Enable Dynamic Policy Management via ghaf-givc

[gngram]

Description of Changes

This PR introduces policy management capabilities within the ghaf-givc implementation. It establishes a distinction between policy administrators and clients, allowing for dynamic updates to system configurations such as firewalls and proxies.

Key Changes:
Policy Architecture:

• Implemented policyAdmin specifically for the admin-vm.
• Implemented policyClient for the host and remaining VMs.
• Added ghaf.common.policies option to accumulate policies from various VMs.

Dynamic Configuration:

• Enabled dynamic firewall rule updates via the policy admin.
• Enabled proxy-config updates via the policy admin.

GIVC Integration:

• Updated givc configurations to align with agents.
• Updated configs for YubiKey and Boot-UI integration.

Type of Change

• New Feature
• Bug Fix
• Improvement / Refactor

Related Issues / Tickets

Checklist

• Clear summary in PR description
• Detailed and meaningful commit message(s)
• Commits are logically organized and squashed if appropriate
• Contribution guidelines followed
• Ghaf documentation updated with the commit - https://tiiuae.github.io/ghaf/
• Author has run make-checks and it passes
• All automatic GitHub Action checks pass - see actions
• Author has added reviewers and removed PR draft status

Testing Instructions

Applicable Targets

• Orin AGX aarch64
• Orin NX aarch64
• Lenovo X1 x86_64
• Dell Latitude x86_64
• System 76 x86_64

Installation Method

• Requires full re-installation
• Can be updated with nixos-rebuild ... switch
• Other:

Test Steps To Verify:

1. Every functionality should work as usual.
2. I have restricted access of chatgpt in chrome vm via dynamic policy update for testing (will remove it later). With this PR you should not be able to access chatgpt from google chrome.

[kajusnau]

Cool change!
Some opinionated, some refactor comments.
Also is it possible to define some example test scenario instead of a generic Every functionality should work as usual.? 😁

[vunnyso]

PR title has title has typo and wip can removed if change is ready.

[gngram]

PR title has title has typo and wip can removed if change is ready.

waiting for ghaf-givc commit to be merged on mainline. once done I will remove wip status and will update givc url also in flake.nix.

[milva-unikie]

Tested on Darter Pro (new image)

• Policy management is not working as described in the testing instructions, ChatGPT is not blocked in chrome-vm Google Chrome

[gngram]

@milva-unikie, I am sorry for not providing clear steps to test it.
First time when you are booting with network cable plugged in then the policy applies within 1-2 minutes. In case you are using wifi, after configuring wifi network you need to wait for 5-6 minutes.
On boot it polls for policy every 5 minutes. By the time we configure wifi, first poll happens and due to network unavailability it doesn't get latest policy. If you don't want to wait reboot the system after saving the wifi configuration.

Once policy is downloaded then it persists the effect is permanent so subsequent boot will have the effect immediately.

I always tested with network cable plugged in on Lenovo-X1, so forgot to mention these details.
I tested with wifi on system76, it works fine as expected.

[milva-unikie]

@milva-unikie, I am sorry for not providing clear steps to test it. First time when you are booting with network cable plugged in then the policy applies within 1-2 minutes. In case you are using wifi, after configuring wifi network you need to wait for 5-6 minutes. On boot it polls for policy every 5 minutes. By the time we configure wifi, first poll happens and due to network unavailability it doesn't get latest policy. If you don't want to wait reboot the system after saving the wifi configuration.

Once policy is downloaded then it persists the effect is permanent so subsequent boot will have the effect immediately.

I always tested with network cable plugged in on Lenovo-X1, so forgot to mention these details. I tested with wifi on system76, it works fine as expected.

After waiting for a while chatgpt.com can no longer be accessed. However, I would argue that it being available for several minutes is still a bug. It is not very secure that the pages can be accessed before the policy is applied.

[gngram]

Since policy polling is periodic by design, there will always be a small window between checks. That is indeed a performance trade-off between reducing CPU/network overhead and achieving real-time policy enforcement. The fact that the polling interval is configurable helps balance security requirements with system efficiency.

Also, once the policy is successfully downloaded and applied, it becomes resident and effective immediately — including across reboots — which means the security posture is maintained after the initial update.

This is a common trade-off: polling avoids complexity and resource overhead, while push frameworks can reduce latency but require additional infrastructure on Ghaf machine and Policy server both.

[milva-unikie]

Since policy polling is periodic by design, there will always be a small window between checks. That is indeed a performance trade-off between reducing CPU/network overhead and achieving real-time policy enforcement. The fact that the polling interval is configurable helps balance security requirements with system efficiency.

Also, once the policy is successfully downloaded and applied, it becomes resident and effective immediately — including across reboots — which means the security posture is maintained after the initial update.

This is a common trade-off: polling avoids complexity and resource overhead, while push frameworks can reduce latency but require additional infrastructure on Ghaf machine and Policy server both.

Allowed addresses are also restricted in business-vm, but there everything is blocked until the list has been fetched. I believe it takes a maximum of two minutes to update after the internet connection is established.

I don’t think the current solution is optimal, but it works like described.

For testing purposes, it would be good to keep some address blocked. Definitely not Chatgpt, but some random website that we are not expecting anyone to visit accidentally.