ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace lexical Rust fragments with real modules

Browse source
This commit is contained in:
ms2k 2026-07-19 05:12:57 +09:00
commit 247819250b
3 changed files with 3302 additions and 2671 deletions
Download patch file Download diff file Expand all files Collapse all files

13
crates/lazaret-runtime-supervisor/src/sandbox/mounts.rs
View file

@ -1,4 +1,11 @@
fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
use super::{
CREDENTIALS_DESTINATION, DEV_DESTINATION, ESCALATION_CLIENT_DESTINATION,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, Mount, MountBuilder,
PROC_DESTINATION, Path, PathBuf, SANDBOX_INIT_DESTINATION, SYS_DESTINATION, SandboxBuildError,
oci_error, validate_absolute_normalized,
};
pub(super) fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
[
(
PROC_DESTINATION,
@ -56,7 +63,7 @@ fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
.collect()
}
fn control_mounts(control_sources: &Path) -> Result<Vec<Mount>, SandboxBuildError> {
pub(super) fn control_mounts(control_sources: &Path) -> Result<Vec<Mount>, SandboxBuildError> {
[
("credentials", CREDENTIALS_DESTINATION, true, false),
(
@ -91,7 +98,7 @@ fn control_mounts(control_sources: &Path) -> Result<Vec<Mount>, SandboxBuildErro
.collect()
}
fn bind_mount(
pub(super) fn bind_mount(
source: PathBuf,
destination: PathBuf,
read_only: bool,

51
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -1,12 +1,24 @@
struct RuntimePaths {
container_name: String,
bundle: PathBuf,
runsc_root: PathBuf,
overlay: PathBuf,
control_sources: PathBuf,
use super::{
AtFlags, BTreeMap, Capabilities, ContainerId, DEFAULT_PATH, File, FileIdentity, FileType,
HandoffPathType, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxIdMappingBuilder,
LinuxNamespaceBuilder, LinuxNamespaceType, Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags,
OsString, OwnedFd, Path, PathBuf, ProcessBuilder, Read, ResolveFlags,
ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
SandboxBuildError, SandboxBuildErrorKind, StagedHostTerminal, StatxFlags,
TERMINFO_ROOT_DESTINATION, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
control_mounts, hex_lower, host_path, oci_error, openat2, staging_error, standard_mounts,
statx, validate_absolute_normalized,
};
pub(super) struct RuntimePaths {
pub(super) container_name: String,
pub(super) bundle: PathBuf,
pub(super) runsc_root: PathBuf,
pub(super) overlay: PathBuf,
pub(super) control_sources: PathBuf,
}
fn handoff_runtime_sources(
pub(super) fn handoff_runtime_sources(
paths: &RuntimePaths,
terminal: Option<&StagedHostTerminal>,
specification_json: &[u8],
@ -81,7 +93,7 @@ fn handoff_runtime_sources(
sources
}
fn open_runtime_source(
pub(super) fn open_runtime_source(
runtime_root: &OwnedFd,
relative_path: &Path,
expected_type: HandoffPathType,
@ -122,7 +134,10 @@ fn open_runtime_source(
Ok(descriptor)
}
fn require_exact_bytes(descriptor: OwnedFd, expected: &[u8]) -> Result<(), SandboxBuildError> {
pub(super) fn require_exact_bytes(
descriptor: OwnedFd,
expected: &[u8],
) -> Result<(), SandboxBuildError> {
let limit = u64::try_from(expected.len())
.ok()
.and_then(|length| length.checked_add(1))
@ -146,7 +161,7 @@ fn require_exact_bytes(descriptor: OwnedFd, expected: &[u8]) -> Result<(), Sandb
Ok(())
}
fn descriptor_identity(descriptor: &OwnedFd) -> Result<FileIdentity, SandboxBuildError> {
pub(super) fn descriptor_identity(descriptor: &OwnedFd) -> Result<FileIdentity, SandboxBuildError> {
let stat = rustix::fs::fstat(descriptor).map_err(staging_error)?;
let extended =
statx(descriptor, "", AtFlags::EMPTY_PATH, StatxFlags::MNT_ID).map_err(staging_error)?;
@ -163,7 +178,7 @@ fn descriptor_identity(descriptor: &OwnedFd) -> Result<FileIdentity, SandboxBuil
})
}
fn runtime_paths(
pub(super) fn runtime_paths(
configuration: &ResolvedDomainConfiguration,
container_id: ContainerId,
) -> Result<RuntimePaths, SandboxBuildError> {
@ -178,7 +193,7 @@ fn runtime_paths(
})
}
fn build_mounts(
pub(super) fn build_mounts(
configuration: &ResolvedDomainConfiguration,
terminal: Option<&StagedHostTerminal>,
control_sources: &Path,
@ -232,7 +247,7 @@ fn build_mounts(
Ok(mounts)
}
fn build_linux() -> Result<oci_spec::runtime::Linux, SandboxBuildError> {
pub(super) fn build_linux() -> Result<oci_spec::runtime::Linux, SandboxBuildError> {
let private_namespaces = [
LinuxNamespaceType::Pid,
LinuxNamespaceType::Ipc,
@ -276,7 +291,10 @@ fn build_linux() -> Result<oci_spec::runtime::Linux, SandboxBuildError> {
.map_err(oci_error)
}
fn build_runsc_command(paths: &RuntimePaths, bundle_authorization: [u8; 32]) -> RunscCommand {
pub(super) fn build_runsc_command(
paths: &RuntimePaths,
bundle_authorization: [u8; 32],
) -> RunscCommand {
RunscCommand::new(
"runsc",
[
@ -311,7 +329,7 @@ fn build_runsc_command(paths: &RuntimePaths, bundle_authorization: [u8; 32]) ->
)
}
fn open_absolute_directory(path: &Path) -> Result<OwnedFd, SandboxBuildError> {
pub(super) fn open_absolute_directory(path: &Path) -> Result<OwnedFd, SandboxBuildError> {
validate_absolute_normalized(path)?;
openat2(
rustix::fs::CWD,
@ -328,7 +346,7 @@ fn open_absolute_directory(path: &Path) -> Result<OwnedFd, SandboxBuildError> {
})
}
fn build_process(
pub(super) fn build_process(
configuration: &ResolvedDomainConfiguration,
root_process: RootProcess,
terminal: Option<&StagedHostTerminal>,
@ -385,4 +403,3 @@ fn build_process(
.build()
.map_err(oci_error)
}

