ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Align network verifiers with runtime namespace sources

Browse source
This commit is contained in:
ms2k 2026-07-17 17:24:45 +09:00
commit 1867f65d4e
2 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

8
crates/lazaret-runtime-supervisor/src/network.rs
View file

@ -214,8 +214,12 @@ where
}
#[allow(deprecated)]
pub(crate) fn enter_generation_filesystem_namespaces()
-> io::Result<(NamespaceIdentity, NamespaceIdentity)> {
/// Enters the generation user and mount namespaces before network preparation.
///
/// # Errors
/// Returns an error when namespace creation, ID mapping, or mount isolation fails.
pub fn enter_generation_filesystem_namespaces() -> io::Result<(NamespaceIdentity, NamespaceIdentity)>
{
let uid = getuid().as_raw();
let gid = getgid().as_raw();
rustix::thread::unshare(UnshareFlags::NEWUSER)?;

3
crates/lazaret-runtime-supervisor/tests/network-runtime.rs
View file

@ -25,7 +25,7 @@ use lazaret_linux::process::{
};
use lazaret_runtime_supervisor::network::{
DnsProbeTarget, NetworkAttestationContext, NetworkProbeRequest, TcpProbeTarget,
prepare_network, probe_current_network,
enter_generation_filesystem_namespaces, prepare_network, probe_current_network,
};
use rustix::io::{FdFlags, fcntl_setfd};
use rustix::process::Signal;
@ -156,6 +156,7 @@ fn run_child(arguments: &[OsString]) -> std::io::Result<()> {
)?;
let policy_file = File::open(format!("/proc/self/fd/{policy_fd}"))?;
require_write_sealed(&policy_file)?;
enter_generation_filesystem_namespaces()?;
let runtime = current_process_identity()?;
let prepared = prepare_network(
&policy_file,