Heap allocation not identified as sealed capability by cheriot-audit

[raylau1]

When following the instructions in the firmware auditing exercise part 1, uncommenting the heap allocation code in sealed_capability.cc and running

xmake -P exercises
cheriot-audit --board=cheriot-rtos/sdk/boards/sonata.json \
              --firmware-report=build/cheriot/cheriot/release/firmware_auditing_part_1.json \
              --module=exercises/firmware_auditing/part_1/no_sealed_capabilities.rego \
              --query='data.no_seal.valid'

does not correctly return false since branch v1.2. The same audit returns false as expected when using branch v1.1 and v1.0.

The sealed_capability compartment in the generated firmware_auditing_part_1.json when using branch v1.3 is shown below:

The same section when using branch v1.1 is shown below, objects that were missing when using branch v1.3 are highlighted:

[marnovandermaas]

@AlexJones0 whenever you have time would you be able to look at this?

[ziuziakowska]

Attempting to bisect gives these commits as causing the issue (these specific commits would not build):

There are only 'skip'ped commits left to test.
The first bad commit could be any of:
6db32611393f7a388274c595b0c26346e272abcd
610851b936b67358142d1e8827d84e8c693a4858
7ddbabedaec37a6fbf2a7997269088959732bf73
39c13220eeb617b2b4e52e6fef864b4a31f4e1bd
We cannot bisect more!

I believe it is likely to be changes in CHERIoT RTOS that have caused this, so I will try to bisect that (although as it is a submodule, that might be difficult).

[ziuziakowska]

Going backwards from the new CHERIoT-RTOS tree after it was updated (https://github.com/CHERIoT-Platform/cheriot-rtos/tree/21fe9d4775108325e4efe930c427564731d22f00), this commit/PR seems to be the issue: CHERIoT-Platform/cheriot-rtos#460