Uh oh!
There was an error while loading. Please reload this page.
NanVix: Preserve block-default networking with blockedHosts - #1071
Open
Huzaifa Danish (huzaifa-d) wants to merge 7 commits into
Open
NanVix: Preserve block-default networking with blockedHosts#1071Huzaifa Danish (huzaifa-d) wants to merge 7 commits into
Huzaifa Danish (huzaifa-d) wants to merge 7 commits into
Conversation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Contributor
There was a problem hiding this comment.
Copilot review overview
Review tier: Balanced
Findings: None
What changed in this PR
Fixes NanVix networking so blockedHosts cannot widen block-default policies.
Changes:
- Rejects blocklists unless
defaultPolicyisallow. - Makes network enablement fail-safe and adds regression tests.
- Documents supported policy combinations.
| File | Description |
|---|---|
src/backends/nanvix/runner/src/lib.rs | Implements validation, fail-safe enablement, and tests. |
docs/nanvix-microvm/nanvix.md | Documents the network-policy matrix. |
docs/superpowers/specs/2026-08-31-nanvix-blocked-hosts-default-policy-design.md | Records the fix design. |
docs/superpowers/plans/2026-08-31-nanvix-blocked-hosts-default-policy.md | Records the implementation plan. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Huzaifa Danish (huzaifa-d)
marked this pull request as ready for review
September 1, 2026 17:13
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Branden Bonaby (bbonaby)
approved these changes
Sep 1, 2026
Comment on lines
+654
to
+660
| if !request.policy.blocked_hosts.is_empty() | ||
| && request.policy.default_network_policy != NetworkPolicy::Allow | ||
| { | ||
| return Err(NanVixError::Preflight( | ||
| ERR_BLOCKED_HOSTS_REQUIRE_ALLOW.to_string(), | ||
| )); | ||
| } |
Collaborator
There was a problem hiding this comment.
thought: I guess you do this because there's no point in having a block list when default is already to block? I figured in that case we'd just ignore the block list entries since all of them would be blocked anyway, but it's probably fine to be thorough.
There was a problem hiding this comment.
Branden, don't we need to unify the semantics of this at the policy layer? Why is this per backend?
Darren Hoehna (dhoehna)
approved these changes
Sep 1, 2026
|
Azure Pipelines: There may be pipelines that require an authorized user to comment /azp run to run. |
Jeff Whiteside (jsidewhite)
commented
Sep 1, 2026
Member
| | Workload | Error | | ||
| | ------------------------------- | ----------------------------------- | | ||
| | Both `allowedHosts` + `blockedHosts` | Rejected at preflight (mutually exclusive) | | ||
| | `blockedHosts` + `defaultPolicy: "block"` | Rejected at preflight (blocklists require an allow default) | |
| /// the runner passes `-allow-host-networking` to nanvixd; per-host lists are | ||
| /// additionally forwarded as `-allow-host`/`-block-host` (see | ||
| /// [`Self::spawn_nanvixd`]). | ||
| fn host_networking_enabled(request: &ExecutionRequest) -> bool { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📖 Description
Prevent the NanVix backend from treating
blockedHostsas permission to enablehost networking when
network.defaultPolicyisblock.blockedHostsunless the default network policy isallow.allowedHostsvalid as an allowlist under the secure block default.🔗 References
Resolves#787
🔍 Validation
cargo fmt --all -- --checkcargo clippy -p nanvix_runner --all-targets -- -D warningscargo test -p nanvix_runner(37 passed)✅ Checklist
Cargo.lock, thedependency-feed-checkcheck passes (not applicable;Cargo.lockis unchanged)📋 Issue Type
GitHub Actions runs the PR validation build automatically. The ADO pipeline
(
MXC-PR-Build) is the Azure version of the PR pipeline, kept in parity with the GitHubActions build; it runs on merge to
main, and Microsoft reviewers with write access can trigger iton a PR with
/azp run. See docs/pull-requests.md.If the
dependency-feed-checkcheck fails on a new dependency, the crate must be added tothe feed before the PR can pass. See docs/pull-requests.md
for the steps.
Microsoft Reviewers: Open in CodeFlow