ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Permit subordinate sandbox identity transitions

Browse source
This commit is contained in:
ms2k 2026-07-22 03:08:27 +09:00
commit 09dae24f52
1 changed files with 66 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

34
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -5,6 +5,7 @@ use std::io::{Read, Write};
use std::os::fd::{AsFd, OwnedFd};
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::path::{Component, Path, PathBuf};
use std::sync::LazyLock;
use lazaret_core::configuration::{ConfinedPathPlan, ResolvedDomainConfiguration, SandboxLayoutV1};
use lazaret_core::identity::{ConfigurationFingerprint, ContainerId, DomainId, NamespaceIdentity};
@ -17,7 +18,7 @@ pub use lazaret_sandbox_contract::{
SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
Capabilities, Capability, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
LinuxNamespaceType, Mount, MountBuilder, ProcessBuilder, RootBuilder, Spec, SpecBuilder,
UserBuilder,
};
@ -689,9 +690,7 @@ fn build_sandbox_bundle_from_source(
.linux(linux)
.build()
.map_err(oci_error)?;
let specification_json = serde_json::to_vec(&specification).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})?;
let specification_json = canonical_specification_json(&specification)?;
let bundle_authorization = Sha256::digest(&specification_json).into();
let command = build_runsc_command(&paths, bundle_authorization);
let runtime_sources =
@ -709,6 +708,33 @@ fn build_sandbox_bundle_from_source(
})
}
fn canonical_specification_json(specification: &Spec) -> Result<Vec<u8>, SandboxBuildError> {
let mut value = serde_json::to_value(specification).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})?;
let capabilities = value
.pointer_mut("/process/capabilities")
.and_then(serde_json::Value::as_object_mut)
.ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::JsonEncoding,
"OCI process capabilities are missing",
)
})?;
for set in capabilities.values_mut() {
let entries = set.as_array_mut().ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::JsonEncoding,
"OCI process capability set is not an array",
)
})?;
entries.sort_by(|left, right| left.as_str().cmp(&right.as_str()));
}
serde_json::to_vec(&value).map_err(|error| {
SandboxBuildError::new(SandboxBuildErrorKind::JsonEncoding, error.to_string())
})
}
mod mounts;
mod runtime_sources;
mod validation;