Add multi-identity Podman conformance harness

docs/MULTI_IDENTITY_SECURITY_CONTRACT.md

@@ -403,9 +403,11 @@ case instead of reusing a successful live container:
 - under the bounded-range profile, a raw mechanism probe kept separate from
   the production supervisor confirms that representative other in-range
   transitions succeed and every out-of-range transition fails;
-- a child probe at its first untrusted instruction sees exactly its declared
-  descriptor allowlist, while adversarial non-`CLOEXEC` supervisor control-file,
-  socket, pidfd, and private-data canaries are absent;
+- immediately before untrusted exec, the trusted launcher observes exactly the
+  declared descriptor allowlist after closing adversarial non-`CLOEXEC`
+  supervisor control-file, socket, pidfd, and private-data canaries; the first
+  application report confirms the launcher's evidence and the canaries remain
+  absent;
 - capability-dropped application children cannot change identity, and neither
   set-ID nor file-capability execution can restore identity-changing authority;
 - all four fields in the capability-bearing supervisor's
@@ -424,7 +426,8 @@ case instead of reusing a successful live container:
 - the approved seccomp profile is explicitly selected and identifiable in the
   resolved and effective runtime policy, application processes report
   `NoNewPrivs: 1` and seccomp filter mode (`Seccomp: 2`), negative probes for
-  syscalls the approved profile must block fail, and the container root
+  syscalls the approved profile must block fail while the same valid operation
+  succeeds in an otherwise equivalent unfiltered control, and the container root
   filesystem is read-only except for declared writable storage;
 - two workloads using the same container IDs receive different host authority,
   run in separate PID, IPC, network, and mount namespaces with private mount
@@ -462,20 +465,20 @@ without an explicit security decision.
 
 | ID | Required result | Owning milestone | Minimum evidence | Current state |
 | --- | --- | --- | --- | --- |
-| ID-01 | Every mapped identity, including the dedicated supervisor identity, has exclusively delegated subordinate host authority only; it does not alias host root, a local or NSS-provided host principal, or a subordinate range delegated to another host principal. | 1 | Resolved-state and host-side mapping inspection for exactly one dedicated supervisor UID/GID plus authoritative collision checks against the host identity inventory and every other subordinate UID/GID delegation, explicit collision-failure cases, and an in-container identity probe for each profile. | Unproven; repeated conformance probe pending |
-| ID-02 | The trusted supervisor can perform every required declared transition and rejects mapped-but-undeclared UIDs, GIDs, and supplementary groups; every application child's real, effective, saved-set, and filesystem UIDs and GIDs match its declared application identities, and its final supplementary-group vector contains exactly its declared groups; a separate raw bounded-range mechanism probe permits representative other in-range transitions. | 1 | Positive declared-identity and negative mapped-but-undeclared tests through the production supervisor policy, all four `/proc/<pid>/status` `Uid:` and `Gid:` fields matching the declared application IDs, final `Groups:` inspection that excludes inherited privileged, runtime-required, and otherwise undeclared groups, plus an independently identified raw range-mechanism probe. | Unproven; repeated conformance probe pending |
-| ID-03 | Exact mappings reject every unmapped transition; bounded ranges reject every out-of-range transition; capability-dropped children cannot change identity, inherit supervisor or undeclared descriptors, regain authority through set-ID or file-capability execution, or signal, inspect, or control the capability-bearing supervisor. | 1 | Profile-specific boundary and post-drop tests for `setuid`, `setreuid`, `setresuid`, `setfsuid`, `setgid`, `setregid`, `setresgid`, `setfsgid`, `setgroups`, set-user/group-ID execution, and file-capability execution; first-instruction child descriptor enumeration against an exact allowlist plus adversarial non-`CLOEXEC` supervisor control-file, socket, pidfd, and private-data canaries; all four supervisor `Uid:` and `Gid:` fields using its dedicated child-disjoint UID and GID; a final supervisor `Groups:` vector containing no GID other than its dedicated GID; a supervisor `PR_GET_DUMPABLE` result of zero; supervisor/child POSIX session-ID inspection proving separation; and negative same-workload child-to-supervisor `kill` and `pidfd_send_signal` probes that explicitly include `SIGCONT`, plus negative `ptrace`, `/proc/<pid>/mem`, `process_vm_readv`, and `process_vm_writev` probes. | Unproven; repeated conformance probe pending |