45
crates/lazaret-runtime-supervisor/src/sandbox/validation.rs
View file

@ -1,4 +1,12 @@
fn require_network_namespace(expected: NamespaceIdentity) -> Result<(), SandboxBuildError> {
use super::{
AsFd, AtFlags, Component, File, FileType, MAX_TERMINFO_BYTES, Mode, NETWORK_NAMESPACE_PATH,
NamespaceIdentity, OFlags, OsStrExt, OsString, OsStringExt, OwnedFd, Path, PathBuf, Read,
ResolveFlags, SandboxBuildError, SandboxBuildErrorKind, Write, fmt, openat2,
};
pub(super) fn require_network_namespace(
expected: NamespaceIdentity,
) -> Result<(), SandboxBuildError> {
let observed = lazaret_linux::filesystem::namespace_identity(Path::new(NETWORK_NAMESPACE_PATH))
.map_err(|error| {
SandboxBuildError::new(
@ -15,22 +23,22 @@ fn require_network_namespace(expected: NamespaceIdentity) -> Result<(), SandboxB
Ok(())
}
fn changed_configuration_authority(error: impl fmt::Display) -> SandboxBuildError {
pub(super) fn changed_configuration_authority(error: impl fmt::Display) -> SandboxBuildError {
SandboxBuildError::new(SandboxBuildErrorKind::ChangedAuthority, error.to_string())
}
fn changed_authority_at(label: &str, error: impl fmt::Display) -> SandboxBuildError {
pub(super) fn changed_authority_at(label: &str, error: impl fmt::Display) -> SandboxBuildError {
SandboxBuildError::new(
SandboxBuildErrorKind::ChangedAuthority,
format!("{label}: {error}"),
)
}
fn oci_error(error: impl fmt::Display) -> SandboxBuildError {
pub(super) fn oci_error(error: impl fmt::Display) -> SandboxBuildError {
SandboxBuildError::new(SandboxBuildErrorKind::OciSpecification, error.to_string())
}
fn validate_sandbox_executable(program: &str) -> Result<(), SandboxBuildError> {
pub(super) fn validate_sandbox_executable(program: &str) -> Result<(), SandboxBuildError> {
validate_absolute_normalized(Path::new(program)).map_err(|_| {
SandboxBuildError::new(
SandboxBuildErrorKind::InvalidProcess,
@ -39,7 +47,7 @@ fn validate_sandbox_executable(program: &str) -> Result<(), SandboxBuildError> {
})
}
fn validate_terminal_name(term: &str) -> Result<(), SandboxBuildError> {
pub(super) fn validate_terminal_name(term: &str) -> Result<(), SandboxBuildError> {
let valid = !term.is_empty()
&& term.len() <= 64
&& term
@ -55,7 +63,10 @@ fn validate_terminal_name(term: &str) -> Result<(), SandboxBuildError> {
}
}
fn validate_compiled_terminfo(term: &str, bytes: &[u8]) -> Result<(), SandboxBuildError> {
pub(super) fn validate_compiled_terminfo(
term: &str,
bytes: &[u8],
) -> Result<(), SandboxBuildError> {
if bytes.len() < 12 || bytes.len() > MAX_TERMINFO_BYTES {
return Err(invalid_terminfo("compiled entry has an invalid size"));
}
