ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Align network verifiers with runtime namespace sources

Browse source
This commit is contained in:
ms2k 2026-07-17 17:24:45 +09:00
commit 1867f65d4e
3 changed files with 12 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

6
crates/lazaret-host-coordinator/tests/runtime-composition.rs
View file

@ -1220,8 +1220,10 @@ impl NetworkFixture {
std::env::current_exe()?, std::env::current_exe()?,
rootfs.join("bin/lazaret-network-probe"), rootfs.join("bin/lazaret-network-probe"),
)?; )?;
fs::create_dir_all(rootfs.join("etc"))?; fs::write(
fs::write(rootfs.join("etc/resolv.conf"), b"nameserver 10.0.2.3\n")?; runtime_domain.join("state-anchor/runtime-files/resolv.conf"),
b"nameserver 10.0.2.3\n",
)?;
let host_loopback = TcpListener::bind((Ipv4Addr::LOCALHOST, 0))?; let host_loopback = TcpListener::bind((Ipv4Addr::LOCALHOST, 0))?;
let host_loopback_port = host_loopback.local_addr()?.port(); let host_loopback_port = host_loopback.local_addr()?.port();
let abstract_name = format!("lazaret-network-v3-{}", std::process::id()).into_bytes(); let abstract_name = format!("lazaret-network-v3-{}", std::process::id()).into_bytes();

8
crates/lazaret-runtime-supervisor/src/network.rs
View file

@ -214,8 +214,12 @@ where
} }
#[allow(deprecated)] #[allow(deprecated)]
pub(crate) fn enter_generation_filesystem_namespaces() /// Enters the generation user and mount namespaces before network preparation.
-> io::Result<(NamespaceIdentity, NamespaceIdentity)> { ///
/// # Errors
/// Returns an error when namespace creation, ID mapping, or mount isolation fails.
pub fn enter_generation_filesystem_namespaces() -> io::Result<(NamespaceIdentity, NamespaceIdentity)>
{
let uid = getuid().as_raw(); let uid = getuid().as_raw();
let gid = getgid().as_raw(); let gid = getgid().as_raw();
rustix::thread::unshare(UnshareFlags::NEWUSER)?; rustix::thread::unshare(UnshareFlags::NEWUSER)?;

3
crates/lazaret-runtime-supervisor/tests/network-runtime.rs
View file

@ -25,7 +25,7 @@ use lazaret_linux::process::{
}; };
use lazaret_runtime_supervisor::network::{ use lazaret_runtime_supervisor::network::{
DnsProbeTarget, NetworkAttestationContext, NetworkProbeRequest, TcpProbeTarget, DnsProbeTarget, NetworkAttestationContext, NetworkProbeRequest, TcpProbeTarget,
prepare_network, probe_current_network, enter_generation_filesystem_namespaces, prepare_network, probe_current_network,
}; };
use rustix::io::{FdFlags, fcntl_setfd}; use rustix::io::{FdFlags, fcntl_setfd};
use rustix::process::Signal; use rustix::process::Signal;
@ -156,6 +156,7 @@ fn run_child(arguments: &[OsString]) -> std::io::Result<()> {
)?; )?;
let policy_file = File::open(format!("/proc/self/fd/{policy_fd}"))?; let policy_file = File::open(format!("/proc/self/fd/{policy_fd}"))?;
require_write_sealed(&policy_file)?; require_write_sealed(&policy_file)?;
enter_generation_filesystem_namespaces()?;
let runtime = current_process_identity()?; let runtime = current_process_identity()?;
let prepared = prepare_network( let prepared = prepare_network(
&policy_file, &policy_file,