ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
2 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

5
crates/lazaret-runtime-supervisor/src/sandbox/mounts.rs
View file

@ -1,8 +1,8 @@
use super::{
CREDENTIALS_DESTINATION, DEV_DESTINATION, ESCALATION_CLIENT_DESTINATION,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, Mount, MountBuilder,
PROC_DESTINATION, Path, PathBuf, SANDBOX_INIT_DESTINATION, SYS_DESTINATION, SandboxBuildError,
oci_error, validate_absolute_normalized,
PROC_DESTINATION, Path, PathBuf, READINESS_DESTINATION, SANDBOX_INIT_DESTINATION,
SYS_DESTINATION, SandboxBuildError, oci_error, validate_absolute_normalized,
};
pub(super) fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
@ -66,6 +66,7 @@ pub(super) fn standard_mounts() -> Result<Vec<Mount>, SandboxBuildError> {
pub(super) fn control_mounts(control_sources: &Path) -> Result<Vec<Mount>, SandboxBuildError> {
[
("credentials", CREDENTIALS_DESTINATION, true, false),
("readiness", READINESS_DESTINATION, false, true),
(
"mailbox/requests",
MAILBOX_REQUESTS_DESTINATION,

46
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -1,11 +1,10 @@
use super::{
AtFlags, BTreeMap, Capabilities, ContainerId, DEFAULT_PATH, File, FileIdentity, FileType,
HandoffPathType, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
LinuxNamespaceType, Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path,
PathBuf, ProcessBuilder, RUNTIME_FILE_DESTINATIONS, Read, ResolveFlags,
ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
SandboxBuildError, SandboxBuildErrorKind, StagedHostTerminal, StatxFlags,
TERMINFO_ROOT_DESTINATION, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
AtFlags, Capabilities, ContainerId, File, FileIdentity, FileType, HandoffPathType,
LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder, LinuxNamespaceType, Mode, Mount,
NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf, ProcessBuilder,
RUNTIME_FILE_DESTINATIONS, Read, ResolveFlags, ResolvedDomainConfiguration, RootProcess,
RunscCommand, RuntimeHandoffSource, SandboxBuildError, SandboxBuildErrorKind,
StagedHostTerminal, StatxFlags, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
control_mounts, hex_lower, host_path, oci_error, openat2, staging_error, standard_mounts,
statx, validate_absolute_normalized,
};
@ -50,6 +49,7 @@ pub(super) fn handoff_runtime_sources(
container.join("mailbox/results"),
HandoffPathType::Directory,
),
(container.join("readiness"), HandoffPathType::Directory),
(
container.join("bin/lazaret-escalate"),
HandoffPathType::RegularFile,
@ -331,36 +331,10 @@ pub(super) fn open_absolute_directory(path: &Path) -> Result<OwnedFd, SandboxBui
}
pub(super) fn build_process(
configuration: &ResolvedDomainConfiguration,
_configuration: &ResolvedDomainConfiguration,
root_process: RootProcess,
terminal: Option<&StagedHostTerminal>,
_terminal: Option<&StagedHostTerminal>,
) -> Result<oci_spec::runtime::Process, SandboxBuildError> {
let mut environment = BTreeMap::from([("PATH".to_owned(), DEFAULT_PATH.to_owned())]);
for (name, value) in configuration.ephemeral_environment() {
let value = value.expose().to_str().ok_or_else(|| {
SandboxBuildError::new(
SandboxBuildErrorKind::InvalidProcess,
"resolved environment value is not UTF-8",
)
})?;
environment.insert(name.clone(), value.to_owned());
}
if let Some(terminal) = terminal {
environment.insert("TERM".to_owned(), terminal.term.clone());
if let Some(color_term) = &terminal.color_term {
environment.insert("COLORTERM".to_owned(), color_term.clone());
} else {
environment.remove("COLORTERM");
}
environment.insert(
"TERMINFO_DIRS".to_owned(),
format!("{TERMINFO_ROOT_DESTINATION}:"),
);
}
let environment = environment
.into_iter()
.map(|(name, value)| format!("{name}={value}"))
.collect::<Vec<_>>();
let empty = Capabilities::new();
let capabilities = LinuxCapabilitiesBuilder::default()
.bounding(empty.clone())
@ -380,7 +354,7 @@ pub(super) fn build_process(
.terminal(false)
.user(user)
.args(root_process.arguments)
.env(environment)
.env(Vec::<String>::new())
.cwd(PathBuf::from(WORKSPACE_DESTINATION))
.capabilities(capabilities)
.no_new_privileges(true)