58 lines
2.7 KiB
Plaintext
58 lines
2.7 KiB
Plaintext
:title
|
|
Blocked functions (hostcall blocklist)
|
|
|
|
:content
|
|
UCE units reach the operating system only through a fixed set of `uce_host_*`
|
|
membrane hostcalls (see the runtime architecture). A server operator can
|
|
**disable individual hostcalls** so a deployment exposes only the capabilities it
|
|
wants — for example turning off `shell_exec` or `http_request` on a hardened
|
|
host. A unit that calls a disabled function fails at request time with the
|
|
configurable error page, stating exactly which function was blocked and why.
|
|
|
|
## Configuration
|
|
|
|
Set `UCE_HOSTCALL_BLOCKLIST` in `/etc/uce/settings.cfg` to a comma-separated list
|
|
of hostcall names. Names may be given bare (`shell_exec`) or fully qualified
|
|
(`uce_host_shell_exec`); whitespace is ignored. Empty (the default) blocks
|
|
nothing.
|
|
|
|
|
|
Changes take effect on **restart** (`systemctl restart uce`). There is no hot
|
|
reload — the list is parsed once per worker process into a fast lookup, so an
|
|
empty list has zero runtime cost and a non-empty list costs only a single check
|
|
per hostcall at workspace birth (never per call).
|
|
|
|
## Behaviour when a blocked function is called
|
|
|
|
The blocked hostcall resolves to a trap stub instead of its real implementation.
|
|
When a unit invokes it, the request fails into the runtime error page with:
|
|
|
|
- error type `policy_blocked` (so a custom error page template can special-case it),
|
|
- a title `function disabled by server policy`,
|
|
- a message naming the exact function, e.g. *"this unit called uce_host_shell_exec,
|
|
which is disabled on this server by configuration (UCE_HOSTCALL_BLOCKLIST)"*.
|
|
|
|
The worker is unharmed (it is a clean guest trap, like any other), and only the
|
|
offending request fails. A unit cannot catch this — blocking is enforcement, not
|
|
a soft signal.
|
|
|
|
## What can and cannot be blocked
|
|
|
|
Any `uce_host_*` capability hostcall can be listed — file I/O, `shell_exec` /
|
|
`shell_spawn`, `http_request`, `mysql`, sockets, memcache, crypto, the job
|
|
registry, etc. (the full set is the membrane list in the runtime architecture
|
|
doc and `src/wasm/core_hostcalls.syms`).
|
|
|
|
A small core set the runtime itself needs is **exempt** and ignored even if
|
|
listed, so a deployment cannot be bricked by an over-broad blocklist:
|
|
`component_resolve` (used for `component()` / unit rendering).
|
|
|
|
## Notes
|
|
|
|
- No recompilation is required (neither the wasm core nor the native binary) —
|
|
this is pure runtime configuration; blocked hostcalls still exist as imports,
|
|
they simply resolve to a trap.
|
|
- Pure-compute library functions that are NOT hostcalls (string ops, `DValue`
|
|
methods, hashing helpers like `gen_noise`, etc.) are not OS capabilities and
|
|
cannot be blocked this way — only `uce_host_*` membrane calls are gateable.
|