Repository navigation
Conversation
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
4 open issues
os.Stderris reassigned earlier, butlogrus’s standard logger output won’t automatically follow… · NewdefaultLogSourcesInfo). Even with cleanup,… · New
What changed in this PR
Adds a dedicated, policy-gated ETW provider for sidecar GCS diagnostics and wires runtime logging authorization into both standard Logrus output and ETW hook emission.
Changes:
- Introduces
WithRuntimeLoggingChanged+ functional options onSecurityOptionsand centralizes runtime logging configuration. - Adds sidecar ETW provider identity (
Microsoft.Virtualization.GCSSidecar) to ETW GUID map and default log sources, plus tests. - Registers the sidecar ETW provider/hook in
gcs-sidecarand documents policy + collection behavior.
| File | Description |
|---|---|
| pkg/securitypolicy/securitypolicy_options.go | Adds runtime logging callback + functional options and centralizes runtime logging configuration. |
| pkg/securitypolicy/runtime_logging_test.go | Tests runtime logging configuration behavior and callback invocation rules. |
| internal/vm/vmutils/etw/etw_map.go | Adds sidecar provider name constant + GUID mapping. |
| internal/vm/vmutils/etw/default-sources.go | Enables sidecar provider in default ETW sources at Information level. |
| internal/vm/vmutils/etw/sidecar_test.go | Validates default sidecar provider config and deduping at the same casing. |
| internal/vm/vmutils/etw/sidecar_windows_test.go | Validates provider registration GUID matches trusted GUID on Windows. |
| internal/gcs-sidecar/logging.go | Adds RuntimeLoggingHook to gate hook emission independent of writer output. |
| internal/gcs-sidecar/logging_test.go | Tests gating behavior and concurrency safety of the runtime logging hook. |
| internal/gcs-sidecar/logging_policy_test.go | Tests policy gating for sidecar provider subscription forwarding. |
| internal/gcs-sidecar/host.go | Threads SecurityOptions functional options through sidecar host initialization. |
| internal/gcs-sidecar/bridge.go | Threads SecurityOptions functional options through bridge construction. |
| cmd/gcs-sidecar/main.go | Registers ETW provider + gated hook and connects it to validated policy decisions. |
| docs/sidecar-gcs-logging.md | Documents provider, policy gating, configuration, and compatibility behavior. |
Review effort: Lite
Comment on lines
+12
to
+18
| for _, level := range []string{"Information", "Verbose"} { | ||
| var user LogSourcesInfo | ||
| if level == "Verbose" { | ||
| user.LogConfig.Sources = []Source{{Type: "ETW", Providers: []EtwProvider{ | ||
| {ProviderName: SidecarProviderName, Level: level}, | ||
| }}} | ||
| } |
Comment on lines
+197
to
+211
| var loggingOptions []func(*securitypolicy.SecurityOptions) | ||
| // Keep the provider registered until process exit, as in the host shim. | ||
| provider, err := etw.NewProvider(logsources.SidecarProviderName, nil) | ||
| if err != nil { | ||
| logrus.WithError(err).Error("failed to register sidecar ETW provider") | ||
| } else if hook, err := etwlogrus.NewHookFromProvider(provider); err != nil { | ||
| logrus.WithError(err).Error("failed to initialize sidecar ETW hook") | ||
| if err := provider.Close(); err != nil { | ||
| logrus.WithError(err).Error("failed to close sidecar ETW provider") | ||
| } | ||
| } else { | ||
| gatedHook := sidecar.NewRuntimeLoggingHook(hook) | ||
| logrus.AddHook(gatedHook) | ||
| loggingOptions = append(loggingOptions, securitypolicy.WithRuntimeLoggingChanged(gatedHook.SetAllowed)) | ||
| } |
Comment on lines
+5
to
+11
| "testing" | ||
| ) | ||
|
|
||
| func TestSidecarDefaultLogSource(t *testing.T) { | ||
| // Updating sources mutates the shared defaults; restore them after the test. | ||
| original := cloneLogSourcesInfo(defaultLogSourcesInfo) | ||
| t.Cleanup(func() { defaultLogSourcesInfo = original }) |
Comment on lines
+74
to
+82
| // WithRuntimeLoggingChanged observes the validated policy's runtime logging | ||
| // decision. The callback must not block or reenter SecurityOptions. | ||
| func WithRuntimeLoggingChanged(callback func(bool)) func(*SecurityOptions) { | ||
| return func(s *SecurityOptions) { | ||
| s.runtimeLoggingChanged = callback | ||
| } | ||
| } | ||
|
|
||
| func NewSecurityOptions(enforcer SecurityPolicyEnforcer, enforcerSet bool, uvmReferenceInfo string, uvmHashEnvelopeReferenceInfo string, logWriter io.Writer, options ...func(*SecurityOptions)) *SecurityOptions { |
Owner
Author
|
Validated the private Rego-enabled sidecar in a VBS C-WCOW UVM with Secure Boot enabled: ETW logs reached the host and subsequent events continued parsing with the host timestamp fix in #2. Runtime logging denied: zero sidecar events while other ETW providers continued forwarding. |
added 2 commits
November 5, 2026 21:52
Signed-off-by: Manish Ranjan Mahanta <mmahanta@microsoft.com>
Signed-off-by: Manish Ranjan Mahanta <mmahanta@microsoft.com>
marma-dev
force-pushed
the
sidecar-gcs-etw-logging
branch
from
November 5, 2026 16:23
06b5d20 to
03b8e51
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation performed
Compatibility and coverage notes