fix(podman): support keep-id runtime groups

Signed-off-by: Evan Lezar <elezar@nvidia.com>

refactor(podman): generalize keep-id group handling

Signed-off-by: Evan Lezar <elezar@nvidia.com>

Author: elezar

crates/openshell-driver-podman/src/driver.rs

@@ -978,6 +978,9 @@ impl PodmanComputeDriver {
                         &workload_id,
                         &uuid::Uuid::new_v4().to_string(),
                         &identity,
+                        crate::isolation::userns_preserves_host_groups(
+                            self.config.userns.as_deref(),
+                        ),
                         child_env,
                         &launch_authentication,
                     )?;
@@ -1319,6 +1322,7 @@ impl PodmanComputeDriver {
                 &container_id,
                 generation.as_str(),
                 &restart_metadata.workload_identity,
+                crate::isolation::userns_preserves_host_groups(self.config.userns.as_deref()),
                 restart_metadata.child_env,
                 &launch_authentication,
             )?;

crates/openshell-driver-podman/src/isolation.rs

@@ -13,6 +13,7 @@ use openshell_core::proto::compute::v1::DriverSandbox;
 use openshell_isolation_interface::contract::{
     OuterFenceGuarantee, OuterFenceGuarantees, ResolvedWorkloadIdentity,
 };
+use openshell_sandbox_backend::ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM;
 use openshell_sandbox_backend::boundary_protocol::{
     BoundaryConfig, BoundaryListener, GatewayVerificationKey, SandboxRuntimeDescriptor,
     SandboxTlsClientConfig, SandboxTlsServerConfig, SandboxTransport,
@@ -70,6 +71,12 @@ pub fn channel_volume_name(id: &str) -> String {
     format!("openshell-channel-{id}")
 }
 
+/// `keep-id` may retain the gateway user's supplementary groups in the
+/// container. Other user-namespace modes, including `auto`, do not.
+pub fn userns_preserves_host_groups(userns: Option<&str>) -> bool {
+    userns.is_some_and(|mode| mode.split(':').next() == Some("keep-id"))
+}
+
 fn invalid(error: impl std::fmt::Display) -> ComputeDriverError {
     ComputeDriverError::Precondition(error.to_string())
 }
@@ -195,19 +202,26 @@ pub fn bootstrap_archives(
     container_id: &str,
     generation: &str,
     identity: &ResolvedWorkloadIdentity,
+    allow_extra_supplementary_groups: bool,
     child_env: HashMap<String, String>,
     launch_authentication: &openshell_core::jwt::SandboxLaunchAuthentication,
 ) -> Result<BootstrapArchives, ComputeDriverError> {
     launch_authentication.validate().map_err(invalid)?;
     let session_id = launch_authentication.supervisor.session_id;
     let tls = generate_sandbox_tls_material(session_id).map_err(invalid)?;
-    let resource_claims = BTreeMap::from([
+    let mut resource_claims = BTreeMap::from([
         ("podman.container_id".into(), container_id.into()),
         (
             "podman.image_identity".into(),
             identity.resource_digest.clone(),
         ),
     ]);
+    if allow_extra_supplementary_groups {
+        resource_claims.insert(
+            ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM.into(),
+            "true".into(),
+        );
+    }
     let runtime_generation = launch_authentication
         .supervisor
         .runtime_generation
@@ -496,6 +510,7 @@ mod tests {
             "container",
             "generation-1",
             &identity,
+            false,
             child_env.clone(),
             &authentication,
         )
@@ -541,6 +556,11 @@ mod tests {
             .outer_fence
             .validate(&runtime_descriptor.generation)
             .unwrap();
+        assert!(
+            !config
+                .resource_claims
+                .contains_key(ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM)
+        );
         let restart_metadata: RestartMetadata = serde_json::from_slice(
             supervisor
                 .get(&PathBuf::from(
@@ -558,4 +578,15 @@ mod tests {
                 .any(|window| window == b"PRIVATE KEY")
         );
     }
+
+    #[test]
+    fn keep_id_is_the_only_userns_mode_that_preserves_host_groups() {
+        assert!(userns_preserves_host_groups(Some("keep-id")));
+        assert!(userns_preserves_host_groups(Some(
+            "keep-id:uid=1000,gid=1000"
+        )));
+        assert!(!userns_preserves_host_groups(Some("auto")));
+        assert!(!userns_preserves_host_groups(Some("private")));
+        assert!(!userns_preserves_host_groups(None));
+    }
 }

crates/openshell-sandbox-backend/src/lib.rs

@@ -21,6 +21,11 @@ pub const BACKEND_NAME: &str = "openshell-sandbox";
 /// Resource claim set by compute drivers when the workload requests GPU access.
 pub const GPU_RESOURCE_CLAIM: &str = "openshell.gpu";
 