-| ID-04 | Two installations using the same container IDs have distinct host mappings, PID, IPC, network, and mount namespaces, private mount propagation, and private `/dev/shm` and `/dev/mqueue` mounts; they cannot observe, signal, or ptrace each other's processes, see each other's mounts, use each other's System V or named POSIX shared-memory, semaphore, or message-queue objects, connect to each other's Linux abstract Unix sockets, or read each other's private state. | 1 | Concurrent two-workload probe with host mapping, PID-namespace, IPC-namespace, network-namespace, mount-namespace, mount-propagation, `/dev/shm`, and `/dev/mqueue` inspection plus negative cross-workload mount visibility, process visibility, signaling, ptrace, System V IPC, POSIX `shm_open`/`sem_open`, POSIX `mq_open`/send/receive, abstract Unix-socket connection, and private-state access tests. | Unproven; repeated conformance probe pending |
-| BE-01 | Both mapping profiles run only on a positively identified Podman backend; Docker Engine rejects them before workload mutation. | 1 | Backend detection plus positive Podman and negative Docker Engine integration tests. | Unproven; product integration not implemented |
-| CAP-01 | Capability sets are empty by default; an opted-in workload control plane receives only its exact reviewed allowlist, and ordinary children receive none. | 1 and 2 | Inspect bounding, effective, permitted, inheritable, and ambient sets for the default, supervisor, and child processes; verify omitted capabilities fail. | Unproven; capability contract not implemented |
+| ID-01 | Every mapped identity, including the dedicated supervisor identity, has exclusively delegated subordinate host authority only; it does not alias host root, a local or NSS-provided host principal, or a subordinate range delegated to another host principal. | 1 | Resolved-state and host-side mapping inspection for exactly one dedicated supervisor UID/GID plus per-ID NSS resolution, fail-closed subordinate-backend enumeration, active-libsubid agreement, checks against every other subordinate UID/GID delegation, injected UID and GID collision cases that must fail for both NSS principals and another delegation, and an in-container identity probe for each profile. | Private 1B conformance passed 3 exact and 3 bounded trials; product integration pending |
+| ID-02 | The trusted supervisor can perform every required declared transition and rejects mapped-but-undeclared UIDs, GIDs, and supplementary groups; every application child's real, effective, saved-set, and filesystem UIDs and GIDs match its declared application identities, and its final supplementary-group vector contains exactly its declared groups; a separate raw bounded-range mechanism probe permits representative other in-range transitions. | 1 | Positive declared-identity and negative mapped-but-undeclared tests through the production supervisor policy, all four `/proc/<pid>/status` `Uid:` and `Gid:` fields matching the declared application IDs, final `Groups:` inspection that excludes inherited privileged, runtime-required, and otherwise undeclared groups, plus an independently identified raw range-mechanism probe. | Private 1B conformance passed 3 exact and 3 bounded trials; product integration pending |
