fix(profile): reject special resolver modules

Author: schickling

Cargo.lock

@@ -19,12 +19,13 @@ wasmtime = { version = "48.0.1", optional = true, default-features = false, feat
     "std",
     "wat",
 ] }
+libc = { version = "0.2", optional = true }
 
 [dev-dependencies]
 tempfile = "3"
 
 [features]
-wasm-resolver = ["dep:wasmtime"]
+wasm-resolver = ["dep:libc", "dep:wasmtime"]
 
 [[example]]
 name = "wasm_bench"

crates/agent-spec/Cargo.toml

@@ -187,8 +187,7 @@ fn read_module_bounded(
 ) -> Result<Vec<u8>, WasmResolveError> {
     use std::io::Read as _;
 
-    let file = std::fs::File::open(path)
-        .map_err(|error| WasmResolveError::Instantiation(error.to_string()))?;
+    let file = open_module_file(path)?;
     let declared_len = file
         .metadata()
         .map_err(|error| WasmResolveError::Instantiation(error.to_string()))?
@@ -210,6 +209,45 @@ fn read_module_bounded(
     Ok(bytes)
 }
 
+#[cfg(unix)]
+fn open_module_file(path: &std::path::Path) -> Result<std::fs::File, WasmResolveError> {
+    use std::os::unix::fs::OpenOptionsExt as _;
+
+    let file = std::fs::OpenOptions::new()
+        .read(true)
+        .custom_flags(libc::O_CLOEXEC | libc::O_NOFOLLOW | libc::O_NONBLOCK)
+        .open(path)
+        .map_err(|error| WasmResolveError::Instantiation(error.to_string()))?;
+    if !file
+        .metadata()
+        .map_err(|error| WasmResolveError::Instantiation(error.to_string()))?
+        .file_type()
+        .is_file()
+    {
+        return Err(WasmResolveError::Instantiation(
+            "resolver module is not a regular file".to_owned(),
+        ));
+    }
+    Ok(file)
+}
+
+#[cfg(not(unix))]
+fn open_module_file(path: &std::path::Path) -> Result<std::fs::File, WasmResolveError> {
+    let file = std::fs::File::open(path)
+        .map_err(|error| WasmResolveError::Instantiation(error.to_string()))?;
+    if !file
+        .metadata()
+        .map_err(|error| WasmResolveError::Instantiation(error.to_string()))?
+        .file_type()
+        .is_file()
+    {
+        return Err(WasmResolveError::Instantiation(
+            "resolver module is not a regular file".to_owned(),
+        ));
+    }
+    Ok(file)
+}
+
 fn reject_symlink_components(
     agent_dir: &std::path::Path,
     path: &std::path::Path,

crates/agent-spec/src/profile_wasm.rs

@@ -369,6 +369,25 @@ fn oversized_module_is_rejected_before_wasmtime_compilation() {
     }
 }
 
+#[cfg(unix)]
+#[test]
+fn special_file_module_is_rejected_without_blocking() {
+    use std::os::unix::ffi::OsStrExt as _;
+
+    let temp = tempfile::tempdir().expect("module directory");
+    let fifo = temp.path().join("resolver.fifo");
+    let fifo_c = std::ffi::CString::new(fifo.as_os_str().as_bytes()).expect("FIFO path");
+    // SAFETY: the path is NUL-terminated and points into the live temporary directory.
+    assert_eq!(unsafe { libc::mkfifo(fifo_c.as_ptr(), 0o600) }, 0);
+    match WasmResolver::load(&fifo) {
+        Err(WasmResolveError::Instantiation(error)) => {
+            assert!(error.contains("regular file"), "got: {error}");
+        }
+        Err(other) => panic!("expected special-file refusal, got {other}"),
+        Ok(_) => panic!("FIFO resolver unexpectedly compiled"),
+    }
+}
+
 #[test]
 fn registry_folds_every_guest_failure_into_unwatchable_and_keeps_resolving() {
     // A broken module registered under a scheme: every resolution fails contained, with the

crates/agent-spec/tests/profile_wasm.rs

@@ -61,10 +61,12 @@ accepted rationale is recorded in
 ### Must contain resolver behavior
 
 - **PROFILE-R04 Closed sandbox:** Resolver modules run with no WASI and no host
-  imports, under a finite module-byte admission bound, per-call fuel budget,
+  imports. Module files are opened nonblocking and accepted only as regular
+  files, under a finite module-byte admission bound, per-call fuel budget,
   linear-memory cap, and table-element cap. Traps, infinite loops, missing
-  exports, invalid memory ranges, malformed output, and oversized module,
-  table, or allocation attempts cannot unwind into or terminate the supervisor.
+  exports, invalid memory ranges, malformed output, and special or oversized
+  module, table, or allocation attempts cannot unwind into or terminate the
+  supervisor.
 - **PROFILE-R05 Host-enforced path boundary:** A module's non-empty returned
   path is decoded and normalized by the host and accepted only when it remains
   inside the agent directory. Every root, ancestor, and final component is

docs/vrs/07-resource-profile/requirements.md

@@ -164,15 +164,16 @@ metadata alone is never treated as a durable proof.
 
 ## Runtime containment (PROFILE-R04..R07)
 
-Each module file is read through a 16 MiB admission cap before validation or
-compilation, then compiled once per module path and shared by registry clones.
+Each module is opened nonblocking and no-follow, accepted only as a regular
+file, and read through a 16 MiB admission cap before validation or compilation.
+It is then compiled once per module path and shared by registry clones.
 Each resolution creates a fresh `Store` and `Instance`. One fuel allowance
 covers the module start function and the first resolution call; a reused
 instance receives one fresh allowance before each later call:
 
 | Boundary | Contract |
 | --- | --- |
-| Module bytes | 16 MiB maximum before Wasmtime compilation |
+| Module file | regular, no-follow, nonblocking open; 16 MiB maximum before Wasmtime compilation |
 | Imports | none; import-requiring modules fail instantiation |
 | Fuel | 5,000,000 fuel units for start + first call; same budget per later call |
 | Linear memory | 64 MiB maximum |
@@ -185,7 +186,7 @@ Failure taxonomy:
 
 | Failure | SDK result | Supervisor effect |
 | --- | --- | --- |
-| oversized module or module load/instantiation | `Instantiation` | binding unwatchable; reconcile warning; supervisor lives |
+| special/oversized module or module load/instantiation | `Instantiation` | binding unwatchable; reconcile warning; supervisor lives |
 | missing `memory`, `alloc`, or `resolve` | `MissingExport` | same |
 | unreachable/stack/memory trap | `Trap` | same |
 | infinite start function or call | `FuelExhausted` | same |