fix(network): restore SDK gvproxy integration tests (#874)

Fix SDK network/secrets integration failures by avoiding the current VMM
seccomp/gvproxy conflict and making MITM TLS validation work inside the
jail.

Test plan:
- Remote e2e runner: Python #155 non-detach failure subset, 25 passed in
116.10s
- Remote e2e runner: Node tests/network-secrets.integration.test.ts, 5
passed
- A/B check without SDK Cargo gvproxy feature changes: Python subset 25
passed, Node network-secrets 5 passed

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Improved secure upstream TLS validation by extending sandbox trust to
include existing system CA bundles and cert files (read-only).
* Prevented syscall filtering from disrupting network-enabled runs by
skipping the VMM syscall filter when networking is active.
* Updated network interception integration coverage to use a new
upstream endpoint, keeping secret-substitution checks stable.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: G4614

sdks/node/tests/network-secrets.integration.test.ts

@@ -67,13 +67,13 @@ describe("SimpleBox network and secrets", { timeout: 180_000 }, () => {
       image: "python:slim",
       network: {
         mode: "enabled",
-        allowNet: ["httpbin.org"],
+        allowNet: ["httpbingo.org"],
       },
       secrets: [
         {
           name: "testkey",
           value: "super-secret-value",
-          hosts: ["httpbin.org"],
+          hosts: ["httpbingo.org"],
         },
       ],
       autoRemove: true,
@@ -85,7 +85,7 @@ describe("SimpleBox network and secrets", { timeout: 180_000 }, () => {
         [
           "import os, urllib.request",
           "req = urllib.request.Request(",
-          "  'https://httpbin.org/headers',",
+          "  'https://httpbingo.org/headers',",
           "  headers={'Authorization': 'Bearer ' + os.environ['BOXLITE_SECRET_TESTKEY']},",
           ")",
           "print(urllib.request.urlopen(req, timeout=20).read().decode())",

sdks/python/tests/test_secret_substitution.py

@@ -240,29 +240,29 @@ def test_secret_substitution_reaches_upstream(self, runtime):
         secret = boxlite.Secret(
             name="testkey",
             value=real_value,
-            hosts=["httpbin.org"],
+            hosts=["httpbingo.org"],
         )
         sandbox = runtime.create(
             boxlite.BoxOptions(
                 image="alpine:latest",
                 network=boxlite.NetworkSpec(
                     mode="enabled",
-                    allow_net=["httpbin.org"],
+                    allow_net=["httpbingo.org"],
                 ),
                 secrets=[secret],
             )
         )
         try:
             # Guest sends placeholder in header; MITM substitutes real value;
-            # httpbin.org echoes it back in JSON response.
+            # httpbingo.org echoes it back in JSON response.
             execution = sandbox.exec(
                 "wget",
                 [
                     "-q",
                     "-O-",
                     "--header",
                     "Authorization: Bearer <BOXLITE_SECRET:testkey>",
-                    "https://httpbin.org/headers",
+                    "https://httpbingo.org/headers",
                 ],
             )
             stdout = "".join(list(execution.stdout()))
@@ -297,16 +297,16 @@ def test_non_secret_host_not_intercepted(self, runtime):
                 image="alpine:latest",
                 network=boxlite.NetworkSpec(
                     mode="enabled",
-                    allow_net=["httpbin.org"],
+                    allow_net=["httpbingo.org"],
                 ),
                 secrets=[secret],
             )
         )
         try:
-            # httpbin.org is NOT in secret hosts — should work normally
+            # httpbingo.org is NOT in secret hosts — should work normally
             execution = sandbox.exec(
                 "wget",
-                ["-q", "-O-", "http://httpbin.org/ip"],
+                ["-q", "-O-", "http://httpbingo.org/ip"],
             )
             stdout = "".join(list(execution.stdout()))
             result = execution.wait()

src/boxlite/src/jailer/mod.rs

@@ -286,6 +286,18 @@ fn build_path_access(layout: &BoxFilesystemLayout, volumes: &[VolumeSpec]) -> Ve
         });
     }
 
+    // The in-shim network backend may validate upstream TLS certificates
+    // (for example secret-substitution MITM forwarding). Keep host trust
+    // stores readable inside the sandbox without granting broader /etc access.
+    for path in system_ca_paths() {
+        if path.exists() {
+            paths.push(PathAccess {
+                path,
+                writable: false,
+            });
+        }
+    }
+
     // User volumes
     for vol in volumes {
         let p = PathBuf::from(&vol.host_path);
@@ -300,6 +312,18 @@ fn build_path_access(layout: &BoxFilesystemLayout, volumes: &[VolumeSpec]) -> Ve
     paths
 }
 
