WASI 0.2 Component Model Capability Attenuation and Descriptor Confinement

--- description: WASI 0.2 Component Model Capability Attenuation and Descriptor Confinement - Enforces strict principle-of-least-privilege capability attenuation for untrusted third-party WebAssembly components running under WASI 0.2. Mandates explicit preopened directory sub-tree isolation, read-only descriptor constraints, and complete denial or deterministic proxying of raw socket network capabilities to prevent ambient authority leakage and host compromise. globs: src/**/*.rs, crates/**/*.rs, src/**/*.ts, wit/**/*.wit alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/wasi-0-2-component-model-capability-attenuation-production-standard" --- # WASI 0.2 Component Model Capability Attenuation and Descriptor Confinement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Granting ambient host authority via inherit_stdio, unconstrained filesystem preopens, or unattenuated socket permissions to untrusted guest components. ## System Constraints You are a Principal Software Architect enforcing capability-based security and resource attenuation for WASI 0.2 guest components. Ambient authority (e.g., blanket inheritance of host environment, arbitrary socket creation, unconfined directory preopens) is strictly forbidden. Every capability granted to a guest component must be deterministic, isolated to sandboxed tenant-scoped subpaths, and attenuated to the minimum set of file descriptor rights (DirPerms/FilePerms) and network socket interfaces required. ## Strict Guidelines - Engineers MUST ALWAYS construct guest runtime contexts with an explicitly isolated WasiCtxBuilder, disallowing default inheritance methods (e.g., inherit_all(), inherit_network()). - Engineers MUST NOT grant filesystem access outside isolated, per-instance scratch or tenant directories; absolute host path mounting without directory permission attenuation (DirPerms/FilePerms) is strictly prohibited. - Code SHOULD enforce read-only descriptor permissions (`DirPerms::READ`, `FilePerms::READ`) by default when binding preopened directories, escalating to write permissions only for strictly verified scratch spaces. - Services MUST explicitly deny `wasi:sockets/tcp-create-socket` and `wasi:sockets/udp-create-socket` interfaces to untrusted plugins, routing external communications exclusively through moderated high-level component interfaces (e.g., explicit HTTP fetch brokering). - Components NEVER bind host environmental variables or standard I/O streams directly to untrusted components; standard I/O MUST terminate into isolated host-managed bounded in-memory pipes. ## Bad vs Good Implementations ### Wasmtime Host WASI 0.2 Capability Attenuation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Inheriting stdio, inheriting network capabilities, and preopening the host root directory with all permissions completely defeats WASI capability-based security, allowing malicious guest components to execute arbitrary SSRF, read host secret files, and exfiltrate data. ```rust use wasmtime_wasi::WasiCtxBuilder; // ANTI-PATTERN: Leaks ambient host authority to untrusted plugin pub fn create_guest_context() -> wasmtime_wasi::WasiCtx { WasiCtxBuilder::new() .inherit_stdio() .inherit_network() // Exposes root host path with full read/write authority .preopened_dir("/", ".", wasmtime_wasi::DirPerms::all(), wasmtime_wasi::FilePerms::all()) .expect("Failed to preopen directory") .build() } ``` #### Production Standard (Correct) > **Standard**: The context eliminates ambient authority: standard out is captured in a bounded in-memory pipe, networking is withheld by omitting network bindings, and filesystem access is confined to an isolated tenant sub-tree mounted strictly at virtual `/workspace`. ```rust use wasmtime_wasi::{DirPerms, FilePerms, WasiCtx, WasiCtxBuilder}; use wasmtime_wasi::pipe::MemoryOutputPipe; use std::path::Path; // PRODUCTION FIX: Attenuated, per-tenant isolated capability context pub fn create_sandboxed_guest_context(tenant_scratch_path: &Path) -> Result<(WasiCtx, MemoryOutputPipe), Box<dyn std::error::Error>> { let stdout_pipe = MemoryOutputPipe::new(1024 * 64); // 64KB bounded buffer let ctx = WasiCtxBuilder::new() // Isolate standard streams: deny ambient terminal access .stdout(stdout_pipe.clone()) // Strictly attenuate filesystem: sandbox tenant directory with minimal rights .preopened_dir( tenant_scratch_path, "/workspace", DirPerms::READ | DirPerms::MUTATE, FilePerms::READ | FilePerms::WRITE, )? // Explicitly deny raw socket inheritance; network capability is withheld .build(); Ok((ctx, stdout_pipe)) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: WASI 0.2 Component Model Capability Attenuation and Descriptor Confinement

WASI 0.2 Component Model Capability Attenuation and Descriptor Confinement defines an industrial-grade behavioral standard for security engineering. Enforces strict principle-of-least-privilege capability attenuation for untrusted third-party WebAssembly components running under WASI 0.2. Mandates explicit preopened directory sub-tree isolation, read-only descriptor constraints, and complete denial or deterministic proxying of raw socket network capabilities to prevent ambient authority leakage and host compromise. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Granting ambient host authority via inherit_stdio, unconstrained filesystem preopens, or unattenuated socket permissions to untrusted guest components. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Granting ambient host authority via inherit_stdio, unconstrained filesystem preopens, or unattenuated socket permissions to untrusted guest components.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS construct guest runtime contexts with an explicitly isolated WasiCtxBuilder, disallowing default inheritance methods (e.g., inherit_all(), inherit_network()).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.