ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Add fail-closed Linux process and descriptor primitives

Browse source
This commit is contained in:
ms2k 2026-07-14 22:08:29 +09:00
commit 1468f6b841
1 changed files with 1725 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

54
crates/lazaret-linux/tests/capability-drop-helper.rs Normal file
View file

@ -0,0 +1,54 @@
use std::process::ExitCode;
use rustix::thread::{
CapabilitySet, capabilities, capability_is_in_ambient_set, configure_capability_in_ambient_set,
set_capabilities,
};
#[allow(clippy::disallowed_methods, clippy::disallowed_types)]
fn main() -> ExitCode {
if std::env::var_os("LAZARET_CAPABILITY_DROP_ISOLATED").is_none() {
let before = lazaret_linux::capability::inspect(CapabilitySet::NET_ADMIN)
.expect("inspect unprivileged capability state");
if lazaret_linux::capability::irreversibly_drop(CapabilitySet::NET_ADMIN).is_ok()
|| lazaret_linux::capability::inspect(CapabilitySet::NET_ADMIN).ok() != Some(before)
{
return ExitCode::FAILURE;
}
return match std::process::Command::new("unshare")
.args(["--user", "--map-root-user"])
.arg(std::env::current_exe().expect("test executable path"))
.env("LAZARET_CAPABILITY_DROP_ISOLATED", "1")
.status()
{
Ok(status) if status.success() => ExitCode::SUCCESS,
Ok(_) | Err(_) => ExitCode::FAILURE,
};
}
let capability = CapabilitySet::NET_ADMIN;
let retained = CapabilitySet::CHOWN;
let mut sets = capabilities(None).expect("inspect isolated capability sets");
sets.inheritable.insert(retained);
set_capabilities(None, sets).expect("prepare unrelated ambient capability");
configure_capability_in_ambient_set(retained, true)
.expect("raise unrelated ambient capability");
if lazaret_linux::capability::irreversibly_drop(capability).is_err() {
return ExitCode::FAILURE;
}
let Ok(observed) = lazaret_linux::capability::inspect(capability) else {
return ExitCode::FAILURE;
};
if observed.sets.effective.intersects(capability)
|| observed.sets.permitted.intersects(capability)
|| observed.sets.inheritable.intersects(capability)
|| observed.ambient
|| observed.bounding
|| !capability_is_in_ambient_set(retained).unwrap_or(false)
|| configure_capability_in_ambient_set(capability, true).is_ok()
{
ExitCode::FAILURE
} else {
ExitCode::SUCCESS
}
}