UDP EPERM, with the rules' counters moving by at least the attempts, while
root reaches the same listeners. A root probe under landlock loses /etc
and TCP connects and keeps /usr; a seccomp filter returns EPERM for the
filtered call. The probe group is removed whatever happens.

Proven. The rules test passes with nft 1.0.9, the image's version, and
three controls each fail it: the range one uid short, the TCP reject
turned to accept, the delete-table line removed. The unit suite passes
(422) with no undefined name. Image 20260920211625 carries all of it (read
back from both rootfs images: 32 accounts in passwd, group, and shadow,
S30forgefirm-sandbox, the rule file and the script byte-identical, nft
with its libraries and no Python binding). On the bench reference, that
image: exthost.platform PASS (5.0 percent of the core under a 5 percent
cpu.max, 0 us frozen and 87358 us thawed over 1.5 s each, 5 of 12 forks
then EAGAIN, rc -9 with oom_kill 1 at a 24 MiB memory.max, the counters
[0, 0] to [12, 4], landlock ABI 6), and forgefirm-sandbox status reports
both halves in place.

Acceptance. exthost.platform gates the platform; sandbox-ci gates the rule
file. The recipe, the rules, and the distro option are layer content, in
the platform identity of every fingerprint.

2026-09-20 18:02:31 -04:00