feat(ocap-kernel): configurable vat global allowlist#933
Merged
Conversation
…endowments Extract the hardcoded allowedGlobals from VatSupervisor into a dedicated endowments module with a configurable DEFAULT_ALLOWED_GLOBALS constant. The allowlist now covers all host/Web APIs that are absent from SES compartments (TextEncoder, TextDecoder, URL, URLSearchParams, atob, btoa, AbortController, AbortSignal, setTimeout, clearTimeout, Date). JS intrinsics (ArrayBuffer, BigInt, typed arrays, Intl) are excluded since they are already available in every SES Compartment. VatSupervisor now accepts an optional allowedGlobals parameter (defaults to DEFAULT_ALLOWED_GLOBALS) and logs a warning when a vat requests an unknown global. Includes e2e tests verifying that endowed globals work inside real SES compartments and that host APIs are genuinely absent when not endowed. Closes #813 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- harden(allowedGlobals) in constructor to prevent mutation of custom maps - move DEFAULT_ALLOWED_GLOBALS tests to co-located endowments.test.ts - add happy-path test: no warning when all globals are known - add tamed Date negative test: Date.now throws in secure mode without endowment Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
sirtimid
force-pushed
the
sirtimid/configurable-vat-globals
branch
from
4fcd831 to
8100815
Compare
Contributor
Coverage Report
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
…Supervisor Add allowedGlobalNames option to Kernel.make() so the kernel owner can restrict which globals are available to vats. The names flow through VatManager → VatHandle → initVat RPC to VatSupervisor, which filters DEFAULT_ALLOWED_GLOBALS by the received names. When omitted, all defaults remain available. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Verify that Kernel.make({ allowedGlobalNames }) restricts which globals
reach vats: a kernel that only allows TextEncoder/TextDecoder blocks URL
even when the vat requests it, and omitting the option allows everything.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
rekmarks
reviewed
Apr 14, 2026
Requesting an unknown global now throws before vat code is evaluated, surfacing misconfigurations immediately rather than silently ignoring them. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
rekmarks
approved these changes
Apr 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This is Part 1 of the vat endowments overhaul (closes #813). Part 2 will integrate attenuated endowment factories from
@metamask/snaps-execution-environmentsonce MetaMask/snaps#3957 is merged and released — adding timer teardown on vat termination, anti-timing-attackDate, and crypto-backedMath.random.The hardcoded
allowedGlobalsinVatSupervisoris extracted into a dedicatedendowments.tsmodule and made configurable:DEFAULT_ALLOWED_GLOBALSconstant — a hardened record of host/Web API endowments that SES Compartments do not provide by default. JS intrinsics (ArrayBuffer,BigInt, typed arrays,Intl, etc.) are excluded since they are already available in every Compartment.URL,URLSearchParams,atob,btoa,AbortController,AbortSignalalongside the existingTextEncoder,TextDecoder,setTimeout,clearTimeout,Date.allowedGlobalsonVatSupervisor— optional constructor parameter defaulting toDEFAULT_ALLOWED_GLOBALS. Custom maps are hardened on assignment.Testing
Unit tests in
endowments.test.tsverify the constant's shape and frozen state.VatSupervisor.test.tstests the configurable parameter, the warning behavior (both positive and negative paths viainitVatRPC). E2e tests inkernel-testexercise each endowment inside a real SES Compartment and verify that all host APIs are genuinely absent when not endowed, including that the tamedDate.nowthrows in secure mode without theDateendowment.🤖 Generated with Claude Code
Note
Medium Risk
Changes vat endowment/SES-global handling by expanding and centralizing the allowlist and adding kernel-controlled restrictions, which can affect vat initialization and security boundaries if misconfigured.
Overview
Adds a hardened
DEFAULT_ALLOWED_GLOBALSexport and expands the default endowment set (e.g.URL,URLSearchParams,atob/btoa,AbortController/AbortSignal) used to explicitly provide host/Web globals to vats.Introduces a kernel-level
allowedGlobalNamesoption that is propagated throughVatManager/VatHandleto theinitVatRPC and enforced inVatSupervisorby filtering the allowlist; vats now fail initialization when requesting a global outside the effective allowlist.Adds unit + integration tests (including a new kernel-test vat) to verify each endowment works when granted, is absent when not endowed, and that kernel restrictions reject disallowed globals; updates public exports and changelog accordingly.
Reviewed by Cursor Bugbot for commit a105504. Bugbot is set up for automated code reviews on this repo. Configure here.