lowRISC / lowRISC/sonata-software
Heap allocation not identified as sealed capability by cheriot-audit
@AlexJones0 is already working on this.
Since Nov 12, 2025.
- Dominant language
- C++
- Stars
- 14
- Forks
- 17
- PR merge metrics
- No merged PRs in 30d
Description
When following the instructions in the firmware auditing exercise part 1, uncommenting the heap allocation code in [sealed_capability.cc](/lowRISC/sonata-software/blob/main/exercises/firmware_auditing/part_1/sealed_capability.cc) and running
```bash
xmake -P exercises
cheriot-audit --board=cheriot-rtos/sdk/boards/sonata.json \
--firmware-report=build/cheriot/cheriot/release/firmware_auditing_part_1.json \
--module=exercises/firmware_auditing/part_1/no_sealed_capabilities.rego \
--query='data.no_seal.valid'
```
does not correctly return false since branch v1.2. The same audit returns false as expected when using branch v1.1 and v1.0.
The sealed_capability compartment in the generated firmware_auditing_part_1.json when using branch v1.3 is shown below:
The same section when using branch v1.1 is shown below, objects that were missing when using branch v1.3 are highlighted:
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.