Add containerID to CombineLayers and MountBlockCIM request types

containerID is required for all gcs requests in confidential mode. Most of the requests
already include it but CombineLayers and MountBlockCIM request types don't. This commit
adds that to these request types.

Signed-off-by: Amit Barve <ambarve@microsoft.com>

Author: ambarve

internal/gcs-sidecar/handlers.go

@@ -338,7 +338,11 @@ func (b *Bridge) modifySettings(req *request) (err error) {
 
 		case guestresource.ResourceTypeWCOWBlockCims:
 			// This is request to mount the merged cim at given volumeGUID
-			wcowBlockCimMounts := modifyGuestSettingsRequest.Settings.(*guestresource.WCOWBlockCIMMounts)
+			if modifyGuestSettingsRequest.RequestType == guestrequest.RequestTypeRemove {
+				return fmt.Errorf("not implemented")
+			}
+
+			wcowBlockCimMounts := modifyGuestSettingsRequest.Settings.(*guestresource.CWCOWBlockCIMMounts)
 			log.G(ctx).Tracef("WCOWBlockCIMMounts { %v}", wcowBlockCimMounts)
 
 			// The block device takes some time to show up. Wait for a few seconds.
@@ -386,6 +390,11 @@ func (b *Bridge) modifySettings(req *request) (err error) {
 			return nil
 
 		case guestresource.ResourceTypeCWCOWCombinedLayers:
+
+			if modifyGuestSettingsRequest.RequestType == guestrequest.RequestTypeRemove {
+				return fmt.Errorf("not implemented")
+			}
+
 			settings := modifyGuestSettingsRequest.Settings.(*guestresource.CWCOWCombinedLayers)
 			containerID := settings.ContainerID
 			log.G(ctx).Tracef("CWCOWCombinedLayers:: ContainerID: %v, ContainerRootPath: %v, Layers: %v, ScratchPath: %v",

internal/gcs-sidecar/uvm.go

@@ -106,7 +106,7 @@ func unmarshalContainerModifySettings(req *request) (_ *prot.ContainerModifySett
 			modifyGuestSettingsRequest.Settings = wcowMappedVirtualDisk
 
 		case guestresource.ResourceTypeWCOWBlockCims:
-			wcowBlockCimMounts := &guestresource.WCOWBlockCIMMounts{}
+			wcowBlockCimMounts := &guestresource.CWCOWBlockCIMMounts{}
 			if err := commonutils.UnmarshalJSONWithHresult(rawGuestRequest, wcowBlockCimMounts); err != nil {
 				return nil, fmt.Errorf("invalid ResourceTypeWCOWBlockCims request: %w", err)
 			}

internal/layers/wcow_mount.go

@@ -440,7 +440,8 @@ func mountHypervIsolatedWCIFSLayers(ctx context.Context, l *wcowWCIFSLayers, vm
 		})
 	}
 
-	err = vm.CombineLayersWCOW(ctx, hcsLayers, ml.RootFS, hcsschema.WCIFS)
+	// containerID isn't required when using non-confidential pods (WCIFS based layers can't run confidential pods)
+	err = vm.CombineLayersWCOW(ctx, hcsLayers, ml.RootFS, hcsschema.WCIFS, "")
 	if err != nil {
 		return nil, nil, err
 	}
@@ -476,7 +477,7 @@ func mountHypervIsolatedBlockCIMLayers(ctx context.Context, l *wcowBlockCIMLayer
 		"parent layers": l.parentLayers,
 	}).Debug("mounting hyperv isolated block CIM layers")
 
-	mountedCIMs, err := vm.MountBlockCIMs(ctx, l.mergedLayer, l.parentLayers)
+	mountedCIMs, err := vm.MountBlockCIMs(ctx, l.mergedLayer, l.parentLayers, containerID)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to mount block CIMs in UVM: %w", err)
 	}
@@ -524,8 +525,7 @@ func mountHypervIsolatedBlockCIMLayers(ctx context.Context, l *wcowBlockCIMLayer
 		},
 	}
 
-	// TODO(ambarve): Do we need CWCOW specific request type here?
-	err = vm.CombineLayersWCOW(ctx, hcsLayers, ml.RootFS, hcsschema.UnionFS)
+	err = vm.CombineLayersWCOW(ctx, hcsLayers, ml.RootFS, hcsschema.UnionFS, containerID)
 	if err != nil {
 		return nil, nil, err
 	}

internal/protocol/guestresource/resources.go

@@ -114,11 +114,12 @@ type BlockCIMDevice struct {
 	Lun     int32
 }
 
-type WCOWBlockCIMMounts struct {
+type CWCOWBlockCIMMounts struct {
 	// BlockCIMs should be ordered from merged CIM followed by Layer n .. layer 1
-	BlockCIMs  []BlockCIMDevice `json:"BlockCIMs,omitempty"`
-	VolumeGUID guid.GUID        `json:"VolumeGUID,omitempty"`
-	MountFlags uint32           `json:"MountFlags,omitempty"`
+	BlockCIMs   []BlockCIMDevice `json:"BlockCIMs,omitempty"`
+	VolumeGUID  guid.GUID        `json:"VolumeGUID,omitempty"`
+	MountFlags  uint32           `json:"MountFlags,omitempty"`
+	ContainerID string           `json:"ContainerID,omitempty"`
 }
 
 type WCOWMappedVirtualDisk struct {

internal/uvm/cimfs.go

@@ -46,7 +46,7 @@ func (umb *UVMMountedBlockCIMs) Release(ctx context.Context) error {
 	guestReq := guestrequest.ModificationRequest{
 		ResourceType: guestresource.ResourceTypeWCOWBlockCims,
 		RequestType:  guestrequest.RequestTypeRemove,
-		Settings: &guestresource.WCOWBlockCIMMounts{
+		Settings: &guestresource.CWCOWBlockCIMMounts{
 			VolumeGUID: umb.volumeGUID,
 		},
 	}
@@ -67,7 +67,7 @@ func (umb *UVMMountedBlockCIMs) Release(ctx context.Context) error {
 
