Skip to content

Commit 200ac02

Browse files
Xynnn007Xynnn007
committed
kbs: align policies and tests with EAR profile submod labels
After CoCoSubmoduleLabel replaced legacy cpu0/gpu0 keys, KBS resource policies, integration tests, and policy-engine fixtures still referenced the old submod names and caused PolicyDeny failures. Update them to sample-cpu and sample-device, iterate submods in e2e policy templates, and resolve tee-pubkey from any EAR submod while keeping the legacy path. Assisted-by: Cursor Signed-off-by: Xynnn007 <xynnn@linux.alibaba.com>
1 parent 10cfab7 commit 200ac02

10 files changed

Lines changed: 46 additions & 18 deletions

File tree

‎deps/policy-engine/src/policy/rego.rs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -279,7 +279,7 @@ mod tests {
279279
r#"
280280
{{
281281
"submods": {{
282-
"cpu0": {{
282+
"sample-cpu": {{
283283
"ear.trustworthiness-vector": {{
284284
"executables": 2,
285285
"hardware": 3

‎deps/policy-engine/test_data/policy_1.rego‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,6 @@ default allow = false
55
allow if {
66
count(data["resource-path"]) == 3
77
data.plugin == "resource"
8-
input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["sample"]["productId"] == data["resource-path"][1]
8+
input["submods"]["sample-cpu"]
9+
input["submods"]["sample-cpu"]["ear.veraison.annotated-evidence"]["sample"]["productId"] == data["resource-path"][1]
910
}

‎deps/policy-engine/test_data/policy_4.rego‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ allow if {
2020

2121

2222

23-
input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["sample"]["productId"] == data["resource-path"][1]
23+
input["submods"]["sample-cpu"]
24+
input["submods"]["sample-cpu"]["ear.veraison.annotated-evidence"]["sample"]["productId"] == data["resource-path"][1]
2425
}
2526

2627

‎deps/policy-engine/test_data/policy_5.rego‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,14 +11,15 @@ resources := {"secret1": 2, "secret2": 3}
1111

1212
allow if {
1313
# check that evidence comes from expected platform
14-
input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["sample"]
14+
input["submods"]["sample-cpu"]
15+
input["submods"]["sample-cpu"]["ear.veraison.annotated-evidence"]["sample"]
1516

1617
# check repository_name and resource_type
1718
data.plugin == "resource"
1819

1920
data["resource-path"][0] == "myrepo"
2021
data["resource-path"][1] == "secret"
2122
# check that the secret name exists and tht the minimum svn is met
22-
resources[data["resource-path"][2]] <= input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["sample"]["svn"]
23+
resources[data["resource-path"][2]] <= input["submods"]["sample-cpu"]["ear.veraison.annotated-evidence"]["sample"]["svn"]
2324

2425
}

‎integration-tests/tests/get_resource.rs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -222,7 +222,7 @@ import rego.v1
222222
default allow = false
223223
224224
allow if {
225-
input[\"submods\"][\"cpu0\"][\"ear.status\"] != \"contraindicated\"
225+
input[\"submods\"][\"sample-cpu\"][\"ear.status\"] != \"contraindicated\"
226226
}
227227
";
228228

@@ -233,8 +233,8 @@ import rego.v1
233233
default allow = false
234234
235235
allow if {
236-
input[\"submods\"][\"cpu0\"][\"ear.status\"] != \"contraindicated\"
237-
input[\"submods\"][\"gpu0\"][\"ear.status\"] != \"contraindicated\"
236+
input[\"submods\"][\"sample-cpu\"][\"ear.status\"] != \"contraindicated\"
237+
input[\"submods\"][\"sample-device\"][\"ear.status\"] != \"contraindicated\"
238238
}
239239
";
240240

‎integration-tests/tests/init_data.rs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ import rego.v1
7777
default allow = false
7878
7979
allow if {
80-
input[\"submods\"][\"cpu0\"][\"ear.veraison.annotated-evidence\"][\"init_data\"] == \"{init_data_hash}\"
80+
input[\"submods\"][\"sample-cpu\"][\"ear.veraison.annotated-evidence\"][\"init_data\"] == \"{init_data_hash}\"
8181
}
8282
";
8383

@@ -122,7 +122,7 @@ import rego.v1
122122
default allow = false
123123
124124
allow if {
125-
input[\"submods\"][\"cpu0\"][\"ear.veraison.annotated-evidence\"][\"init_data_claims\"][\"cdh.toml\"][\"image\"][\"extra_root_certificates\"][0] == \"-----BEGIN CERTIFICATE-----\\nMIIFTDCCAvugAwIBAgIBADBGBgkqhkiG9w0BAQowOaAPMA0GCWCGSAFlAwQCAgUA\\noRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAgUAogMCATCjAwIBATB7MRQwEgYD\\nVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDASBgNVBAcMC1NhbnRhIENs\\nYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5jZWQgTWljcm8gRGV2aWNl\\n-----END CERTIFICATE-----\\n\"
125+
input[\"submods\"][\"sample-cpu\"][\"ear.veraison.annotated-evidence\"][\"init_data_claims\"][\"cdh.toml\"][\"image\"][\"extra_root_certificates\"][0] == \"-----BEGIN CERTIFICATE-----\\nMIIFTDCCAvugAwIBAgIBADBGBgkqhkiG9w0BAQowOaAPMA0GCWCGSAFlAwQCAgUA\\noRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAgUAogMCATCjAwIBATB7MRQwEgYD\\nVQQLDAtFbmdpbmVlcmluZzELMAkGA1UEBhMCVVMxFDASBgNVBAcMC1NhbnRhIENs\\nYXJhMQswCQYDVQQIDAJDQTEfMB0GA1UECgwWQWR2YW5jZWQgTWljcm8gRGV2aWNl\\n-----END CERTIFICATE-----\\n\"
126126
}
127127
";
128128

