GCS-BOOT-02: Bootstrap bucket rejects injection-shaped object writes¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | GCP Confidential Space (AMD SEV-SNP) |
| Lifecycle stage | deploy |
| Mode | Active: writes and then removes probe objects. Skipped with --read-only. |
What a failure enables¶
- Workload keys released to tampered code
What it checks¶
It passes when:
- State bucket refused all … injection-shaped canary writes (writes are not open to the audit identity).
Example failures:
- State bucket accepted …/… injection-shaped object writes across classes: …. A bootstrap consumer that joins these names onto a local path without sanitizing gets arbitrary file write (boot-time RCE — the boot-time object-name-injection class).
How to fix¶
- Scope object-write on the state bucket to the attested workload identity only (close the write surface), AND sanitize downloaded object names enclave-side: reject any name whose normalized path escapes the intended state directory, decode once and re-check, and refuse absolute paths.
- Scope object-write to the attested workload identity and sanitize downloaded object names enclave-side (reject normalized paths that escape the state dir; refuse absolute paths; decode once and re-check).
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gcs-bucket specified; skipping check.
ERROR:
- Could not initialize GCS probe: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gcp-project |
GCP project ID. |
--gcs-bucket |
GCS bucket holding bootstrap state. |
Permissions¶
The cloud API calls this check makes, read from the scanner's source:
| Cloud | API call | Permission | Access |
|---|---|---|---|
| Google Cloud | storage.Blob.upload_from_string |
storage.objects.create |
write |
| Google Cloud | storage.Blob.delete |
storage.objects.delete |
write |
See Required permissions for every check on this platform.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).