ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Decouple client contracts and close private role registries

Browse source
This commit is contained in:
ms2k 2026-07-19 03:44:30 +09:00
commit 22325aa76a
2 changed files with 1041 additions and 321 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crates/lazaret-state-anchor/src/lib.rs
View file

@ -35,7 +35,7 @@ use rustix::thread::{ThreadNameSpaceType, move_into_thread_name_spaces};
const MOUNT_TIMEOUT: Duration = Duration::from_secs(5);
const MOUNT_POLL_INTERVAL: Duration = Duration::from_millis(2);
const PRIVATE_RECOVERY_ROLE: &str = "--lazaret-private-state-anchor-recovery";
pub const PRIVATE_STATE_ANCHOR_RECOVERY_ROLE: &str = "--lazaret-private-state-anchor-recovery";
static TEMPORARY_SEQUENCE: AtomicU64 = AtomicU64::new(0);
pub const PROTECTED_RUNTIME_FILES: [&str; 3] = ["resolv.conf", "hosts", "hostname"];
const RESET_QUARANTINE: &str = "reset-quarantine";

4
crates/lazaret-state-anchor/src/lib/mount.rs
View file

@ -189,7 +189,7 @@ pub fn recover_private_state_anchor_mount(
)?;
let authority = holder.identity().authority();
let target = TargetCommand::new("/proc/self/exe")
.argument(PRIVATE_RECOVERY_ROLE)
.argument(PRIVATE_STATE_ANCHOR_RECOVERY_ROLE)
.argument(authority.pidfs_st_dev.get().to_string())
.argument(authority.pidfs_st_ino.get().to_string())
.argument(user_namespace.device.get().to_string())
@ -214,7 +214,7 @@ pub fn recover_private_state_anchor_mount(
pub fn dispatch_private_state_anchor_recovery(arguments: &[OsString]) -> Option<io::Result<()>> {
if arguments
.first()
.is_none_or(|arg| arg != PRIVATE_RECOVERY_ROLE)
.is_none_or(|arg| arg != PRIVATE_STATE_ANCHOR_RECOVERY_ROLE)
{
return None;
}