ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Replace external reachability with an owned canary

Browse source
This commit is contained in:
ms2k 2026-07-19 22:39:31 +09:00
commit 31e9ab0f2d
1 changed files with 1409 additions and 1972 deletions
Download patch file Download diff file Expand all files Collapse all files

14
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -1,4 +1,3 @@
use std::collections::BTreeMap;
use std::ffi::{OsStr, OsString};
use std::fmt;
use std::fs::File;
@ -14,8 +13,8 @@ pub use lazaret_sandbox_contract::{
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
ESCALATION_CLIENT_DESTINATION, HOSTNAME_DESTINATION, HOSTS_DESTINATION,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, PROC_DESTINATION,
RESOLV_CONF_DESTINATION, RUNTIME_FILE_DESTINATIONS, SANDBOX_INIT_DESTINATION, SYS_DESTINATION,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
READINESS_DESTINATION, RESOLV_CONF_DESTINATION, RUNTIME_FILE_DESTINATIONS,
SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
@ -42,7 +41,6 @@ use validation::{
pub const NETWORK_NAMESPACE_PATH: &str = "/proc/self/ns/net";
const OCI_VERSION: &str = "1.2.1";
const DEFAULT_PATH: &str = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
const MAX_TERMINFO_BYTES: usize = 1_048_576;
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
@ -323,7 +321,6 @@ impl SandboxHandoffAuthority<'_> {
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct HostTerminal {
term: String,
color_term: Option<String>,
compiled_entry: Vec<u8>,
}
@ -334,12 +331,12 @@ impl HostTerminal {
/// Invalid names, colors, terminfo headers, aliases, and oversized entries are refused.
pub fn from_compiled_entry(
term: impl Into<String>,
color_term: Option<String>,
color_term: Option<&str>,
compiled_entry: Vec<u8>,
) -> Result<Self, SandboxBuildError> {
let term = term.into();
validate_terminal_name(&term)?;
if color_term.as_deref().is_some_and(|value| {
if color_term.is_some_and(|value| {
value.is_empty() || value.bytes().any(|byte| byte < 0x20 || byte == 0x7f)
}) {
return Err(SandboxBuildError::new(
@ -350,7 +347,6 @@ impl HostTerminal {
validate_compiled_terminfo(&term, &compiled_entry)?;
Ok(Self {
term,
color_term,
compiled_entry,
})
}
@ -359,7 +355,6 @@ impl HostTerminal {
#[derive(Debug)]
pub struct StagedHostTerminal {
term: String,
color_term: Option<String>,
compiled_entry: Vec<u8>,
relative_source: PathBuf,
identity: FileIdentity,
@ -441,7 +436,6 @@ pub fn stage_host_terminal(
.join(bucket)
.join(&terminal.term),
term: terminal.term,
color_term: terminal.color_term,
compiled_entry: terminal.compiled_entry,
identity,
})