ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Permit subordinate sandbox identity transitions

Browse source
This commit is contained in:
ms2k 2026-07-22 03:08:27 +09:00
commit 09dae24f52
3 changed files with 66 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

34
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -5,6 +5,7 @@ use std::io::{Read, Write};
use std::os::fd::{AsFd, OwnedFd};
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::path::{Component, Path, PathBuf};
use std::sync::LazyLock;
use lazaret_core::configuration::{ConfinedPathPlan, ResolvedDomainConfiguration, SandboxLayoutV1};
use lazaret_core::identity::{ConfigurationFingerprint, ContainerId, DomainId, NamespaceIdentity};
@ -17,7 +18,7 @@ pub use lazaret_sandbox_contract::{
SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
Capabilities, Capability, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
LinuxNamespaceType, Mount, MountBuilder, ProcessBuilder, RootBuilder, Spec, SpecBuilder,
UserBuilder,
};
@ -689,9 +690,7 @@ fn build_sandbox_bundle_from_source(
.linux(linux)
.build()
.map_err(oci_error)?;
let specification_json = serde_json::to_vec(&specification).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})?;
let specification_json = canonical_specification_json(&specification)?;
let bundle_authorization = Sha256::digest(&specification_json).into();
let command = build_runsc_command(&paths, bundle_authorization);
let runtime_sources =
@ -709,6 +708,33 @@ fn build_sandbox_bundle_from_source(
})
}
fn canonical_specification_json(specification: &Spec) -> Result<Vec<u8>, SandboxBuildError> {
let mut value = serde_json::to_value(specification).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})?;
let capabilities = value
.pointer_mut("/process/capabilities")
.and_then(serde_json::Value::as_object_mut)
.ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::JsonEncoding,
"OCI process capabilities are missing",
)
})?;
for set in capabilities.values_mut() {
let entries = set.as_array_mut().ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::JsonEncoding,
"OCI process capability set is not an array",
)
})?;
entries.sort_by(|left, right| left.as_str().cmp(&right.as_str()));
}
serde_json::to_vec(&value).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})
}
mod mounts;
mod runtime_sources;
mod validation;

15
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -1,7 +1,7 @@
use super::{
AtFlags, Capabilities, ContainerId, File, FileIdentity, FileType, HandoffPathType,
LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder, LinuxNamespaceType, Mode, Mount,
NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf, ProcessBuilder,
AtFlags, Capabilities, Capability, ContainerId, File, FileIdentity, FileType, HandoffPathType,
LazyLock, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder, LinuxNamespaceType,
Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf, ProcessBuilder,
RUNTIME_FILE_DESTINATIONS, Read, ResolveFlags, ResolvedDomainConfiguration, RootProcess,
RunscCommand, RuntimeHandoffSource, SandboxBuildError, SandboxBuildErrorKind,
StagedHostTerminal, StatxFlags, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
@ -335,12 +335,15 @@ pub(super) fn build_process(
root_process: RootProcess,
_terminal: Option<&StagedHostTerminal>,
) -> Result<oci_spec::runtime::Process, SandboxBuildError> {
static IDENTITY_TRANSITION_CAPABILITIES: LazyLock<Capabilities> =
LazyLock::new(|| Capabilities::from([Capability::Setgid, Capability::Setuid]));
let empty = Capabilities::new();
let identity = IDENTITY_TRANSITION_CAPABILITIES.clone();
let capabilities = LinuxCapabilitiesBuilder::default()
.bounding(empty.clone())
.effective(empty.clone())
.bounding(identity.clone())
.effective(identity.clone())
.inheritable(empty.clone())
.permitted(empty.clone())
.permitted(identity)
.ambient(empty)
.build()
.map_err(oci_error)?;

6
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -294,7 +294,11 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
assert_eq!(
specification["process"]["capabilities"],
serde_json::json!({
"bounding": [], "effective": [], "inheritable": [], "permitted": [], "ambient": []
"bounding": ["CAP_SETGID", "CAP_SETUID"],
"effective": ["CAP_SETGID", "CAP_SETUID"],
"inheritable": [],
"permitted": ["CAP_SETGID", "CAP_SETUID"],
"ambient": []
})
);