Expose RHEL/Amazon Linux CA roots in chroot mode (#6460)

Author: Copilot

containers/agent/entrypoint.sh

@@ -705,9 +705,10 @@ copy_awf_ca_cert() {
 
 copy_system_ca_bundle() {
   # Detect and copy the host system CA bundle to a chroot-accessible path.
-  # On Amazon Linux / RHEL-family systems, the CA bundle lives under /etc/pki/
-  # which is not mounted into the chroot. This function finds the system bundle
-  # and copies it to /tmp/awf-lib/ so TLS works regardless of distro.
+  # On Amazon Linux / RHEL-family systems, the CA bundle often lives under
+  # /etc/pki/. This function finds the system bundle and, when it is not already
+  # accessible in the chroot, copies it to /tmp/awf-lib/ so TLS works regardless
+  # of distro.
   #
   # In SSL Bump mode, the AWF CA must remain the active trust bundle for MITM
   # proxy validation. We only append the system bundle to that staged AWF CA.
@@ -762,11 +763,11 @@ copy_system_ca_bundle() {
   fi
 
   # Check if the bundle is already accessible inside the chroot via existing mounts.
-  # AWF mounts /etc/ssl and /etc/ca-certificates into the chroot; paths under those
-  # prefixes are already visible. Paths under /etc/pki (RHEL/Amazon Linux) are not.
+  # AWF mounts the common CA roots under /etc/ssl, /etc/ca-certificates, and the
+  # RHEL/Amazon Linux CA roots under /etc/pki/ca-trust/extracted and /etc/pki/tls/certs.
   local CHROOT_RELATIVE="${SYSTEM_BUNDLE#/host}"
   case "$CHROOT_RELATIVE" in
-    /etc/ssl/*|/etc/ca-certificates/*)
+    /etc/ssl/*|/etc/ca-certificates/*|/etc/pki/ca-trust/extracted/*|/etc/pki/tls/certs/*)
       # Already accessible via existing bind mounts
       export SSL_CERT_FILE="$CHROOT_RELATIVE"
       export NODE_EXTRA_CA_CERTS="$CHROOT_RELATIVE"
@@ -778,7 +779,7 @@ copy_system_ca_bundle() {
       ;;
   esac
 
-  # Bundle is not accessible in chroot (e.g., /etc/pki paths). Copy it.
+  # Bundle is not accessible in chroot. Copy it.
   if mkdir -p /host/tmp/awf-lib 2>/dev/null; then
     if cp "$SYSTEM_BUNDLE" /host/tmp/awf-lib/system-ca-certificates.crt 2>/dev/null && \
        [ -s /host/tmp/awf-lib/system-ca-certificates.crt ]; then

docs/chroot-mode.md

@@ -180,6 +180,8 @@ In chroot mode, selective paths are mounted for security instead of the entire f
 | `/opt` | `/host/opt:ro` | Tool cache (Python, Node, Go) |
 | `/etc/ssl` | `/host/etc/ssl:ro` | SSL certificates |
 | `/etc/ca-certificates` | `/host/etc/ca-certificates:ro` | CA certificates |
+| `/etc/pki/ca-trust/extracted` | `/host/etc/pki/ca-trust/extracted:ro` | RHEL/Amazon Linux extracted CA bundle roots |
+| `/etc/pki/tls/certs` | `/host/etc/pki/tls/certs:ro` | RHEL/Amazon Linux CA certificate directory |
 | `/etc/passwd` | `/host/etc/passwd:ro` | User lookup |
 | `/etc/group` | `/host/etc/group:ro` | Group lookup |
 
@@ -191,7 +193,7 @@ When `chroot.binariesSourcePath` is set in stdin config, AWF also mounts:
 
 **Note:** As of v0.13.13, `/proc` is no longer bind-mounted. Instead, a fresh container-scoped procfs is mounted at `/host/proc` during entrypoint initialization. This provides dynamic `/proc/self/exe` resolution required by Java and .NET runtimes.
 
