ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Enforce causal child acquisition boundaries

Browse source
This commit is contained in:
ms2k 2026-07-14 23:50:30 +09:00
commit 6f722ce079
1 changed files with 603 additions and 146 deletions
Download patch file Download diff file Expand all files Collapse all files

28
crates/lazaret-linux/tests/capability-drop-helper.rs
View file

@ -10,7 +10,7 @@ fn main() -> ExitCode {
if std::env::var_os("LAZARET_CAPABILITY_DROP_ISOLATED").is_none() {
let before = lazaret_linux::capability::inspect(CapabilitySet::NET_ADMIN)
.expect("inspect unprivileged capability state");
if lazaret_linux::capability::irreversibly_drop(CapabilitySet::NET_ADMIN).is_ok()
if lazaret_linux::capability::irreversibly_drop(CapabilitySet::NET_ADMIN).is_err()
|| lazaret_linux::capability::inspect(CapabilitySet::NET_ADMIN).ok() != Some(before)
{
return ExitCode::FAILURE;
@ -19,10 +19,30 @@ fn main() -> ExitCode {
.args(["--user", "--map-root-user"])
.arg(std::env::current_exe().expect("test executable path"))
.env("LAZARET_CAPABILITY_DROP_ISOLATED", "1")
.status()
.output()
{
Ok(status) if status.success() => ExitCode::SUCCESS,
Ok(_) | Err(_) => ExitCode::FAILURE,
Ok(output) if output.status.success() => ExitCode::SUCCESS,
Ok(output)
if String::from_utf8_lossy(&output.stderr).contains("Operation not permitted") =>
{
eprintln!("SKIP isolated capability-positive branch: user namespaces unavailable");
ExitCode::SUCCESS
}
Ok(output) => {
eprintln!(
"isolated capability-positive branch failed: {}",
String::from_utf8_lossy(&output.stderr)
);
ExitCode::FAILURE
}
Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
eprintln!("SKIP isolated capability-positive branch: unshare is unavailable");
ExitCode::SUCCESS
}
Err(error) => {
eprintln!("failed to run isolated capability-positive branch: {error}");
ExitCode::FAILURE
}
};
}