From c1db7029bfd5286e14207018ceeebfcf8f776876 Mon Sep 17 00:00:00 2001 From: sean wibisono Date: Wed, 9 Sep 2026 09:39:42 +1000 Subject: [PATCH] UID2-7804: Stop forcing allow_environment_variable_dropping to false Fragment-defined containers reject Azure's injected identity vars regardless of our env_rules; only this flag reaches them. confcom already emits true; assert it stays true instead of flipping it. --- .../azure-cc/deployment/generate-deployment-artifacts.sh | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/scripts/azure-cc/deployment/generate-deployment-artifacts.sh b/scripts/azure-cc/deployment/generate-deployment-artifacts.sh index ca4b950e4..5c6214243 100644 --- a/scripts/azure-cc/deployment/generate-deployment-artifacts.sh +++ b/scripts/azure-cc/deployment/generate-deployment-artifacts.sh @@ -81,12 +81,15 @@ if [[ $? -ne 0 ]]; then exit 1 fi -# Export the policy, update it to turn off allow_environment_variable_dropping, and then insert it into the template +# Export the policy and insert it into the template. # note that the EnclaveId is generated by generate.py on the raw policy, not the base64 version POLICY_DIGEST_FILE=azure-cc-operator-digest-$VERSION_NUMBER.txt az confcom acipolicygen --approve-wildcards --omit-id --template-file ${OUTPUT_DIR}/operator.json --print-policy > ${INPUT_DIR}/policy.base64 base64 -di < ${INPUT_DIR}/policy.base64 > ${INPUT_DIR}/generated.rego -sed -i "s#allow_environment_variable_dropping := true#allow_environment_variable_dropping := false#g" ${INPUT_DIR}/generated.rego +if ! grep -q "allow_environment_variable_dropping := true" ${INPUT_DIR}/generated.rego; then + echo "allow_environment_variable_dropping is not true in the generated policy" + exit 1 +fi base64 -w0 < ${INPUT_DIR}/generated.rego > ${INPUT_DIR}/generated.rego.base64 python3 ${SCRIPT_DIR}/generate.py ${INPUT_DIR}/generated.rego > ${MANIFEST_DIR}/${POLICY_DIGEST_FILE}