-**System CA Bundle Detection:** The entrypoint automatically detects the host system CA bundle from common locations (Debian/Ubuntu `/etc/ssl/certs/ca-certificates.crt`, RHEL/Amazon Linux `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/pki/tls/cert.pem`, macOS `/etc/ssl/cert.pem`). If the bundle is not already accessible in the chroot via existing mounts (e.g., `/etc/pki` paths), it is copied to `/tmp/awf-lib/system-ca-certificates.crt` and `SSL_CERT_FILE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, and `GIT_SSL_CAINFO` are set to point at it.
+**System CA Bundle Detection:** The entrypoint automatically detects the host system CA bundle from common locations (Debian/Ubuntu `/etc/ssl/certs/ca-certificates.crt`, RHEL/Amazon Linux `/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem`, `/etc/pki/tls/certs/ca-bundle.crt`, `/etc/pki/tls/cert.pem`, macOS `/etc/ssl/cert.pem`). If the bundle is not already accessible in the chroot via the mounted CA paths, it is copied to `/tmp/awf-lib/system-ca-certificates.crt` and `SSL_CERT_FILE`, `NODE_EXTRA_CA_CERTS`, `REQUESTS_CA_BUNDLE`, `CURL_CA_BUNDLE`, and `GIT_SSL_CAINFO` are set to point at it.
 
 ### Read-Write Mounts
 

src/config/mount-policy.test.ts

@@ -141,7 +141,13 @@ describe('mount-policy', () => {
 
     it('exposes the always-mounted /etc allow list', () => {
       expect(etcAllowlist()).toEqual(
-        expect.arrayContaining(['/etc/ssl', '/etc/ca-certificates', '/etc/nsswitch.conf']),
+        expect.arrayContaining([
+          '/etc/ssl',
+          '/etc/ca-certificates',
+          '/etc/pki/ca-trust/extracted',
+          '/etc/pki/tls/certs',
+          '/etc/nsswitch.conf',
+        ]),
       );
     });
   });

src/config/sandbox-mount-policy.json

@@ -6,7 +6,7 @@
       "default": ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/opt", "/sys", "/dev"],
       "sysroot": ["/sys", "/dev"]
     },
-    "etc": ["/etc/ssl", "/etc/ca-certificates", "/etc/alternatives", "/etc/ld.so.cache", "/etc/nsswitch.conf"]
+    "etc": ["/etc/ssl", "/etc/ca-certificates", "/etc/pki/ca-trust/extracted", "/etc/pki/tls/certs", "/etc/alternatives", "/etc/ld.so.cache", "/etc/nsswitch.conf"]
   },
   "home": {
     "$comment": "Agent $HOME exposure. `toolSubdirs` is the ALLOW list: tool caches, language toolchains and agent state the agent legitimately needs. `forbiddenSubdirs` is a DENY guard: dirs whose primary purpose is storing credentials and which must NEVER be added to the allow list. Compose mounts an empty home + binds toolSubdirs on top; sbx mounts toolSubdirs wholesale instead of the whole $HOME.",

src/services/agent-volumes-basic.test.ts

@@ -1,3 +1,4 @@
+import * as fs from 'fs';
 import { generateDockerCompose, mockNetworkConfig, useAgentVolumesTestConfig } from './service-test-setup.test-utils';
 
 // Create mock functions (must remain per-file — jest.mock() is hoisted before imports)
@@ -163,6 +164,16 @@ describe('agent service', () => {
     // Should include /etc subdirectories (read-only)
     expect(volumes).toContain('/etc/ssl:/host/etc/ssl:ro');
     expect(volumes).toContain('/etc/ca-certificates:/host/etc/ca-certificates:ro');
+    if (fs.existsSync('/etc/pki/ca-trust/extracted')) {
+      expect(volumes).toContain('/etc/pki/ca-trust/extracted:/host/etc/pki/ca-trust/extracted:ro');
+    } else {
+      expect(volumes).not.toContain('/etc/pki/ca-trust/extracted:/host/etc/pki/ca-trust/extracted:ro');
+    }
+    if (fs.existsSync('/etc/pki/tls/certs')) {
+      expect(volumes).toContain('/etc/pki/tls/certs:/host/etc/pki/tls/certs:ro');
+    } else {
+      expect(volumes).not.toContain('/etc/pki/tls/certs:/host/etc/pki/tls/certs:ro');
+    }
     expect(volumes).toContain('/etc/alternatives:/host/etc/alternatives:ro');
     expect(volumes).toContain('/etc/ld.so.cache:/host/etc/ld.so.cache:ro');
     // /etc/hosts is always a custom hosts file in a secure chroot temp dir (for pre-resolved domains)

src/services/agent-volumes/etc-mounts.test.ts

@@ -16,6 +16,10 @@ function createMinimalConfig(overrides: Partial<WrapperConfig> = {}): WrapperCon
 }
 