+| ID-03 | Exact mappings reject every unmapped transition; bounded ranges reject every out-of-range transition; capability-dropped children cannot change identity, inherit supervisor or undeclared descriptors, regain authority through set-ID or file-capability execution, or signal, inspect, or control the capability-bearing supervisor. | 1 | Profile-specific boundary and post-drop tests for `setuid`, `setreuid`, `setresuid`, `setfsuid`, `setgid`, `setregid`, `setresgid`, `setfsgid`, `setgroups`, execution of a mapped supervisor-owned set-user/group-ID fixture, and file-capability execution; pre-exec trusted-launcher enumeration against an exact descriptor allowlist plus adversarial non-`CLOEXEC` supervisor control-file, socket, pidfd, and private-data canaries, followed by application confirmation; all four supervisor `Uid:` and `Gid:` fields using its dedicated child-disjoint UID and GID; a final supervisor `Groups:` vector containing no GID other than its dedicated GID; a supervisor `PR_GET_DUMPABLE` result of zero; supervisor/child POSIX session-ID inspection proving separation; and negative same-workload child-to-supervisor `kill` and `pidfd_send_signal` probes that explicitly include `SIGCONT`, plus negative `ptrace`, `/proc/<pid>/mem`, `process_vm_readv`, and `process_vm_writev` probes. | Private 1B conformance passed 3 exact and 3 bounded trials; product integration pending |
+| ID-04 | Two installations using the same container IDs have distinct host mappings, PID, IPC, network, and mount namespaces, private mount propagation, and private `/dev/shm` and `/dev/mqueue` mounts; they cannot observe, signal, or ptrace each other's processes, see each other's mounts, use each other's System V or named POSIX shared-memory, semaphore, or message-queue objects, connect to each other's Linux abstract Unix sockets, or read each other's private state. | 1 | Concurrent two-workload probe with host mapping, PID-namespace, IPC-namespace, network-namespace, mount-namespace, mount-propagation, `/dev/shm`, and `/dev/mqueue` inspection plus negative cross-workload mount visibility, process visibility, signaling, ptrace, System V IPC, POSIX `shm_open`/`sem_open`, POSIX `mq_open`/send/receive, abstract Unix-socket connection, and private-state access tests. | Private 1B conformance passed 3 exact and 3 bounded trials; product integration pending |
+| BE-01 | Both mapping profiles run only on a positively identified Podman backend; Docker Engine rejects them before workload mutation. | 1 | Backend detection plus positive Podman and negative Docker Engine integration tests. | Private Podman-positive and Docker-negative gate passed; product integration pending |
+| CAP-01 | Capability sets are empty by default; an opted-in workload control plane receives only its exact reviewed allowlist, and ordinary children receive none. | 1 and 2 | Inspect bounding, effective, permitted, inheritable, and ambient sets for the default, supervisor, and child processes; verify omitted capabilities fail. | Private default, supervisor, and child conformance passed; public capability contract pending |
 | LC-01 | Files created by declared identities have expected subordinate ownership; ordinary restart and recreation preserve both the stored allocation and host ownership. | 2 | Stored-allocation and host-ownership inspection before and after ordinary stop/start and recreation through Reploy. | Unproven; deferred to lifecycle work |
 | LC-02 | Generation updates may add, remove, or renumber application identities without rewriting persistent ownership. Exact mappings contain only the current accepted set while removed assignments remain reserved and reactivate on rollback; bounded mappings retain their fixed geometry while the supervisor admits only the current set. Mapping-profile, supervisor-identity, and bounded-geometry changes fail before mutation. | 2 | Lifecycle tests across identity addition, removal, renumbering, and rollback for both profiles; host ownership inspection proving no automatic rewrite; exact-map and supervisor-policy inspection for each generation; dormant-assignment reservation and reactivation checks; and pre-mutation rejection tests for mechanism changes. | Unproven; deferred to lifecycle work |
 | LC-03 | Backup and restore preserve ownership or perform an explicit checked translation. | 2 | Checksummed offline export/import with no workload attached. | Unproven; deferred to storage work |
 | AL-01 | Concurrent allocations cannot overlap, mappings remain reserved while live or retained managed storage uses them, and all external `bind` mounts are rejected before mutation. | 1 | Contended allocation, crash recovery, retention, removal, safe-reuse, and pre-mutation mount-rejection tests. | Unproven; allocator not designed |
