Fix copilot review comments from blockdev mounts PR

Addresses the following comments:
microsoft#2762 (comment)
microsoft#2762 (comment)
microsoft#2762 (comment)
microsoft#2762 (comment)
microsoft#2762 (comment)
microsoft#2762 (comment)

Assisted-by: GitHub Copilot:claude-opus-4.7 copilot-review
Signed-off-by: Tingmao Wang <m@maowtm.org>

Author: micromaomao

internal/guest/runtime/hcsv2/uvm.go

@@ -408,7 +408,7 @@ func checkContainerSettings(sandboxID, containerID string, settings *prot.VMHost
 func (h *Host) checkMountsNotBroken() error {
 	if h.HasSecurityPolicy() && h.mountsBroken.Load() {
 		return errors.Errorf(
-			"Mount, unmount, container creation and deletion has been disabled in this UVM due to a previous error (%q)",
+			"Mount, unmount, container creation and deletion have been disabled in this UVM due to a previous error (%q)",
 			h.mountsBrokenCausedBy,
 		)
 	}

internal/regopolicyinterpreter/regopolicyinterpreter_test.go

@@ -89,9 +89,11 @@ func Test_copyRegoMetadata(t *testing.T) {
 			if copyObject, ok := copy[name]; ok {
 				if !assertObjectsEqual(origObject, copyObject) {
 					t.Errorf("original and copy differ on key %s", name)
+					return false
 				}
 			} else {
 				t.Errorf("copy missing object %s", name)
+				return false
 			}
 		}
 

pkg/securitypolicy/regopolicy_linux_test.go

@@ -2127,7 +2127,7 @@ func Test_Rego_EnforceCreateContainer_Capabilities_Drop_NoMatches(t *testing.T)
 	}
 }
 
-func Test_Regi_EnforceCreateContainer_RequireNoDevices(t *testing.T) {
+func Test_Rego_EnforceCreateContainer_RequireNoDevices(t *testing.T) {
 	f := func(p *generatedConstraints) bool {
 		tc, err := setupSimpleRegoCreateContainerTest(p)
 		if err != nil {
@@ -2156,7 +2156,7 @@ func Test_Regi_EnforceCreateContainer_RequireNoDevices(t *testing.T) {
 	}
 
 	if err := quick.Check(f, &quick.Config{MaxCount: 50, Rand: testRand}); err != nil {
-		t.Errorf("Test_Regi_EnforceCreateContainer_RequireNoDevices: %v", err)
+		t.Errorf("Test_Rego_EnforceCreateContainer_RequireNoDevices: %v", err)
 	}
 }
 

pkg/securitypolicy/securitypolicyenforcer.go

@@ -60,7 +60,7 @@ func init() {
 
 // Represents an in-progress revertable section.  To ensure state is consistent,
 // Commit() and Rollback() must not fail, so they do not return anything, and if
-// an error does occur they should panic.
+// an error does occur they should panic or trigger an unrecoverable error.
 type RevertableSectionHandle interface {
 	Commit()
 	Rollback()

pkg/securitypolicy/securitypolicyenforcer_rego.go

@@ -843,6 +843,13 @@ func appendMountData(mountData []interface{}, mounts []oci.Mount) []interface{}
 	return mountData
 }
 
+func uint32ptrtoany(i *uint32) interface{} {
+	if i == nil {
+		return nil
+	}
+	return *i
+}
+
 func appendDeviceData(deviceData []interface{}, devices []oci.LinuxDevice) []interface{} {
 	for _, device := range devices {
 		deviceData = append(deviceData, inputData{
@@ -851,8 +858,8 @@ func appendDeviceData(deviceData []interface{}, devices []oci.LinuxDevice) []int
 			"major":    device.Major,
 			"minor":    device.Minor,
 			"fileMode": device.FileMode,
-			"uid":      device.UID,
-			"gid":      device.GID,
+			"uid":      uint32ptrtoany(device.UID),
+			"gid":      uint32ptrtoany(device.GID),
 		})
 	}
 
@@ -1245,7 +1252,7 @@ func (policy *regoEnforcer) StartRevertableSection() (RevertableSectionHandle, e
 	if err != nil {
 		err = errors.Wrapf(err, "unable to save metadata for revertable section")
 		policy.revertableSectionLock.Unlock()
-		return &revertableSectionHandle{}, err
+		return nil, err
 	}
 	// Keep policy.revertableSectionLock locked until the end of the section.
 	sh := &revertableSectionHandle{