@@ -236,7 +236,7 @@ import rego.v1
236236
default allow = false
237237
238238
allow if {
239-
input[\"submods\"][\"cpu0\"][\"ear.veraison.annotated-evidence\"][\"init_data_claims\"][\"agent_policy_claims\"][\"containers\"][1][\"OCI\"][\"Process\"][\"Args\"][0] = \"/opt/bitnami/scripts/nginx/entrypoint.sh\"
239+
input[\"submods\"][\"sample-cpu\"][\"ear.veraison.annotated-evidence\"][\"init_data_claims\"][\"agent_policy_claims\"][\"containers\"][1][\"OCI\"][\"Process\"][\"Args\"][0] = \"/opt/bitnami/scripts/nginx/entrypoint.sh\"
240240
}
241241
";
242242

@@ -257,7 +257,7 @@ async fn check_validated_identifiers() -> Result<()> {
257257
harness.cleanup().await?;
258258

259259
let validated_identifiers = token_payload
260-
.pointer("/submods/cpu0/ear.trustee.identifiers/validated")
260+
.pointer("/submods/sample-cpu/ear.trustee.identifiers/validated")
261261
.ok_or(anyhow!("Could not find validated identifiers."))?;
262262

263263
let expected_identifiers =

‎kbs/sample_policies/default.rego‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
# ```
1717
# {
1818
# "submods": {
19-
# "cpu0": {
19+
# "sample-cpu": {
2020
# "ear.veraison.annotated-evidence": {
2121
# "sample": {
2222
# "productId": "",
@@ -80,7 +80,12 @@ default allow = false
8080

8181
plugin = data.plugin
8282

83+
forbidden_submod_present if {
84+
some label in ["sample-cpu", "sample-device"]
85+
input["submods"][label]
86+
}
87+
8388
allow if {
8489
plugin == "resource"
85-
not input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["sample"]
90+
not forbidden_submod_present
8691
}

‎kbs/sample_policies/deny_all.rego‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
# ```
1717
# {
1818
# "submods": {
19-
# "cpu0": {
19+
# "sample-cpu": {
2020
# "ear.veraison.annotated-evidence": {
2121
# "sample": {
2222
# "productId": "",

‎kbs/src/token/mod.rs‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,12 @@ pub use error::*;
1515
pub const TOKEN_TEE_PUBKEY_PATH_ITA: &str = "/tdx/attester_runtime_data/tee-pubkey";
1616
pub const TOKEN_TEE_PUBKEY_PATH_ITA_VTPM: &str = "/tdx/attester_user_data/tee-pubkey";
1717
pub const TOKEN_TEE_PUBKEY_PATH_COCO: &str = "/customized_claims/runtime_data/tee-pubkey";
18+
// Keep this for backward compatibility with legacy EAR submod naming.
1819
pub const TOKEN_TEE_PUBKEY_PATH_EAR: &str =
1920
"/submods/cpu0/ear.veraison.annotated-evidence/runtime_data_claims/tee-pubkey";
2021
pub const TOKEN_TEE_PUBKEY_PATH_VALUE: &str = "/tee-pubkey";
22+
pub const TOKEN_TEE_PUBKEY_PATH_EAR_SUBMOD_RELATIVE: &str =
23+
"/ear.veraison.annotated-evidence/runtime_data_claims/tee-pubkey";
2124

2225
#[derive(Deserialize, Debug, Clone, PartialEq, Default)]
2326
pub struct AttestationTokenVerifierConfig {
@@ -102,6 +105,20 @@ impl TokenVerifier {
102105
}
103106
}
104107

108+
if let Some(pkey_value) =
109+
claim
110+
.get("submods")
111+
.and_then(Value::as_object)
112+
.and_then(|submods| {
113+
submods.values().find_map(|submod| {
114+
submod.pointer(TOKEN_TEE_PUBKEY_PATH_EAR_SUBMOD_RELATIVE)
115+
})
116+
})
117+
{
118+
debug!("Extract tee public key from EAR submod path");
119+
return TeePubKey::deserialize(pkey_value).map_err(|_| Error::TeePubKeyParseFailed);
120+
}
121+
105122
Err(Error::NoTeePubKeyClaimFound)
106123
}
107124
}

‎kbs/test/Makefile‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,8 @@ allow if {
6666
data["resource-path"][0] == "one"
6767
data["resource-path"][1] == "two"
6868
data["resource-path"][2] == "three"
69-
input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["$(TEE)"]
69+
some submod in object.keys(input["submods"])
70+
input["submods"][submod]["ear.veraison.annotated-evidence"]["$(TEE)"]
7071
}
7172
endef
7273
export TEE_POLICY_REGO
@@ -79,7 +80,8 @@ default allow = false
7980
allow if {
8081
data.plugin == "external"
8182
data["resource-path"][0] == "echo-test"
82-
input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["$(TEE)"]
83+
some submod in object.keys(input["submods"])
84+
input["submods"][submod]["ear.veraison.annotated-evidence"]["$(TEE)"]
8385
}
8486
endef
8587
export EXT_PLUGIN_POLICY_REGO
@@ -92,7 +94,8 @@ default allow = false
9294
allow if {
9395
data.plugin == "external"
9496
data["resource-path"][0] == "resource"
95-
input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["$(TEE)"]
97+
some submod in object.keys(input["submods"])
98+
input["submods"][submod]["ear.veraison.annotated-evidence"]["$(TEE)"]
9699
}
97100
endef
98101
export EXT_RESOURCE_PLUGIN_POLICY_REGO

0 commit comments

Comments
 (0)