@ -113,7 +124,7 @@ fn invalid_terminfo(detail: &str) -> SandboxBuildError {
SandboxBuildError::new(SandboxBuildErrorKind::InvalidTerminal, detail)
}
fn open_or_create_staging_directory(
pub(super) fn open_or_create_staging_directory(
parent: OwnedFd,
name: &str,
) -> Result<OwnedFd, SandboxBuildError> {
@ -142,7 +153,7 @@ fn open_or_create_staging_directory(
Ok(directory)
}
fn stage_exact_file(
pub(super) fn stage_exact_file(
directory: &OwnedFd,
name: &str,
bytes: &[u8],
@ -197,7 +208,7 @@ fn open_staged_file(directory: &OwnedFd, name: &str) -> rustix::io::Result<Owned
)
}
fn require_staged_file(descriptor: &OwnedFd) -> Result<(), SandboxBuildError> {
pub(super) fn require_staged_file(descriptor: &OwnedFd) -> Result<(), SandboxBuildError> {
let stat = rustix::fs::fstat(descriptor).map_err(staging_error)?;
if !FileType::from_raw_mode(stat.st_mode).is_file()
|| stat.st_uid != rustix::process::getuid().as_raw()
@ -212,7 +223,7 @@ fn require_staged_file(descriptor: &OwnedFd) -> Result<(), SandboxBuildError> {
Ok(())
}
fn read_descriptor(descriptor: OwnedFd) -> Result<Vec<u8>, SandboxBuildError> {
pub(super) fn read_descriptor(descriptor: OwnedFd) -> Result<Vec<u8>, SandboxBuildError> {
let mut bytes = Vec::new();
File::from(descriptor)
.take((MAX_TERMINFO_BYTES + 1) as u64)
@ -224,18 +235,18 @@ fn read_descriptor(descriptor: OwnedFd) -> Result<Vec<u8>, SandboxBuildError> {
Ok(bytes)
}
fn confined_resolve_flags() -> ResolveFlags {
pub(super) fn confined_resolve_flags() -> ResolveFlags {
ResolveFlags::BENEATH
| ResolveFlags::NO_MAGICLINKS
| ResolveFlags::NO_SYMLINKS
| ResolveFlags::NO_XDEV
}
fn staging_error(error: impl fmt::Display) -> SandboxBuildError {
pub(super) fn staging_error(error: impl fmt::Display) -> SandboxBuildError {
SandboxBuildError::new(SandboxBuildErrorKind::ChangedAuthority, error.to_string())
}
fn validate_absolute_normalized(path: &Path) -> Result<(), SandboxBuildError> {
pub(super) fn validate_absolute_normalized(path: &Path) -> Result<(), SandboxBuildError> {
if !path.is_absolute()
|| path.as_os_str().as_bytes().contains(&0)
|| path
@ -260,13 +271,15 @@ fn utf8_path(path: &Path) -> Result<&str, SandboxBuildError> {
})
}
fn host_path(path: &lazaret_core::identity::HostPath) -> Result<PathBuf, SandboxBuildError> {
pub(super) fn host_path(
path: &lazaret_core::identity::HostPath,
) -> Result<PathBuf, SandboxBuildError> {
let path = PathBuf::from(OsString::from_vec(path.as_bytes().to_vec()));
validate_absolute_normalized(&path)?;
Ok(path)
}
fn hex_lower(bytes: &[u8]) -> String {
pub(super) fn hex_lower(bytes: &[u8]) -> String {
let mut output = String::with_capacity(bytes.len() * 2);
for byte in bytes {
use fmt::Write as _;