Add a static trusted sandbox init

tools/install-to-host

@@ -18,7 +18,7 @@ elif [ "$#" -ne 0 ]; then
     exit 2
 fi
 
-for command in cargo install; do
+for command in cargo install readelf; do
     command -v "$command" >/dev/null 2>&1 || {
         printf '%s\n' "install-to-host: $command is required" >&2
         exit 1
@@ -34,6 +34,12 @@ cargo build \
     --package lazaret-host-coordinator \
     --package lazaret-escalation-client \
     --bins
+env RUSTFLAGS="-C relocation-model=static -C link-arg=-no-pie" cargo build \
+    --release \
+    --locked \
+    --target x86_64-unknown-linux-musl \
+    --package lazaret-sandbox-init \
+    --bin lazaret-sandbox-init
 
 target_dir="${CARGO_TARGET_DIR:-target}"
 if [[ "$target_dir" != /* ]]; then
@@ -44,5 +50,12 @@ install -d -m 755 "$install_dir"
 for executable in lazaret lazaret-host-coordinator lazaret-escalation-client; do
     install -m 755 "$target_dir/release/$executable" "$install_dir/$executable"
 done
+sandbox_init="$target_dir/x86_64-unknown-linux-musl/release/lazaret-sandbox-init"
+if readelf -l "$sandbox_init" | grep -q 'Requesting program interpreter' ||
+    ! readelf -d "$sandbox_init" 2>&1 | grep -q 'There is no dynamic section'; then
+    printf '%s\n' "install-to-host: sandbox init is dynamically linked" >&2
+    exit 1
+fi
+install -m 755 "$sandbox_init" "$install_dir/lazaret-sandbox-init"
 
 printf '%s\n' "Installed Lazaret in $install_dir"