+fn system_ca_paths() -> [PathBuf; 7] {
+    [
+        PathBuf::from("/etc/ssl/certs"),
+        PathBuf::from("/etc/pki/tls/certs"),
+        PathBuf::from("/etc/ca-certificates"),
+        PathBuf::from("/etc/ssl/cert.pem"),
+        PathBuf::from("/etc/ssl/certs/ca-certificates.crt"),
+        PathBuf::from("/etc/pki/tls/certs/ca-bundle.crt"),
+        PathBuf::from("/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"),
+    ]
+}
+
 /// Jailer provides process isolation for boxlite-shim.
 ///
 /// Encapsulates security configuration and delegates to a [`Sandbox`]
@@ -532,8 +556,27 @@ mod tests {
 
         let paths = build_path_access(&layout, &[]);
 
-        // Empty box dir: no subdirectories exist yet, so no paths
-        assert!(paths.is_empty(), "No paths for empty box dir");
+        let existing_ca_paths: Vec<_> = system_ca_paths()
+            .into_iter()
+            .filter(|p| p.exists())
+            .collect();
+
+        assert_eq!(
+            paths.len(),
+            existing_ca_paths.len(),
+            "empty box dir should only include existing system CA paths"
+        );
+        for ca_path in existing_ca_paths {
+            let entry = paths
+                .iter()
+                .find(|p| p.path == ca_path)
+                .unwrap_or_else(|| panic!("missing CA path {}", ca_path.display()));
+            assert!(
+                !entry.writable,
+                "CA path must be read-only: {}",
+                ca_path.display()
+            );
+        }
     }
 
     #[test]
@@ -662,6 +705,34 @@ mod tests {
         assert!(!bases_paths[0].writable);
     }
 
+    #[test]
+    fn test_build_path_access_includes_system_ca_paths_readonly() {
+        let dir = tempdir().unwrap();
+        let layout = test_layout(dir.path().to_path_buf());
+        let existing_ca_paths: Vec<_> = system_ca_paths()
+            .into_iter()
+            .filter(|p| p.exists())
+            .collect();
+
+        if existing_ca_paths.is_empty() {
+            return;
+        }
+
+        let paths = build_path_access(&layout, &[]);
+
+        for ca_path in existing_ca_paths {
+            let entry = paths
+                .iter()
+                .find(|p| p.path == ca_path)
+                .unwrap_or_else(|| panic!("missing CA path {}", ca_path.display()));
+            assert!(
+                !entry.writable,
+                "CA path must be read-only: {}",
+                ca_path.display()
+            );
+        }
+    }
+
     #[test]
     fn test_build_path_access_includes_qcow2_backing_file() {
         use crate::disk::{BackingFormat, Qcow2Helper};

src/deps/libgvproxy-sys/gvproxy-bridge/mitm.go

@@ -24,6 +24,12 @@ type BoxCA struct {
 	certCache sync.Map // hostname -> *tls.Certificate
 }
 
+var (
+	upstreamRootCAs     *x509.CertPool
+	upstreamRootCAsOnce sync.Once
+	upstreamRootCAsErr  error
+)
+
 // NewBoxCAFromPEM reconstructs a BoxCA from PEM-encoded cert and key.
 // The cert/key are generated by the Rust side and passed via GvproxyConfig JSON.
 func NewBoxCAFromPEM(certPEM, keyPEM []byte) (*BoxCA, error) {
@@ -185,7 +191,18 @@ func resolveUpstreamTLS(hostname string, overrides ...*tls.Config) *tls.Config {
 	if len(overrides) > 0 && overrides[0] != nil {
 		return overrides[0]
 	}
-	return &tls.Config{ServerName: hostname}
+	cfg := &tls.Config{ServerName: hostname}
+	if roots, err := loadUpstreamRootCAs(); err == nil {
+		cfg.RootCAs = roots
+	}
+	return cfg
+}
+
+func loadUpstreamRootCAs() (*x509.CertPool, error) {
+	upstreamRootCAsOnce.Do(func() {
+		upstreamRootCAs, upstreamRootCAsErr = x509.SystemCertPool()
+	})
+	return upstreamRootCAs, upstreamRootCAsErr
 }
 
 // SecretHostMatcher provides O(1) lookup for whether a hostname has secrets.

src/shim/src/main.rs

@@ -153,7 +153,10 @@ fn run_shim(mut config: InstanceSpec, timing: impl Fn(&str)) -> BoxliteResult<()
     {
         use boxlite::jailer::seccomp;
 
-        if config.security.jailer_enabled && config.security.seccomp_enabled {
+        if config.security.jailer_enabled
+            && config.security.seccomp_enabled
+            && config.network_config.is_none()
+        {
             tracing::info!(
                 box_id = %config.box_id,
                 "Applying VMM seccomp filter (TSYNC)"
@@ -165,6 +168,11 @@ fn run_shim(mut config: InstanceSpec, timing: impl Fn(&str)) -> BoxliteResult<()
                 box_id = %config.box_id,
                 "Seccomp isolation complete"
             );
+        } else if config.security.jailer_enabled && config.security.seccomp_enabled {
+            tracing::warn!(
+                box_id = %config.box_id,
+                "Seccomp disabled for network-enabled VM; gvproxy runs in-process and is not covered by the VMM syscall profile"
+            );
         } else if config.security.jailer_enabled {
             tracing::warn!(
                 box_id = %config.box_id,