 describe('buildEtcMounts', () => {
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
   describe('sysroot gating by runnerTopology', () => {
     it('returns empty array when runnerTopology is arc-dind (sysroot provides /etc)', () => {
       const config = createMinimalConfig({ runnerTopology: 'arc-dind' });
@@ -51,8 +55,42 @@ describe('buildEtcMounts', () => {
       const mounts = buildEtcMounts(config);
       expect(mounts).toContain('/etc/ssl:/host/etc/ssl:ro');
       expect(mounts).toContain('/etc/ca-certificates:/host/etc/ca-certificates:ro');
+      if (fs.existsSync('/etc/pki/ca-trust/extracted')) {
+        expect(mounts).toContain('/etc/pki/ca-trust/extracted:/host/etc/pki/ca-trust/extracted:ro');
+      } else {
+        expect(mounts).not.toContain('/etc/pki/ca-trust/extracted:/host/etc/pki/ca-trust/extracted:ro');
+      }
+      if (fs.existsSync('/etc/pki/tls/certs')) {
+        expect(mounts).toContain('/etc/pki/tls/certs:/host/etc/pki/tls/certs:ro');
+      } else {
+        expect(mounts).not.toContain('/etc/pki/tls/certs:/host/etc/pki/tls/certs:ro');
+      }
       expect(mounts).toContain('/etc/nsswitch.conf:/host/etc/nsswitch.conf:ro');
     });
+
+    it('omits optional RHEL CA mounts when host sources are unavailable', () => {
+      if (fs.existsSync('/etc/pki/ca-trust/extracted') || fs.existsSync('/etc/pki/tls/certs')) {
+        return;
+      }
+      const config = createMinimalConfig({ dockerHostPathPrefix: undefined });
+      const mounts = buildEtcMounts(config);
+      expect(mounts).not.toContain('/etc/pki/ca-trust/extracted:/host/etc/pki/ca-trust/extracted:ro');
+      expect(mounts).not.toContain('/etc/pki/tls/certs:/host/etc/pki/tls/certs:ro');
+    });
+
+    it('keeps optional RHEL CA mounts when split-fs prefixed sources exist', () => {
+      const prefixRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'awf-prefix-'));
+      try {
+        fs.mkdirSync(path.join(prefixRoot, 'etc/pki/ca-trust/extracted'), { recursive: true });
+        fs.mkdirSync(path.join(prefixRoot, 'etc/pki/tls/certs'), { recursive: true });
+        const config = createMinimalConfig({ dockerHostPathPrefix: prefixRoot });
+        const mounts = buildEtcMounts(config);
+        expect(mounts).toContain('/etc/pki/ca-trust/extracted:/host/etc/pki/ca-trust/extracted:ro');
+        expect(mounts).toContain('/etc/pki/tls/certs:/host/etc/pki/tls/certs:ro');
+      } finally {
+        fs.rmSync(prefixRoot, { recursive: true, force: true });
+      }
+    });
   });
 
   describe('DinD mode with dockerHostPathPrefix', () => {

src/services/agent-volumes/etc-mounts.ts

@@ -6,6 +6,35 @@ import { getSafeHostUid, getSafeHostGid } from '../../host-identity';
 import { isSysrootEnabled } from '../sysroot-service';
 import { etcAllowlist } from '../../config/mount-policy';
 
+const OPTIONAL_ETC_CA_MOUNTS = new Set<string>([
+  '/etc/pki/ca-trust/extracted',
+  '/etc/pki/tls/certs',
+]);
+
+function normalizeDockerHostPathPrefix(prefix: string): string {
+  const trimmed = prefix.trim();
+  if (!trimmed) return '';
+  const withLeadingSlash = trimmed.startsWith('/') ? trimmed : `/${trimmed}`;
+  return withLeadingSlash.replace(/\/+$/, '') || '/';
+}
+
+function bindMountSourceExists(hostPath: string, config: WrapperConfig): boolean {
+  if (fs.existsSync(hostPath)) {
+    return true;
+  }
+
+  if (!config.dockerHostPathPrefix) {
+    return false;
+  }
+
+  const normalizedPrefix = normalizeDockerHostPathPrefix(config.dockerHostPathPrefix);
+  if (!normalizedPrefix || normalizedPrefix === '/') {
+    return false;
+  }
+
+  return fs.existsSync(`${normalizedPrefix}${hostPath}`);
+}
+
 /**
  * Synthesize a minimal /etc/passwd or /etc/group file in the staging directory.
  * Used when the runner doesn't have these files (e.g., minimal ARC-DinD containers).
@@ -67,7 +96,9 @@ export function buildEtcMounts(config: WrapperConfig): string[] {
     return [];
   }
 
