ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Require fresh State Anchor absence before lease release

Browse source
This commit is contained in:
ms2k 2026-07-17 04:40:02 +09:00
commit 3b76b59bdf
1 changed files with 543 additions and 194 deletions
Download patch file Download diff file Expand all files Collapse all files

31
crates/lazaret-state-anchor/tests/state-anchor-lifecycle.rs
View file

@ -19,9 +19,9 @@ use lazaret_linux::process::{
ProcessOwnershipContext, current_process_identity, dispatch_private_process_role,
};
use lazaret_state_anchor::{
FuseOverlayfsMount, ProtectedRuntimeFiles, RuntimeStateAnchorAuthority, StateAnchorAcquisition,
StateAnchorLaunchAuthority, StateAnchorLayout, StateAnchorSandboxView,
unmount_after_coordinator_loss,
FuseOverlayfsMount, ProtectedRuntimeFiles, RuntimeStateAnchorAuthority,
RuntimeStateAnchorInherited, StateAnchorAcquisition, StateAnchorLaunchAuthority,
StateAnchorLayout, StateAnchorSandboxView, unmount_after_coordinator_loss,
};
use rustix::process::Signal;
@ -80,18 +80,19 @@ fn run() -> io::Result<()> {
let launch =
StateAnchorLaunchAuthority::capture(&layout, &artifact).map_err(io::Error::other)?;
let runtime_authority = RuntimeStateAnchorAuthority::from_inherited(
launch.lower_fd(),
launch.lower_label(),
launch.persistent_root_fd(),
launch.persistent_anchor_fd(),
launch.persistent_anchor_label(),
launch.runtime_root_fd(),
launch.runtime_anchor_fd(),
launch.runtime_anchor_label(),
launch.expected_lower(),
)
.map_err(io::Error::other)?;
let runtime_authority =
RuntimeStateAnchorAuthority::from_inherited(RuntimeStateAnchorInherited {
lower_fd: launch.lower_fd(),
lower_label: launch.lower_label(),
persistent_root_fd: launch.persistent_root_fd(),
persistent_anchor_fd: launch.persistent_anchor_fd(),
persistent_anchor_label: launch.persistent_anchor_label(),
runtime_root_fd: launch.runtime_root_fd(),
runtime_anchor_fd: launch.runtime_anchor_fd(),
runtime_anchor_label: launch.runtime_anchor_label(),
expected_lower: launch.expected_lower(),
})
.map_err(io::Error::other)?;
let expected = std::cell::Cell::new(None);
let runtime_mount = runtime_authority
.acquire(