ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Close hostile recovery and concurrency gaps

Browse source
This commit is contained in:
ms2k 2026-07-18 05:47:15 +09:00
commit 3f9b1b3543
1 changed files with 306 additions and 113 deletions
Download patch file Download diff file Expand all files Collapse all files

30
tools/lazaret_verify.py
View file

@ -14,6 +14,9 @@ import tempfile
import tomllib
ROOT = Path(__file__).resolve().parent.parent
MATERIALIZED_FUSER_MANIFEST = (
ROOT / ".lazaret/vendor/fuser-0.17.0/Cargo.toml"
).resolve()
MODEL_CONFIGURATIONS = (
(ROOT / "docs/protocol/Lazaret.tla", ROOT / "docs/protocol/Lazaret.cfg"),
(ROOT / "docs/protocol/PreparedLower.tla", ROOT / "docs/protocol/PreparedLower.cfg"),
@ -227,6 +230,16 @@ FORBIDDEN_PROCESS_SYSCALLS = tuple(
r"^rt_sigaction\(SIGCHLD,",
)
)
PROCESS_TRACE_EXIT_CODES = {
"lazaret": 2,
"lazaret-escalation-client": 2,
"lazaret-git-sentry": 1,
"lazaret-host-coordinator": 0,
"lazaret-ignored-workspace": 1,
"lazaret-launch-wrapper": 0,
"lazaret-runtime-supervisor": 0,
"lazaret-workspace-benchmark": 1,
}
LINT_BYPASS = re.compile(
r"#\s*!?\s*\[[^]]*(?:allow|expect)\s*\([^]]*"
r"(?:warnings|clippy\s*::\s*(?:all|style|restriction)|disallowed_methods|disallowed_types)"
@ -397,7 +410,8 @@ def audit_dependencies(metadata: dict) -> None:
if package["id"] not in workspace_members:
source = package.get("source") or ""
require(
source.startswith("registry+https://github.com/rust-lang/crates.io-index"),
source.startswith("registry+https://github.com/rust-lang/crates.io-index")
or is_materialized_fuser(package),
f"unapproved dependency source: {package['name']}",
)
license_expression = package.get("license") or ""
@ -429,6 +443,14 @@ def audit_dependencies(metadata: dict) -> None:
print("PASS dependency source, wildcard, and license audit")
def is_materialized_fuser(package: dict) -> bool:
return (
package.get("name") == "fuser"
and package.get("version") == "0.17.0"
and Path(package.get("manifest_path", "")).resolve() == MATERIALIZED_FUSER_MANIFEST
)
def license_permitted(expression: str, allowed: set[str]) -> bool:
expression = re.sub(r"\s+WITH\s+[A-Za-z0-9.-]+", "", expression)
expression = re.sub(r"\s*/\s*", " OR ", expression)
@ -573,7 +595,11 @@ def audit_process_syscalls(metadata: dict) -> None:
def validate_trace_exit(binary: str, returncode: int) -> None:
require(returncode == 0, f"{binary}: exercised path exited {returncode}")
expected = PROCESS_TRACE_EXIT_CODES.get(binary)
require(
returncode == expected,
f"{binary}: exercised path exited {returncode}, expected {expected}",
)
def refresh_advisories() -> None: