Default to deny all security policy.

internal/guest/runtime/hcsv2/uvm.go

@@ -16,7 +16,7 @@ import (
  "syscall"
  "time"
 
- shellwords "github.com/mattn/go-shellwords"
+ "github.com/mattn/go-shellwords"
  "github.com/pkg/errors"
 
  "github.com/Microsoft/hcsshim/internal/guest/gcserr"
@@ -66,7 +66,7 @@ func NewHost(rtime runtime.Runtime, vsock transport.Transport) *Host {
  rtime: rtime,
  vsock: vsock,
  securityPolicyEnforcerSet: false,
- securityPolicyEnforcer: &securitypolicy.OpenDoorSecurityPolicyEnforcer{},
+ securityPolicyEnforcer: &securitypolicy.ClosedDoorSecurityPolicyEnforcer{},
  }
 }
 

internal/tools/securitypolicy/README.md

@@ -159,4 +159,3 @@ isn't in the TOML configuration.
 If the version of the pause container changes from 3.1, you will need to update
 the hardcoded root hash by running the `dmverity-vhd` to compute the root hash
 for the new container and update this tool accordingly.
-

internal/uvm/security_policy.go

@@ -20,7 +20,12 @@ func (uvm *UtilityVM) SetSecurityPolicy(ctx context.Context, policy string) erro
  }
 
  if policy == "" {
- return nil
+ openDoorPolicy := securitypolicy.NewOpenDoorPolicy()
+ policyString, err := openDoorPolicy.EncodeToString()
+ if err != nil {
+ return err
+ }
+ policy = policyString
  }
 
  uvm.m.Lock()

pkg/securitypolicy/securitypolicy.go

@@ -160,12 +160,13 @@ type SecurityPolicy struct {
  Containers Containers `json:"containers"`
 }
 
+// EncodeToString returns base64 encoded string representation of SecurityPolicy.
 func (sp *SecurityPolicy) EncodeToString() (string, error) {
- j, err := json.Marshal(sp)
+ jsn, err := json.Marshal(sp)
  if err != nil {
  return "", err
  }
- return base64.StdEncoding.EncodeToString(j), nil
+ return base64.StdEncoding.EncodeToString(jsn), nil
 }
 
 type Containers struct {