ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Permit subordinate sandbox identity transitions

Browse source
This commit is contained in:
ms2k 2026-07-22 03:08:27 +09:00
commit 09dae24f52
4 changed files with 66 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

34
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -5,6 +5,7 @@ use std::io::{Read, Write};
use std::os::fd::{AsFd, OwnedFd};
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::path::{Component, Path, PathBuf};
use std::sync::LazyLock;
use lazaret_core::configuration::{ConfinedPathPlan, ResolvedDomainConfiguration, SandboxLayoutV1};
use lazaret_core::identity::{ConfigurationFingerprint, ContainerId, DomainId, NamespaceIdentity};
@ -17,7 +18,7 @@ pub use lazaret_sandbox_contract::{
SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
Capabilities, Capability, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
LinuxNamespaceType, Mount, MountBuilder, ProcessBuilder, RootBuilder, Spec, SpecBuilder,
UserBuilder,
};
@ -689,9 +690,7 @@ fn build_sandbox_bundle_from_source(
.linux(linux)
.build()
.map_err(oci_error)?;
let specification_json = serde_json::to_vec(&specification).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})?;
let specification_json = canonical_specification_json(&specification)?;
let bundle_authorization = Sha256::digest(&specification_json).into();
let command = build_runsc_command(&paths, bundle_authorization);
let runtime_sources =
@ -709,6 +708,33 @@ fn build_sandbox_bundle_from_source(
})
}
fn canonical_specification_json(specification: &Spec) -> Result<Vec<u8>, SandboxBuildError> {
let mut value = serde_json::to_value(specification).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})?;
let capabilities = value
.pointer_mut("/process/capabilities")
.and_then(serde_json::Value::as_object_mut)
.ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::JsonEncoding,
"OCI process capabilities are missing",
)
})?;
for set in capabilities.values_mut() {
let entries = set.as_array_mut().ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::JsonEncoding,
"OCI process capability set is not an array",
)
})?;
entries.sort_by(|left, right| left.as_str().cmp(&right.as_str()));
}
serde_json::to_vec(&value).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})
}
mod mounts;
mod runtime_sources;
mod validation;

15
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -1,7 +1,7 @@
use super::{
AtFlags, Capabilities, ContainerId, File, FileIdentity, FileType, HandoffPathType,
LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder, LinuxNamespaceType, Mode, Mount,
NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf, ProcessBuilder,
AtFlags, Capabilities, Capability, ContainerId, File, FileIdentity, FileType, HandoffPathType,
LazyLock, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder, LinuxNamespaceType,
Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf, ProcessBuilder,
RUNTIME_FILE_DESTINATIONS, Read, ResolveFlags, ResolvedDomainConfiguration, RootProcess,
RunscCommand, RuntimeHandoffSource, SandboxBuildError, SandboxBuildErrorKind,
StagedHostTerminal, StatxFlags, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
@ -335,12 +335,15 @@ pub(super) fn build_process(
root_process: RootProcess,
_terminal: Option<&StagedHostTerminal>,
) -> Result<oci_spec::runtime::Process, SandboxBuildError> {
static IDENTITY_TRANSITION_CAPABILITIES: LazyLock<Capabilities> =
LazyLock::new(|| Capabilities::from([Capability::Setgid, Capability::Setuid]));
let empty = Capabilities::new();
let identity = IDENTITY_TRANSITION_CAPABILITIES.clone();
let capabilities = LinuxCapabilitiesBuilder::default()
.bounding(empty.clone())
.effective(empty.clone())
.bounding(identity.clone())
.effective(identity.clone())
.inheritable(empty.clone())
.permitted(empty.clone())
.permitted(identity)
.ambient(empty)
.build()
.map_err(oci_error)?;

6
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -294,7 +294,11 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
assert_eq!(
specification["process"]["capabilities"],
serde_json::json!({
"bounding": [], "effective": [], "inheritable": [], "permitted": [], "ambient": []
"bounding": ["CAP_SETGID", "CAP_SETUID"],
"effective": ["CAP_SETGID", "CAP_SETUID"],
"inheritable": [],
"permitted": ["CAP_SETGID", "CAP_SETUID"],
"ambient": []
})
);

28
crates/lazaret-sandbox-init/src/lib.rs
View file

@ -62,7 +62,7 @@ fn run_sandbox_init() -> io::Result<()> {
authenticate_canary(Ipv4Addr::new(10, 137, 55, 2), &generation).is_ok(),
authenticate_canary(Ipv4Addr::new(10, 137, 55, 3), &generation).is_err(),
ipv6_absent().unwrap_or(false),
network_capabilities_empty().unwrap_or(false),
network_admin_capability_absent().unwrap_or(false),
route_mutation_refused,
];
write_observation("initial", &initial)?;
@ -159,15 +159,22 @@ fn read_optional_proc(path: &str) -> io::Result<String> {
}
}
fn network_capabilities_empty() -> io::Result<bool> {
fn network_admin_capability_absent() -> io::Result<bool> {
let status = std::fs::read_to_string("/proc/self/status")?;
network_admin_capability_absent_from_status(&status)
}
fn network_admin_capability_absent_from_status(status: &str) -> io::Result<bool> {
let names = ["CapInh:", "CapPrm:", "CapEff:", "CapBnd:", "CapAmb:"];
Ok(names.into_iter().all(|name| {
status
names.into_iter().try_fold(true, |absent, name| {
let value = status
.lines()
.find_map(|line| line.strip_prefix(name))
.is_some_and(|value| value.trim().bytes().all(|byte| byte == b'0'))
}))
.ok_or_else(|| io::Error::other("process capability status is incomplete"))?;
let bits = u64::from_str_radix(value.trim(), 16)
.map_err(|_| io::Error::other("process capability status is malformed"))?;
Ok(absent && bits & (1 << 12) == 0)
})
}
fn route_mutation_refused() -> io::Result<bool> {
@ -442,4 +449,13 @@ mod tests {
assert!(group_is_present_except(group, u32::MAX).unwrap());
assert!(!group_is_present_except(u32::MAX, u32::MAX).unwrap());
}
#[test]
fn network_attestation_allows_only_non_network_capabilities() {
let setid = "CapInh:\t0000000000000000\nCapPrm:\t00000000000000c0\nCapEff:\t00000000000000c0\nCapBnd:\t00000000000000c0\nCapAmb:\t0000000000000000\n";
assert!(network_admin_capability_absent_from_status(setid).unwrap());
let network_admin = setid.replace("00000000000000c0", "00000000000010c0");
assert!(!network_admin_capability_absent_from_status(&network_admin).unwrap());
assert!(network_admin_capability_absent_from_status("CapEff:\t0\n").is_err());
}
}