 // mergedCIM can be nil,
 // sourceCIMs MUST be in the top to bottom order
-func (uvm *UtilityVM) MountBlockCIMs(ctx context.Context, mergedCIM *cimfs.BlockCIM, sourceCIMs []*cimfs.BlockCIM) (_ *UVMMountedBlockCIMs, retErr error) {
+func (uvm *UtilityVM) MountBlockCIMs(ctx context.Context, mergedCIM *cimfs.BlockCIM, sourceCIMs []*cimfs.BlockCIM, containerID string) (_ *UVMMountedBlockCIMs, retErr error) {
 	if len(sourceCIMs) < 1 {
 		return nil, fmt.Errorf("at least 1 source CIM is required")
 	}
@@ -94,10 +94,14 @@ func (uvm *UtilityVM) MountBlockCIMs(ctx context.Context, mergedCIM *cimfs.Block
 		return nil, fmt.Errorf("generated cim mount GUID: %w", err)
 	}
 
-	settings := &guestresource.WCOWBlockCIMMounts{
-		BlockCIMs:  []guestresource.BlockCIMDevice{},
-		VolumeGUID: volumeGUID,
-		MountFlags: cimfs.CimMountBlockDeviceCim,
+	// TODO(ambarve): When inbox GCS adds support for mounting block CIMs, we should
+	// use the appropriate request type for confidential vs regular pods as inbox GCS
+	// may not understand the CWCOWBlockCIMMounts type.
+	settings := &guestresource.CWCOWBlockCIMMounts{
+		BlockCIMs:   []guestresource.BlockCIMDevice{},
+		VolumeGUID:  volumeGUID,
+		MountFlags:  cimfs.CimMountBlockDeviceCim,
+		ContainerID: containerID,
 	}
 
 	umb := &UVMMountedBlockCIMs{

internal/uvm/combine_layers.go

@@ -14,22 +14,41 @@ import (
 // container file system.
 //
 // Note: `layerPaths` and `containerRootPath` are paths from within the UVM.
-func (uvm *UtilityVM) CombineLayersWCOW(ctx context.Context, layerPaths []hcsschema.Layer, containerRootPath string, filterType hcsschema.FileSystemFilterType) error {
+func (uvm *UtilityVM) CombineLayersWCOW(ctx context.Context, layerPaths []hcsschema.Layer, containerRootPath string, filterType hcsschema.FileSystemFilterType, containerID string) error {
 	if uvm.operatingSystem != "windows" {
 		return errNotSupported
 	}
-	msr := &hcsschema.ModifySettingRequest{
-		GuestRequest: guestrequest.ModificationRequest{
-			ResourceType: guestresource.ResourceTypeCombinedLayers,
-			RequestType:  guestrequest.RequestTypeAdd,
-			Settings: guestresource.WCOWCombinedLayers{
-				ContainerRootPath: containerRootPath,
-				Layers:            layerPaths,
-				FilterType:        filterType,
+
+	var modifyRequest *hcsschema.ModifySettingRequest
+	if uvm.HasConfidentialPolicy() {
+		modifyRequest = &hcsschema.ModifySettingRequest{
+			GuestRequest: guestrequest.ModificationRequest{
+				ResourceType: guestresource.ResourceTypeCWCOWCombinedLayers,
+				RequestType:  guestrequest.RequestTypeAdd,
+				Settings: guestresource.CWCOWCombinedLayers{
+					ContainerID: containerID,
+					CombinedLayers: guestresource.WCOWCombinedLayers{
+						ContainerRootPath: containerRootPath,
+						Layers:            layerPaths,
+						FilterType:        filterType,
+					},
+				},
 			},
-		},
+		}
+	} else {
+		modifyRequest = &hcsschema.ModifySettingRequest{
+			GuestRequest: guestrequest.ModificationRequest{
+				ResourceType: guestresource.ResourceTypeCombinedLayers,
+				RequestType:  guestrequest.RequestTypeAdd,
+				Settings: guestresource.WCOWCombinedLayers{
+					ContainerRootPath: containerRootPath,
+					Layers:            layerPaths,
+					FilterType:        filterType,
+				},
+			},
+		}
 	}
-	return uvm.modify(ctx, msr)
+	return uvm.modify(ctx, modifyRequest)
 }
 
 // CombineLayersLCOW combines `layerPaths` and optionally `scratchPath` into an

internal/uvm/security_policy.go

@@ -120,3 +120,14 @@ func (uvm *UtilityVM) InjectPolicyFragment(ctx context.Context, fragment *ctrdta
 	}
 	return uvm.modify(ctx, mod)
 }
+
+// returns if this instance of the UtilityVM is created with confidential policy
+func (uvm *UtilityVM) HasConfidentialPolicy() bool {
+	switch opts := uvm.createOpts.(type) {
+	case *OptionsWCOW:
+		return opts.SecurityPolicyEnabled
+	case *OptionsLCOW:
+		return opts.SecurityPolicyEnabled
+	}
+	return false
+}