ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Establish bounded descriptor budgets for sandbox domains

Browse source
This commit is contained in:
ms2k 2026-07-24 02:18:30 +09:00
commit 503f090121
3 changed files with 191 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

5
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -19,8 +19,8 @@ pub use lazaret_sandbox_contract::{
};
use oci_spec::runtime::{
Capabilities, Capability, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder,
LinuxNamespaceType, Mount, MountBuilder, ProcessBuilder, RootBuilder, Spec, SpecBuilder,
UserBuilder,
LinuxNamespaceType, Mount, MountBuilder, PosixRlimitBuilder, PosixRlimitType, ProcessBuilder,
RootBuilder, Spec, SpecBuilder, UserBuilder,
};
use rustix::fs::{AtFlags, FileType, Mode, OFlags, ResolveFlags, StatxFlags, openat2, statx};
use sha2::{Digest, Sha256};
@ -40,6 +40,7 @@ use validation::{
};
pub const NETWORK_NAMESPACE_PATH: &str = "/proc/self/ns/net";
pub const DOMAIN_OPEN_FILE_LIMIT: u64 = 524_288;
const OCI_VERSION: &str = "1.2.1";
const MAX_TERMINFO_BYTES: usize = 1_048_576;

19
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -1,12 +1,12 @@
use super::{
AtFlags, Capabilities, Capability, ContainerId, File, FileIdentity, FileType, HandoffPathType,
LazyLock, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxNamespaceBuilder, LinuxNamespaceType,
Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf, ProcessBuilder,
RUNTIME_FILE_DESTINATIONS, Read, ResolveFlags, ResolvedDomainConfiguration, RootProcess,
RunscCommand, RuntimeHandoffSource, SandboxBuildError, SandboxBuildErrorKind,
StagedHostTerminal, StatxFlags, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
control_mounts, hex_lower, host_path, oci_error, openat2, staging_error, standard_mounts,
statx, validate_absolute_normalized,
Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags, OsString, OwnedFd, Path, PathBuf,
PosixRlimitBuilder, PosixRlimitType, ProcessBuilder, RUNTIME_FILE_DESTINATIONS, Read,
ResolveFlags, ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
SandboxBuildError, SandboxBuildErrorKind, StagedHostTerminal, StatxFlags, UserBuilder,
VolumeAccess, WORKSPACE_DESTINATION, bind_mount, control_mounts, hex_lower, host_path,
oci_error, openat2, staging_error, standard_mounts, statx, validate_absolute_normalized,
};
pub(super) struct RuntimePaths {
@ -353,6 +353,12 @@ pub(super) fn build_process(
.umask(0o022_u32)
.build()
.map_err(oci_error)?;
let nofile = PosixRlimitBuilder::default()
.typ(PosixRlimitType::RlimitNofile)
.soft(super::DOMAIN_OPEN_FILE_LIMIT)
.hard(super::DOMAIN_OPEN_FILE_LIMIT)
.build()
.map_err(oci_error)?;
ProcessBuilder::default()
.terminal(false)
.user(user)
@ -360,6 +366,7 @@ pub(super) fn build_process(
.env(Vec::<String>::new())
.cwd(PathBuf::from(WORKSPACE_DESTINATION))
.capabilities(capabilities)
.rlimits(vec![nofile])
.no_new_privileges(true)
.build()
.map_err(oci_error)

10
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -9,7 +9,7 @@ use lazaret_core::configuration::{
};
use lazaret_core::identity::{ContainerId, DeviceId, InodeId, NamespaceIdentity};
use lazaret_runtime_supervisor::sandbox::{
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION, DOMAIN_OPEN_FILE_LIMIT,
ESCALATION_CLIENT_DESTINATION, HOSTNAME_DESTINATION, HOSTS_DESTINATION, HostTerminal,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, NETWORK_NAMESPACE_PATH,
PROC_DESTINATION, RESOLV_CONF_DESTINATION, RootProcess, SANDBOX_INIT_DESTINATION,
@ -283,6 +283,14 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
assert_eq!(specification["process"]["terminal"], false);
assert_eq!(specification["process"]["noNewPrivileges"], true);
assert_eq!(specification["process"]["cwd"], WORKSPACE_DESTINATION);
assert_eq!(
specification["process"]["rlimits"],
serde_json::json!([{
"type": "RLIMIT_NOFILE",
"hard": DOMAIN_OPEN_FILE_LIMIT,
"soft": DOMAIN_OPEN_FILE_LIMIT
}])
);
assert_eq!(
specification["process"]["args"],
serde_json::json!([