Repository navigation
fix(minimald): change the UDP 443 blocked-leaves set through nft on a root VM guest daemon #3059
Description
Situation
Inside a VM, the in-VM minimald runs as root. It changes the classifier's UDP 443 blocked-leaves set through HostMoves::add_blocked_leaf and remove_blocked_leaf in crates/minimald/src/box_actor/host.rs. Both always call run_quic443_leaf_helper, which runs sudo -n with QUIC443_LEAF_HELPER. The VM guest image has no sudo and no such helper.
So inside the VM, the add fails for a host_ip box whose stance blocks UDP 443, for example an auto credentialed box with dns steering. A refused add of the blocked-leaves set fails the launch, so the box does not start on a Mac.
The networking design §5.7 line 208 needs that UDP 443 refusal in every stance. The arch ruling on #3052 at 64ec306 (arch_rulings 984, condition C1) raised this gap. The gap predates T124 (#3047).
Done when
- On a root daemon,
add_blocked_leafandremove_blocked_leafchangequic443_blocked_leavesthroughnftdirectly. This uses the samegeteuid() == 0branch thatchange_lane_setuses forbep_lane_leavessince T124 — Refuse a host-address box with no grant the proxy's address inside the VM #3052. - A unit test runs that root path over a recording
nftstub. It covers an add, a remove, and a leaf that is not below the mount. - A
host_ipgrant box whose stance blocks UDP 443 starts inside a VM on a Mac.
Not checked
Whether any stance that a released min can select reaches this path inside a VM today.
Activity