+/// Resource claim set when the runtime may retain supplementary groups in
+/// addition to the image-derived workload identity.
+pub const ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM: &str =
+    "openshell.identity.allow_extra_supplementary_groups";
+
 /// Memory-backed parent used for supervisor CA material.
 pub const SUPERVISOR_CA_RUNTIME_ROOT: &str = "/run/openshell-supervisor-ca";
 

crates/openshell-sandbox/src/boundary_server.rs

@@ -39,7 +39,6 @@ mod linux {
         BoundaryConfirmation, BoundaryExec, BoundaryLoopbackConnector, BoundaryProcess,
         BoundaryTerminal, ExecSession, LoopbackTarget, ResolvedWorkloadIdentity,
     };
-    use openshell_sandbox_backend::GPU_RESOURCE_CLAIM;
     use openshell_sandbox_backend::mediation::{
         self, DnsQueryWire, MediationFrame, MediationFrameKind,
     };
@@ -53,6 +52,9 @@ mod linux {
         SandboxConnectionId, SandboxConnectionRegistry, SandboxProtocolAuthenticator,
         SandboxProtocolPrincipal,
     };
+    use openshell_sandbox_backend::{
+        ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM, GPU_RESOURCE_CLAIM,
+    };
     use tokio::io::{AsyncReadExt as _, AsyncWriteExt as _};
     use tokio_stream::wrappers::ReceiverStream;
 
@@ -389,6 +391,10 @@ mod linux {
             .resource_claims
             .get(GPU_RESOURCE_CLAIM)
             .is_some_and(|value| value == "true")
+            || config
+                .resource_claims
+                .get(ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM)
+                .is_some_and(|value| value == "true")
     }
 
     fn supplementary_groups_match(actual: &[u32], expected: &[u32], allow_extra: bool) -> bool {
@@ -3834,6 +3840,33 @@ mod linux {
             assert!(!supplementary_groups_match(&[44, 992], &[1001], true));
         }
 
+        #[test]
+        fn generic_identity_claim_allows_runtime_supplementary_groups() {
+            let config = BoundaryConfig {
+                boundary_id: "sandbox-1".to_string(),
+                generation: "generation-1".to_string(),
+                session_id: test_session_id(),
+                session_rotation: openshell_core::jwt::SessionRotation::new(1)
+                    .expect("session rotation"),
+                auth_epoch: CredentialEpoch::new(1).expect("auth epoch"),
+                gateway_id: "test-gateway".to_string(),
+                verification_keys: vec![],
+                listener: BoundaryListenerConfig::Vsock {
+                    control_port: 5500,
+                    tls: placeholder_server_tls(),
+                },
+                resource_claims: std::collections::BTreeMap::from([(
+                    ALLOW_EXTRA_SUPPLEMENTARY_GROUPS_RESOURCE_CLAIM.to_string(),
+                    "true".to_string(),
+                )]),
+                resource_claim_files: std::collections::BTreeMap::new(),
+                workload_identity: test_workload_identity(),
+                outer_fence: test_outer_fence(),
+                child_env: std::collections::HashMap::new(),
+            };
+            assert!(allows_runtime_supplementary_groups(&config));
+        }
+
         #[test]
         fn control_connection_slots_bound_authenticated_sessions() {
             let active = Arc::new(AtomicUsize::new(MAX_CONTROL_CONNECTIONS - 1));

tests/suites/drivers/podman/tests/default_userns.rs

@@ -19,8 +19,8 @@ const PODMAN_TEST_IMAGE_ENV: &str = "OPENSHELL_PODMAN_TEST_IMAGE";
 /// Verify that the gateway's user-namespace configuration matches Podman's
 /// direct behavior for the same profile.
 ///
-/// The test creates a sandbox and compares its user-namespace mapping with the
-/// direct-Podman reference stored at
+/// The test runs a short-lived sandbox command and compares its user-namespace
+/// mapping with the direct-Podman reference stored at
 /// `OPENSHELL_TEST_INPUT_DIR/reference-uid-map`. The tmachine pre-test
 /// playbook creates that reference in the same gateway-user context. This deliberately
 /// avoids baking a particular Podman mapping into OpenShell's test contract.
@@ -59,38 +59,21 @@ async fn configured_userns_matches_podman_reference() {
         if let Some(image) = workload_image.as_deref() {
             create_args.extend(["--from", image]);
         }
-        create_args.extend(["--detach", "--", "sleep", "infinity"]);
-        let create = runner
-            .step("userns/create")
-            .description("sandbox from the configured test image is created")
-            .with_timeout(SANDBOX_TIMEOUT)
-            .run(&create_args)
-            .await
-            .map_err(|error| error.to_string())?;
-        create.require_success()?;
-        let exec = runner
+        create_args.extend(["--no-tty", "--", "cat", "/proc/self/uid_map"]);
+        let run = runner
             .step("userns/uid-map")
             .description("sandbox exposes its UID map")
             .with_timeout(SANDBOX_TIMEOUT)
-            .run(&[
-                "sandbox",
-                "exec",
-                "--name",
-                &sandbox_name,
-                "--no-tty",
-                "--",
-                "cat",
-                "/proc/self/uid_map",
-            ])
+            .run(&create_args)
             .await
             .map_err(|error| error.to_string())?;
-        exec.require_success()?;
-        let sandbox_uid_map = normalize_uid_map(exec.stdout()).ok_or_else(|| {
-            exec.failure_diagnostic("sandbox returns a non-empty UID map")
+        run.require_success()?;
+        let sandbox_uid_map = normalize_uid_map(run.stdout()).ok_or_else(|| {
+            run.failure_diagnostic("sandbox returns a non-empty UID map")
         })?;
         if sandbox_uid_map != expected_uid_map {
             return Err(format!(
-                "sandbox UID map differs from direct Podman default:\nexpected:\n{expected_uid_map}\nactual:\n{sandbox_uid_map}"
+                "sandbox UID map differs from the direct Podman reference:\nexpected:\n{expected_uid_map}\nactual:\n{sandbox_uid_map}"
             ));
         }
         Ok(())