capsule: refuse to sign a manifest the source never declared #1

Open

nonos-sync wants to merge 1 commit from nonos-sync/gh-7 into main AGit

nonos-sync commented

2026-09-11 11:23:04 -04:00

Member

An application declares its capabilities in its own source. The SDK compiles that declaration into a .nonos.caps section of the binary. This compares the section against CAPSULE_REQUIRED_CAPS in the manifest, and does it before signing.

Before, not after, is the point. A manifest granting powers the source never requested must not exist in signed form at all, because the instant it does, somebody can install it.

A mismatch reports both directions, since they are different problems:

granted but not declared is a security defect the kernel will honour and nobody will notice
declared but not granted is a program that fails when it tries

A section rather than a symbol, because release builds link with --strip-all. A check that verifies in development and silently stops running in the build that ships is worse than no check, because you believe in it.

Also drops the hardcoded x86_64-nonos-user from the build rule so a capsule can name its own target, with the pipeline setting applying otherwise.

Needs scripts/check_declared_caps.py from the SDK PR in nonos-micro-kernel.

Opened on GitHub by eKisNonos as pull request 7. Review and merge happen there while this repository is kept in step from GitHub; this copy follows it, and is marked merged or closed when it is.

An application declares its capabilities in its own source. The SDK compiles that declaration into a `.nonos.caps` section of the binary. This compares the section against `CAPSULE_REQUIRED_CAPS` in the manifest, and does it **before** signing. Before, not after, is the point. A manifest granting powers the source never requested must not exist in signed form at all, because the instant it does, somebody can install it. A mismatch reports both directions, since they are different problems: - granted but not declared is a security defect the kernel will honour and nobody will notice - declared but not granted is a program that fails when it tries A section rather than a symbol, because release builds link with `--strip-all`. A check that verifies in development and silently stops running in the build that ships is worse than no check, because you believe in it. Also drops the hardcoded `x86_64-nonos-user` from the build rule so a capsule can name its own target, with the pipeline setting applying otherwise. Needs `scripts/check_declared_caps.py` from the SDK PR in nonos-micro-kernel. --- Opened on GitHub by eKisNonos as [pull request 7](https://github.com/NON-OS/nonos-mk/pull/7). Review and merge happen there while this repository is kept in step from GitHub; this copy follows it, and is marked merged or closed when it is.

nonos-sync added 1 commit

2026-09-11 11:23:04 -04:00

capsule: refuse to sign a manifest the source never declared d1e2b7c643

The capability section the compiler emits is compared against the manifest
before the signature, not after. A manifest granting more than the source
asked for must not exist in signed form, because the moment it does somebody
can install it.

The target is no longer hardcoded to x86_64-nonos-user in the build rule, so
a capsule can name its own and the pipeline setting applies otherwise.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin +refs/pull/1/head:nonos-sync/gh-7

git switch nonos-sync/gh-7

No reviewers

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

NON-OS/nonos-mk!1

No description provided.

Rows
Columns