 | RV-01 | Revocation stops and removes live workload resources, prevents service-manager or other autonomous restart, and makes further operations fail closed without mutating retained storage or releasing its mapping. | 1 | Active-workload revocation with runtime-resource absence and restart-prevention inspection, followed by recovery tests with retained owned data and its mapping still reserved. | Unproven; revocation not designed |
 | HB-01 | Host bootstrap is explicit, auditable, idempotent, validates that its delegated IDs are exclusive and non-overlapping, and enables later user-level operation without host root. | 1 | Repeated bootstrap, successful user operation, and failures for absent or inconsistent preparation, collisions with local or NSS-provided host principals, overlap with another principal's subordinate delegation, and an identity inventory whose completeness cannot be established. | Unproven; bootstrap not designed |
-| SB-01 | No workload uses privileged mode or gains host-root authority. | 1 | Runtime inspection plus negative host-authority tests. | Unproven; repeated conformance probe pending |
-| SB-02 | The approved seccomp profile is explicitly selected and identifiable in the resolved and effective runtime policy; application processes have `NoNewPrivs: 1` and seccomp filter mode (`Seccomp: 2`); syscalls the approved profile must block fail; the container root filesystem is read-only except for declared writable storage; and namespaces, devices, mounts, and network attachment match declared policy, with distinct network namespaces and no host control socket, undeclared path, or peer-reachable network. | 1 and 2 | Resolved-policy and host/runtime inspection through the supported Podman path plus negative approved-policy syscall, path, cross-workload TCP, cross-workload UDP, and cross-workload Linux abstract Unix-socket tests through supported Reploy interfaces. | Unproven; baseline checked by one-off probe; repeated conformance pending |
+| SB-01 | No workload uses privileged mode or gains host-root authority. | 1 | Runtime inspection plus negative host-authority tests. | Private 1B conformance passed 3 exact and 3 bounded trials; product integration pending |
+| SB-02 | The approved seccomp profile is explicitly selected and identifiable in the resolved and effective runtime policy; application processes have `NoNewPrivs: 1` and seccomp filter mode (`Seccomp: 2`); syscalls the approved profile must block fail while the same valid operation succeeds in an unfiltered control; the container root filesystem is read-only except for declared writable storage; and namespaces, devices, mounts, and network attachment match declared policy, with distinct network namespaces and no host control socket, undeclared path, or peer-reachable network. | 1 and 2 | Resolved-policy and host/runtime inspection through the supported Podman path plus paired filtered-denial and unfiltered-success syscall evidence, negative path checks, and cross-workload TCP, UDP, and Linux abstract Unix-socket tests through supported Reploy interfaces. | Private 1B sandbox conformance passed; supported Reploy integration pending |
 | FS-01 | Trusted filesystem preparation cannot follow symlinks, accept unexpected object types, escape the declared root, recursively rewrite application data, or execute application-provided code. | 2 | Adversarial descriptor-safe preparation tests plus executable and hook canaries proving that trusted preparation never invokes application-provided code; process tracing verifies that any later application-provided execution begins only after entering its final child credentials and capability set. | Unproven; deferred to filesystem design |
 | CF-01 | Disagreement among declarations, locked image, delegation, allocation, and persistent ownership fails before start without state mutation. | 1 and 2 | Deliberate mismatch matrix with before/after state evidence. | Unproven; initial cases required in milestone 1 |
 | SI-01 | Only declared producers and consumers can use a shared Unix socket across otherwise private mappings. | 3 | Positive participant test and negative undeclared-workload test. | Unproven; shared interface not designed |

tools/conformance/multiidentity/Containerfile

@@ -0,0 +1,10 @@
+FROM scratch
+
+COPY --chmod=0755 probe /probe
+COPY --chmod=0755 posix-ipc-probe /posix-ipc-probe
+COPY --chown=100:100 --chmod=6755 probe /probe-setid
+COPY --chmod=0755 probe /probe-filecap
+RUN ["/probe", "stamp-filecap", "/probe-filecap"]
+
+ENTRYPOINT ["/probe"]
+CMD ["supervisor"]