Enforce NONMODIFIABLE and TRUSTED NVM policy on keystore key commit

[yosuke-wolfssl]

Problem

WH_KEY_COMMIT persisted a cached key to NVM with no NONMODIFIABLE/TRUSTED
policy check addressed by f_4225.
A cache slot whose id names an immutable NVM object could be committed over it,
overwriting a key the policy layer declares unmodifiable. The obvious cache
route is already blocked (WH_KS_OP_CACHE checks NONMODIFIABLE), so this is a
defense-in-depth hole in the central keystore gate, not a demonstrated bypass.

Fix (src/wh_server_keystore.c)

Added a WH_KS_OP_COMMIT branch to _KeystoreCheckPolicy that reads the
stored object's flags (not the cache-first copy a client controls) and
returns WH_ERROR_ACCESS when the target is NONMODIFIABLE or TRUSTED.

• Scoped to a cached key. An uncached id has nothing to commit and still
  reports WH_ERROR_NOTFOUND, so there is no client-visible protocol change.
• First commit still allowed. Creating an immutable key (cache with the
  flag, then commit once) is unaffected; only overwriting an existing immutable
  object is refused.
• Enforcement stays in the keystore gate. wh_Server_KeystoreCommitKey
  keeps its unchecked wh_Nvm_AddObjectWithReclaim, preserving the repo's
  X()/XChecked() layering; the client path reaches the gate through
  wh_Server_KeystoreCommitKeyChecked.

Closes f_4225. wh_Server_KeystoreRevokeKey shares the same cache-to-NVM write
shape and is left as a separate item (see below).

Tests

New whTest_KeystoreCommitPolicy (test-refactor, server group), 4 sub-tests:
overwrite of a NONMODIFIABLE object, of a TRUSTED object, first-commit of an
immutable key succeeds, normal commit round-trips through NVM. Includes the
uncached-commit NOTFOUND guard.

Verification

• test-refactor: 44/26/0 default, 50/20/0 SHE=1, 48/22/0 DMA=1, 16/54/0
  NOCRYPTO=1 (skips cleanly); legacy test/ exit 0.
• Clean under -std=c90 -Werror -Wall -Wextra.
• Negative control: reverting the gate fails the poisoned-cache assertion.

[Copilot]

Pull request overview

This pull request closes a defense-in-depth gap in the server keystore “gate” by ensuring WH_KEY_COMMIT cannot overwrite existing NVM objects that are marked NONMODIFIABLE or TRUSTED. The policy enforcement is implemented centrally in the keystore policy checker (rather than in the lower-level commit function), and is validated via a new server-side test suite.

Changes:

• Add a WH_KS_OP_COMMIT policy branch that consults the stored NVM object’s flags and denies overwrite when NONMODIFIABLE or TRUSTED.
• Register and add a new server test (whTest_KeystoreCommitPolicy) covering overwrite-denial, first-commit allowance, normal commit round-trip, and the “uncached commit returns NOTFOUND” guard.
• Extend the server test registry to include the new test.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/wh_server_keystore.c	Enforces NONMODIFIABLE/TRUSTED overwrite denial for commit by checking stored NVM metadata when a cache slot is being committed.
test-refactor/server/wh_test_keystore_policy.c	Adds targeted server-side tests validating commit policy behavior and ensuring stored bytes/flags remain unchanged on denied overwrite.
test-refactor/wh_test_list.c	Registers the new keystore commit policy test in the server test group.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #492

Scan targets checked: wolfhsm-core-bugs, wolfhsm-src

No new issues found in the changed files. ✅