-  const mounts: string[] = etcAllowlist().map((p) => `${p}:/host${p}:ro`);
+  const mounts: string[] = etcAllowlist()
+    .filter((p) => !OPTIONAL_ETC_CA_MOUNTS.has(p) || bindMountSourceExists(p, config))
+    .map((p) => `${p}:/host${p}:ro`);
 
   if (!shouldUseDockerHostStaging(config.dockerHostPathPrefix)) {
     mounts.push('/etc/passwd:/host/etc/passwd:ro');

tests/entrypoint-phase-functions.test.sh

@@ -149,6 +149,56 @@ else
   fail "copy_system_ca_bundle() does not safely append system roots to the staged AWF CA bundle"
 fi
 
+if printf '%s\n' "${COPY_SYSTEM_CA_BUNDLE_BLOCK}" | grep -Fq '/etc/pki/ca-trust/extracted/*|/etc/pki/tls/certs/*)'; then
+  pass "copy_system_ca_bundle() treats mounted RHEL/Amazon Linux CA paths as chroot-accessible"
+else
+  fail "copy_system_ca_bundle() does not recognize mounted RHEL/Amazon Linux CA paths as chroot-accessible"
+fi
+
+run_copy_system_ca_bundle_fixture() {
+  local tmp_dir
+  tmp_dir="$(mktemp -d)"
+  local host_root="${tmp_dir}/host-root"
+  local fixture_entrypoint="${tmp_dir}/entrypoint-fixture.sh"
+  mkdir -p "${host_root}/etc/pki/tls/certs" "${host_root}/etc/ssl/certs"
+  printf '%s\n' "fixture-ca-cert" > "${host_root}/etc/pki/tls/certs/ca-bundle.crt"
+
+  awk '$0 != "main \"$@\""' "${ENTRYPOINT}" > "${fixture_entrypoint}"
+  sed -i "s#/host#\${AWF_TEST_HOST_ROOT}#g" "${fixture_entrypoint}"
+
+  (
+    set -e
+    # shellcheck disable=SC1090
+    . "${fixture_entrypoint}"
+
+    AWF_SSL_BUMP_ENABLED="false"
+    AWF_CA_CHROOT=""
+    AWF_TEST_HOST_ROOT="${host_root}"
+
+    unset SSL_CERT_FILE NODE_EXTRA_CA_CERTS REQUESTS_CA_BUNDLE CURL_CA_BUNDLE GIT_SSL_CAINFO SYSTEM_CA_CHROOT
+    copy_system_ca_bundle
+    [ "${SSL_CERT_FILE}" = "/etc/pki/tls/certs/ca-bundle.crt" ]
+    [ -r "${AWF_TEST_HOST_ROOT}${SSL_CERT_FILE}" ]
+    [ "${NODE_EXTRA_CA_CERTS}" = "${SSL_CERT_FILE}" ]
+
+    ln -sf ../../pki/tls/certs/ca-bundle.crt "${host_root}/etc/ssl/certs/ca-certificates.crt"
+    unset SSL_CERT_FILE NODE_EXTRA_CA_CERTS REQUESTS_CA_BUNDLE CURL_CA_BUNDLE GIT_SSL_CAINFO SYSTEM_CA_CHROOT
+    copy_system_ca_bundle
+    [ "${SSL_CERT_FILE}" = "/etc/ssl/certs/ca-certificates.crt" ]
+    [ -r "${AWF_TEST_HOST_ROOT}${SSL_CERT_FILE}" ]
+    [ "${NODE_EXTRA_CA_CERTS}" = "${SSL_CERT_FILE}" ]
+  )
+  local result=$?
+  rm -rf "${tmp_dir}"
+  return "${result}"
+}
+
+if run_copy_system_ca_bundle_fixture; then
+  pass "copy_system_ca_bundle() exports chroot-readable CA paths for direct RHEL bundles and /etc/ssl symlink targets"
+else
+  fail "copy_system_ca_bundle() does not export chroot-readable CA paths for RHEL bundle fixtures"
+fi
+
 if grep -Eq '\[ -n "\$\{SYSTEM_CA_CHROOT\}" \]' "${ENTRYPOINT}"; then
   pass "run_chroot_command() cleans up copied system CA bundles"
 else