ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Own the patched runsc artifact and bind recovery identity

Browse source
This commit is contained in:
ms2k 2026-07-26 18:01:03 +09:00
commit 2c420012bd
1 changed files with 1967 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

12
crates/lazaret-runtime-supervisor/src/supervision.rs
View file

@ -4,7 +4,7 @@ use std::io::{self, Read};
use std::os::fd::{AsFd, AsRawFd, OwnedFd};
use std::os::unix::ffi::{OsStrExt, OsStringExt};
use std::os::unix::fs::FileExt;
use std::path::PathBuf;
use std::path::{Component, Path, PathBuf};
use std::time::{Duration, Instant};
use lazaret_core::codec::{decode, encode};
@ -419,7 +419,7 @@ impl RuntimeSupervisorLaunch {
command: &RunscCommand,
) -> io::Result<Self> {
if ownership.slot != HostProcessOwnershipSlot::SandboxRuntimeSupervisor
|| command.program() != OsStr::new("runsc")
|| !is_absolute_normalized(command.program())
|| !command
.arguments()
.iter()
@ -558,6 +558,14 @@ impl RuntimeSupervisorLaunch {
}
}
fn is_absolute_normalized(value: &OsStr) -> bool {
let path = Path::new(value);
path.is_absolute()
&& path
.components()
.all(|component| matches!(component, Component::RootDir | Component::Normal(_)))
}
/// Runs the Runtime Supervisor's private early role before ordinary binary dispatch.
///
/// # Errors