Align network verifiers with runtime namespace sources

crates/lazaret-host-coordinator/tests/runtime-composition.rs

@@ -1220,8 +1220,10 @@ impl NetworkFixture {
             std::env::current_exe()?,
             rootfs.join("bin/lazaret-network-probe"),
         )?;
-        fs::create_dir_all(rootfs.join("etc"))?;
-        fs::write(rootfs.join("etc/resolv.conf"), b"nameserver 10.0.2.3\n")?;
+        fs::write(
+            runtime_domain.join("state-anchor/runtime-files/resolv.conf"),
+            b"nameserver 10.0.2.3\n",
+        )?;
         let host_loopback = TcpListener::bind((Ipv4Addr::LOCALHOST, 0))?;
         let host_loopback_port = host_loopback.local_addr()?.port();
         let abstract_name = format!("lazaret-network-v3-{}", std::process::id()).into_bytes();

crates/lazaret-runtime-supervisor/src/network.rs

@@ -214,8 +214,12 @@ where
 }
 
 #[allow(deprecated)]
-pub(crate) fn enter_generation_filesystem_namespaces()
--> io::Result<(NamespaceIdentity, NamespaceIdentity)> {
+/// Enters the generation user and mount namespaces before network preparation.
+///
+/// # Errors
+/// Returns an error when namespace creation, ID mapping, or mount isolation fails.
+pub fn enter_generation_filesystem_namespaces() -> io::Result<(NamespaceIdentity, NamespaceIdentity)>
+{
     let uid = getuid().as_raw();
     let gid = getgid().as_raw();
     rustix::thread::unshare(UnshareFlags::NEWUSER)?;

crates/lazaret-runtime-supervisor/tests/network-runtime.rs

@@ -25,7 +25,7 @@ use lazaret_linux::process::{
 };
 use lazaret_runtime_supervisor::network::{
     DnsProbeTarget, NetworkAttestationContext, NetworkProbeRequest, TcpProbeTarget,
-    prepare_network, probe_current_network,
+    enter_generation_filesystem_namespaces, prepare_network, probe_current_network,
 };
 use rustix::io::{FdFlags, fcntl_setfd};
 use rustix::process::Signal;
@@ -156,6 +156,7 @@ fn run_child(arguments: &[OsString]) -> std::io::Result<()> {
     )?;
     let policy_file = File::open(format!("/proc/self/fd/{policy_fd}"))?;
     require_write_sealed(&policy_file)?;
+    enter_generation_filesystem_namespaces()?;
     let runtime = current_process_identity()?;
     let prepared = prepare_network(
         &policy_file,