Syscall Access Control

[mriise]

For Account Abstraction we will be needing to constrain the available syscalls for both validate contexts and invoke on abstract accounts. Work done here will also apply towards https://github.com/filecoin-project/ref-fvm/pull/654 though it is not listed in the table.

---

✅ available

🚫 forbidden

❎ not linked

✳️ see notes

❓TODO

Module	Syscalls	Validate	Invoke (account actor)	Invoke (normal)	Builtin	Notes	Abstract Account Notes
vm	abort	✅	✅	✅	✅
	context	🚫	✅	✅	✅	probably rename to invoke_context
	validate_context	✅❓	❎	❎	❎		TODO
network	base_fee	🚫	✅	✅	✅
	total_fil_circ_supply	🚫	✅❓	✅❓	✅	TODO maybe constrain to only builtin actors
ipld	block_open	✅✳️	✅	✅	✅		state mutations is not saved on chain
	block_create	✅✳️	✅	✅	✅		state mutations is not saved on chain
	block_read	✅	✅	✅	✅
	block_stat	✅	✅	✅	✅
	block_link	✅✳️	✅	✅	✅		state mutations is not saved on chain
self	root	✅	✅	✅	✅
	set_root	🚫	🚫	✅	🚫❓
	current_balance	🚫	✅	✅	✅
	self_destruct	🚫	🚫❓✳️	❓✅✳️	🚫	only if self == origin?	Spec before this is final
actor	resolve_address	🚫	✅	✅	✅
	get_actor_code_cid	🚫	✅	✅	✅
	new_actor_address	🚫	✅❓	✅❓✳️	✅	TODO merge with create_actor
	create_actor	🚫	✅❓	✅❓✳️	✅	only init actor (!current implementation doesn’t check!)
	get_builtin_actor_type	🚫	✅	✅	✅
	get_code_cid_for_type	🚫	✅	✅	✅
	install_actor	🚫	✅❓✳️	✅❓✳️	✅	only for m2 native, TODO be done through init actor in the future	changes done in invoke cant effect validate
crypto	hash	✅	✅	✅	✅
	recover_secp_public_key	✅	✅	✅	✅
	compute_unsealed_sector_cid	🚫	✅❓	✅❓	✅	TODO maybe just defer to a Builtin Actor
	verify_seal	🚫	✅❓	✅❓	✅	TODO maybe constrain to Builtin actor type
	verify_post	🚫	✅❓	✅❓	✅	TODO maybe constrain to Builtin actor type
	verify_consensus_fault	🚫	✅❓	✅❓	✅	TODO maybe constrain to Builtin actor type
	verify_aggregate_seals	🚫	✅❓	✅❓	✅	TODO maybe constrain to Builtin actor type
	verify_replica_update	🚫	✅❓	✅❓	✅	TODO maybe constrain to Builtin actor type
	batch_verify_seals	🚫	✅❓	✅❓	✅	only power actor (!current implementation doesn’t check!)
rand	get_chain_randomness	🚫	✅	✅	✅
	get_beacon_randomness	🚫	✅	✅	✅
gas	charge	🚫	✅❓	✅❓	✅	to be unlinked for non-system actors
send	send	🚫	🚫❓✳️	✅	✅		Spec before this is final
debug	enabled	✅	✅	✅	✅
	log	✅✳️	✅✳️	✅✳️	✅✳️	error if !enabled
	store_artifact	✅✳️	✅✳️	✅✳️	✅✳️	error if !enabled

Account Abstraction adds validate_context and origin syscalls.

upgrade should be ran in a constrained runtime as well, but that is a later TODO.

Implementation

Goals

• Pave the way for future differently constrained runtimes.
• Keep actor types and syscalls composable where expected.

Appoaches

• Runtime value inside Kernel that is checked on syscalls that are constrained at any point. This ends up being most syscalls.
• Lean into rust traits to constrain syscall binding to certain bounds, with runtime implementation checks done inside kernel.
• Syscall permission table per-mode, listing what syscalls are available with a closure for runtime checks.

[mriise]

cc @Stebalien

[mriise]

I see three major types of binding:

• Always forbidden
• Always allowed
• Sometimes allowed (runtime check)

Always allowed can be done with a runtime check and be considered part of Somtimes allowed, though it probably get messy quick.

Unbound is another one potentially, but it could implemented as Always forbidden. This would mean all actors would need to import syscalls like validate_context and become_actor.

[Stebalien]

General notes:

• Invoke shouldn't differ between normal actors and abstract accounts except that abstract accounts can't set their own state or delete themselves.
• The "builtin only" methods should only be linked to builtin actors (so they don't appear as part of the public API). They're not dangerous (generally), just unstable.

Unbound is another one potentially, but it could implemented as Always forbidden.

(see my comment about builtin actors).

This would mean all actors would need to import syscalls like validate_context and become_actor.

Actors can choose to not import a defined syscall.

[mriise]

A note on get_code_cid_for_type and get_builtin_actor_type reasons' for being disallowed in validate contexts: Both functions breaks the (currently thought) contract of validate being solely a pure function of its own state and the message it validates. By allowing either of these, actors can write code that can test for what version of the network it is currently running on, and as such breaks that contract.

[mriise]

on the same hand, gas_available can give hints as well by doing test operations that it knows are more expensive/cheaper on different versions of the runtime and gathering information that way, though it is a bit less accurate and easy.

[Stebalien]

We're no longer implementing the validate entry point in this M2.1, so we can punt this to M2.2.