lazaret/support/process-safety.toml

schema = 2

[policy]
id = "causal-child-acquisition-v1"
broker_crate = "lazaret-process-broker"
broker_state = "unimplemented"
production_roots = ["crates"]
lint_config = ".clippy.toml"
lint_allow_paths = []
dynamic_scenario = "process-safety-baseline-exercised-paths"
dynamic_coverage = "registered-exercised-paths-only"
completion_owner = "IP-03"
trace_expression = "process,wait4,waitid,rt_sigaction"
forbidden_syscall_patterns = [
    '^clone3?\(',
    '^execveat\(',
    '^fork\(',
    '^vfork\(',
    '^wait4\(',
    '^waitid\(',
    '^rt_sigaction\(SIGCHLD,',
]
disallowed_types = [
    "std::process::Child",
    "std::process::Command",
    "tokio::process::Child",
    "tokio::process::Command",
]
disallowed_methods = [
    "libc::clone",
    "libc::execve",
    "libc::execveat",
    "libc::fork",
    "libc::posix_spawn",
    "libc::sigaction",
    "libc::signal",
    "libc::vfork",
    "libc::wait",
    "libc::wait4",
    "libc::waitid",
    "libc::waitpid",
    "nix::sys::signal::sigaction",
    "nix::sys::wait::wait",
    "nix::sys::wait::waitid",
    "nix::sys::wait::waitpid",
    "nix::unistd::execve",
    "nix::unistd::execveat",
    "nix::unistd::fork",
    "nix::unistd::vfork",
    "rustix::process::kill_process",
    "rustix::process::kill_process_group",
    "rustix::process::pidfd_open",
    "rustix::process::pidfd_send_signal",
    "rustix::process::waitid",
    "rustix::process::waitpid",
    "std::process::Child::kill",
    "std::process::Child::try_wait",
    "std::process::Child::wait",
    "std::process::Child::wait_with_output",
    "std::process::Command::output",
    "std::process::Command::spawn",
    "std::process::Command::status",
]

[[trace_case]]
binary = "lazaret"
args = []
expected_exit_code = 0
initial_execve_count = 1

[[trace_case]]
binary = "lazaret-escalation-client"
args = []
expected_exit_code = 0
initial_execve_count = 1

[[trace_case]]
binary = "lazaret-host-coordinator"
args = []
expected_exit_code = 0
initial_execve_count = 1

[[trace_case]]
binary = "lazaret-network-sidecar"
args = []
expected_exit_code = 0
initial_execve_count = 1

[[trace_case]]
binary = "lazaret-runtime-supervisor"
args = []
expected_exit_code = 0
initial_execve_count = 1

[[runtime_dependency]]
name = "cobs"
version = "0.3.0"
checksum = "0fa961b519f0b462e3a3b4a34b64d119eeaca1d59af726fe450bbba07a9fc0a1"
features = []
reviewed_process_apis = []

[[runtime_dependency]]
name = "embedded-io"
version = "0.4.0"
checksum = "ef1a6892d9eef45c8fa6b9e0086428a2cca8491aca8f787c534a3d6d0bcb3ced"
features = ["alloc"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "embedded-io"
version = "0.6.1"
checksum = "edd0f118536f44f5ccd48bcb8b111bdc3de888b58c74639dfb034a357d0f206d"
features = ["alloc"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "postcard"
version = "1.1.3"
checksum = "6764c3b5dd454e283a30e6dfe78e9b31096d9e32036b5d1eaac7a6119ccb9a24"
features = ["alloc", "use-std"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "proc-macro2"
version = "1.0.106"
checksum = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934"
features = ["default", "proc-macro"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "quote"
version = "1.0.46"
checksum = "dfbc457d0c7a0759a614551b11a6409e5951f6c7537be1f1b7682b9ae9230368"
features = ["default", "proc-macro"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "serde"
version = "1.0.228"
checksum = "9a8e94ea7f378bd32cbbd37198a4a91436180c5bb472411e48b5ec2e2124ae9e"
features = ["alloc", "default", "derive", "serde_derive", "std"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "serde_core"
version = "1.0.228"
checksum = "41d385c7d4ca58e59fc732af25c3983b67ac852c1a25000afe1175de458b67ad"
features = ["alloc", "result", "std"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "serde_derive"
version = "1.0.228"
checksum = "d540f220d3187173da220f885ab66608367b6574e925011a9353e4badda91d79"
features = ["default"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "syn"
version = "2.0.118"
checksum = "1b9ae57f904213ebb649ce6895b8a66c66f0203b9319718f69a5612a065b1422"
features = ["clone-impls", "default", "derive", "parsing", "printing", "proc-macro"]
reviewed_process_apis = []

[[runtime_dependency]]
name = "thiserror"
version = "2.0.18"
checksum = "4288b5bcbc7920c07a1149a35cf9590a2aa808e0bc1eafaade0b80947865fbc4"
features = []
reviewed_process_apis = []

[[runtime_dependency]]
name = "thiserror-impl"
version = "2.0.18"
checksum = "ebc4ee7f67670e9b64d05fa4253e753e016c6c95ff35b89b7941d6b856dec1d5"
features = []
reviewed_process_apis = []

[[runtime_dependency]]
name = "unicode-ident"
version = "1.0.24"
checksum = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75"
features = []
reviewed_process_apis = []