c-wcow policy tooling - #2870
Merged
Merged
Conversation
Maksim An (anmaxvl)
force-pushed
the
wcow-policy-tooling
branch
from
August 11, 2026 09:20
5a72dc5 to
7d654a6
Compare
There was a problem hiding this comment.
Pull request overview
This PR extends the security policy tooling and library to support C-WCOW (Windows) policy generation using Block CIM digests, introduces a standalone blockcimdump inspection tool, and removes legacy JSON policy output in favor of Rego.
Changes:
- Add Windows container policy config/model support (
windows_container), plus Windows-specific policy/fragment marshalling APIs. - Update
securitypolicytoolto target Linux vs Windows (-os) and restrict output types to Rego/fragment. - Add Windows Block CIM digest computation helpers and a new
blockcimdumptool for inspecting sealed root hashes.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| test/pkg/securitypolicy/policy.go | Add test helpers to build Base64 Windows policies from config opts. |
| pkg/securitypolicy/windows_tooling_test.go | Add unit tests for Windows container policy creation/marshalling and escaping. |
| pkg/securitypolicy/securitypolicy.go | Add WindowsContainerConfig + PolicyConfig.WindowsContainers and Windows container policy builder. |
| pkg/securitypolicy/securitypolicy_marshal.go | Make Rego the default marshaller; add Windows policy/fragment marshalling; improve string escaping. |
| pkg/securitypolicy/securitypolicy_internal.go | Add Windows containers to fragments and include MountedCim in internal conversion. |
| pkg/securitypolicy/opts.go | Add Windows container config opts and WithWindowsContainers. |
| internal/tools/securitypolicy/README.md | Update docs for Rego-only output and add C-WCOW usage/examples. |
| internal/tools/securitypolicy/main.go | Add `-os [linux |
| internal/tools/securitypolicy/helpers/windows.go | Implement Windows Block CIM digest computation via CIM APIs. |
| internal/tools/securitypolicy/helpers/windows_test.go | Add validation test for Windows container configs (requires image_name). |
| internal/tools/securitypolicy/helpers/windows_others.go | Provide non-Windows stub error for digest computation. |
| internal/tools/securitypolicy/helpers/helpers.go | Add Windows-container policy materialization from image-based configs. |
| internal/tools/blockcimdump/main.go | New CLI tool to inspect Block CIM metadata/root hash without CIM APIs. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+75
to
+80
| func TestMarshalWindowsPolicyRejectsJSON(t *testing.T) { | ||
| _, err := MarshalWindowsPolicy("json", false, nil, nil, nil, false, false, false, false, false, false, false, false) | ||
| if err == nil { | ||
| t.Fatal("expected JSON marshalling to be rejected for Windows policies") | ||
| } | ||
| } |
Maksim An (anmaxvl)
force-pushed
the
wcow-policy-tooling
branch
from
August 11, 2026 10:33
7d654a6 to
cd674e7
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Maksim An (anmaxvl)
force-pushed
the
wcow-policy-tooling
branch
from
August 11, 2026 11:19
cd674e7 to
0d1b62b
Compare
Hamza El-Saawy (helsaawy)
approved these changes
Aug 12, 2026
Extend the securitypolicy package and tooling to generate rego policies for Confidential WCOW (Windows) images, mirroring the existing C-LCOW image-based flow. The runtime enforcement side (verified CIM mounts) already existed; this adds the authoring side so a matching policy can be produced from an image reference. Key changes: - pkg/securitypolicy: add WindowsContainerConfig (image-based) and CreateWindowsContainerPolicy, WithWindows* opts, and Windows rego/ fragment marshalling. Windows policy is rego only; the JSON marshaller is rejected for Windows. regoString() escapes backslashes/quotes so Windows paths and user strings survive marshalling. - internal/tools/securitypolicy: add -os linux|windows and route marshalling per OS; PolicyWindowsContainersFromConfigs fetches the windows platform image and computes verified Block CIM digests. - helpers/windows.go: import each layer into a verified single-file Block CIM and read its sealed root digest. Each layer is imported into its own directory with CimName "layer.cim" (merged: "merged.cim"), exactly matching containerd's cimfs snapshotter/differ, since the embedded CimName contributes to the sealed root digest. Setting SECURITYPOLICY_BLOCKCIM_DIR preserves the intermediate *.bcim for inspection. Existing LCOW policy generation behavior is intentionally preserved; the Windows path is only taken for windows_container config entries. Signed-off-by: Maksim An <maksiman@microsoft.com>
Maksim An (anmaxvl)
force-pushed
the
wcow-policy-tooling
branch
from
August 12, 2026 17:09
0d1b62b to
d70d7ec
Compare
Maksim An (anmaxvl)
changed the title
ryankeithster
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add Confidential WCOW security-policy generation + a block CIM root-hash dumper
Summary
This PR adds authoring-side support for generating Confidential WCOW (Windows) security policies, mirroring the existing C‑LCOW image-based flow. The runtime enforcement side (verified CIM mounts) already existed; this fills in the policy-generation side so a policy can be produced from an image reference and will match what the runtime computes at mount time.
Changes
securitypolicy: Confidential WCOW policy generationWindowsContainerConfig(image-based) andCreateWindowsContainerPolicy,WithWindows*options, and Windows rego/fragment marshalling. Windows policy is rego-only; the JSON marshaller is rejected for Windows and removed as a registered marshaller.regoString()escapes backslashes/quotes so Windows paths and user strings survive marshalling.-os linux|windowsflag routing marshalling per OS;PolicyWindowsContainersFromConfigsfetches the Windows-platform image and computes verified Block CIM digests.helpers/windows.go: imports each layer into a verified single-file Block CIM and reads its sealed root digest. Each layer is imported into its own directory withCimName = "layer.cim"(merged:"merged.cim"), matching containerd's snapshotter/differ exactly, since the embeddedCimNamecontributes to the digest.SECURITYPOLICY_BLOCKCIM_DIRpreserves the intermediate*.bcimfor inspection.windows_containerconfig entries.Testing
go buildofpkg/securitypolicy/...,internal/tools/..., and the test module — clean.go test pkg.— pass.