ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Enforce exact recovery ownership before cold start

Browse source
This commit is contained in:
ms2k 2026-07-17 06:48:49 +09:00
commit 2bc5982a62
2 changed files with 1076 additions and 238 deletions
Download patch file Download diff file Expand all files Collapse all files

79
crates/lazaret-host-coordinator/tests/recovery-process.rs
View file

@ -1,14 +1,22 @@
use std::fs::{self, File};
use std::io;
use std::os::fd::OwnedFd;
use std::os::unix::fs::PermissionsExt;
use std::process::ExitCode;
use lazaret_core::identity::{
ConfigurationFingerprint, CoordinatorId, DomainId, GenerationId, NetworkSidecarId, SandboxId,
BootId, BundleDigest, ConfigurationFingerprint, ContainerId, CoordinatorId, DomainId,
GenerationId, HostPath, HostPidLocator, MountId, MountIdentity, NetworkSidecarId,
PidfsDeviceId, PidfsInodeId, PidfsProcessAuthorityV1, PidfsProcessIdentityV1,
ProcessStartTimeTicks, SandboxId,
};
use lazaret_core::records::{
DurableDecision, Generation, Participant, ParticipantOwnership, ParticipantRole,
ParticipantState, PersistedHostProcessOwnership, StateAnchorOwnership,
ParticipantState, PersistedHostProcessOwnership, SandboxOwnership, StateAnchorOwnership,
};
use lazaret_host_coordinator::recovery::{
delete_runsc_container, prove_runtime_owners_absent, runtime_recovery_ownership,
};
use lazaret_host_coordinator::recovery::{prove_runtime_owners_absent, runtime_recovery_ownership};
use lazaret_linux::process::{TargetCommand, child_broker, dispatch_private_process_role};
use rustix::process::Signal;
@ -31,19 +39,61 @@ fn exit(result: io::Result<()>) -> ExitCode {
}
fn run() -> io::Result<()> {
verify_exact_runsc_delete()?;
verify_exact_action(None)?;
verify_exact_action(Some(Signal::STOP))
}
fn verify_exact_runsc_delete() -> io::Result<()> {
let tree = tempfile::tempdir()?;
let root_path = tree.path().join("runsc");
fs::create_dir(&root_path)?;
fs::create_dir(root_path.join("container"))?;
let program = tree.path().join("runsc-fixture");
fs::write(
&program,
b"#!/bin/sh\nroot=${1#-root=}\n[ \"$2\" = delete ] && [ \"$3\" = --force ] && rmdir \"$root/$4\"\n",
)?;
fs::set_permissions(&program, fs::Permissions::from_mode(0o700))?;
let root: OwnedFd = File::open(&root_path)?.into();
delete_runsc_container(&root, "container", program.as_os_str()).map_err(io::Error::other)?;
if root_path.join("container").exists() {
return Err(io::Error::other("exact runsc container remained"));
}
Ok(())
}
fn verify_exact_action(signal: Option<Signal>) -> io::Result<()> {
let captured =
let state =
child_broker().run_transient_captured(&TargetCommand::new("/bin/sleep").argument("60"))?;
if let Some(signal) = signal {
captured.process().send_signal(signal)?;
state.process().send_signal(signal)?;
}
let process = captured.into_process();
let state = state.into_process();
let supervisor = child_broker()
.run_transient_captured(&TargetCommand::new("/bin/sleep").argument("60"))?
.into_process();
let generation = generation();
let participants = [
Participant::snapshot(
generation.generation_id,
ParticipantRole::Sandbox,
ParticipantState::Intent,
Some(ParticipantOwnership::Sandbox(SandboxOwnership {
container_id: Some(ContainerId::new([6; 32])),
runtime_root: Some(HostPath::new(b"/runtime/runsc".to_vec())),
runtime_root_identity: Some(MountIdentity {
mount_id: MountId::new(7),
device: lazaret_core::identity::DeviceId::new(8),
inode: lazaret_core::identity::InodeId::new(9),
}),
bundle_digest: Some(BundleDigest::new([10; 32])),
host_coordinator: PersistedHostProcessOwnership::committed(absent_process()),
runtime_supervisor: PersistedHostProcessOwnership::staged(supervisor.identity()),
attached_runsc: PersistedHostProcessOwnership::unassigned(),
})),
)
.map_err(|_| io::Error::other("Sandbox participant is invalid"))?,
Participant::bare_intent(generation.generation_id, ParticipantRole::PreparedLower),
Participant::snapshot(
generation.generation_id,
@ -54,7 +104,7 @@ fn verify_exact_action(signal: Option<Signal>) -> io::Result<()> {
upper_path: None,
work_path: None,
merged_path: None,
daemon: PersistedHostProcessOwnership::staged(process.identity()),
daemon: PersistedHostProcessOwnership::staged(state.identity()),
user_namespace: None,
mount_namespace: None,
mount: None,
@ -65,7 +115,20 @@ fn verify_exact_action(signal: Option<Signal>) -> io::Result<()> {
let ownership =
runtime_recovery_ownership(&participants, &generation).map_err(io::Error::other)?;
prove_runtime_owners_absent(&ownership)?;
child_broker().reap(process)
child_broker().reap(state)?;
child_broker().reap(supervisor)
}
fn absent_process() -> PidfsProcessIdentityV1 {
PidfsProcessIdentityV1::new(
PidfsProcessAuthorityV1 {
boot_id: BootId::new([0xff; 16]),
pidfs_st_dev: PidfsDeviceId::new(1),
pidfs_st_ino: PidfsInodeId::new(2),
},
HostPidLocator::new(1),
ProcessStartTimeTicks::new(3),
)
}
fn generation() -> Generation {

4
crates/lazaret-host-coordinator/tests/runtime-composition.rs
View file

@ -33,7 +33,7 @@ use lazaret_host_coordinator::terminal::{
NoActivePrompt, RunscSessionTerminalFactory, SessionTerminalEngine, TerminalAcquisition,
TerminalRoute,
};
use lazaret_linux::filesystem::try_exclusive_flock;
use lazaret_linux::filesystem::{current_mount_identity, try_exclusive_flock};
use lazaret_linux::platform::{PlatformObservation, check_platform};
use lazaret_linux::process::{
ProcessOwnershipContext, RetainedProcess, TargetCommand, child_broker, current_process_identity,
@ -1023,6 +1023,7 @@ impl Fixture {
GenerationId::new(7),
container_id,
&runtime_domain.join("runsc"),
current_mount_identity(&runtime_domain.join("runsc"))?,
BundleDigest::new([7; 32]),
current_process_identity()?,
)
@ -1306,6 +1307,7 @@ fn network_store(
GenerationId::new(7),
container_id,
&runtime_domain.join("runsc"),
current_mount_identity(&runtime_domain.join("runsc"))?,
BundleDigest::new([17; 32]),
current_process_identity()?,
)