Found while reviewing #849.
What happens
has_network_policy reconstructs intent from values plus one presence bit, but it uses default_network_policy_present and never network_specified:
src/backends/lxc/common/src/state_aware.rs:138-147
...|| policy.allow_local_network || policy.network_proxy.is_enabled() || policy.default_network_policy_present
The parser sets three different bits:
config_parser.rs:978 -- policy.network_specified = cfg.network.is_some(); (any network block, including {})config_parser.rs:1024-1031 -- default_network_policy_present set only inside if let Some(p) = net.default_policyconfig_parser.rs:983-989 -- network_mode_specified for allow_local_network.is_some() and friends
So:
network: {} gives network_specified=true, default_network_policy_present=false, all values default, so has_network_policy returns false.allowLocalNetwork: false gives the same result.
Both are then accepted by state_aware.rs:184 on provision, exec, stop, and deprovision, even though the documented phase contract rejects a network section on those phases (docs/state-aware-lifecycle/mxc-state-aware-sandbox-api.md:1691).
Severity, stated honestly
network: {} imposes no restriction, so this is a contract-consistency divergence, not a fail-open. It is inconsistent because the code already rejects defaultPolicy: allow through the presence bit while silently accepting these two forms.
Not a missed second copy
There is no duplicate of this logic to fix. requires_firewall_enforcement (state_aware.rs:167-171) omits network_specified deliberately and correctly -- a no-op network section genuinely needs no enforcement.
Suggested direction
Add || policy.network_specified to has_network_policy. This changes the accept/reject contract on four phases, so it wants a deliberate decision rather than a drive-by fix.
Found while reviewing #849.
What happens
has_network_policyreconstructs intent from values plus one presence bit, but it usesdefault_network_policy_presentand nevernetwork_specified:src/backends/lxc/common/src/state_aware.rs:138-147...|| policy.allow_local_network || policy.network_proxy.is_enabled() || policy.default_network_policy_presentThe parser sets three different bits:
config_parser.rs:978--policy.network_specified = cfg.network.is_some();(any network block, including{})config_parser.rs:1024-1031--default_network_policy_presentset only insideif let Some(p) = net.default_policyconfig_parser.rs:983-989--network_mode_specifiedforallow_local_network.is_some()and friendsSo:
network: {}givesnetwork_specified=true,default_network_policy_present=false, all values default, sohas_network_policyreturns false.allowLocalNetwork: falsegives the same result.Both are then accepted by
state_aware.rs:184on provision, exec, stop, and deprovision, even though the documented phase contract rejects a network section on those phases (docs/state-aware-lifecycle/mxc-state-aware-sandbox-api.md:1691).Severity, stated honestly
network: {}imposes no restriction, so this is a contract-consistency divergence, not a fail-open. It is inconsistent because the code already rejectsdefaultPolicy: allowthrough the presence bit while silently accepting these two forms.Not a missed second copy
There is no duplicate of this logic to fix.
requires_firewall_enforcement(state_aware.rs:167-171) omitsnetwork_specifieddeliberately and correctly -- a no-op network section genuinely needs no enforcement.Suggested direction
Add
|| policy.network_specifiedtohas_network_policy. This changes the accept/reject contract on four phases, so it wants a deliberate decision rather than a drive-by fix.