ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Fix rootless launches with subordinate ID maps

Browse source 
Resolve and verify canonical caller subordinate ranges, launch preparation and runtime workers through mapped causal acquisition, and keep runsc in the existing user namespace. Repair descriptor-relative OCI cleanup and absent-mount recovery so failed launches can progress to the corrected path.
This commit is contained in:
ms2k 2026-07-19 19:51:47 +09:00
commit 73e3e9fdee
1 changed files with 1424 additions and 172 deletions
Download patch file Download diff file Expand all files Collapse all files

42
crates/lazaret-core/src/network.rs
View file

@ -509,31 +509,40 @@ fn validate_reachability(
|| expected_results.permitted_destinations.is_empty()
|| expected_results.dns_queries.is_empty()
{
return reachability_error();
return reachability_error("network probe identity or coverage mismatch");
}
let denied = exact_observations(
&expected_results.denied_destinations,
&probe.denied_destinations,
|item| (item.destination, item.unreachable),
"denied destination observations differ",
)?;
let permitted = exact_observations(
&expected_results.permitted_destinations,
&probe.permitted_destinations,
|item| (item.destination, item.reachable),
"permitted destination observations differ",
)?;
if denied.iter().any(|(_, passed)| !passed)
|| permitted.iter().any(|(_, passed)| !passed)
|| expected_results
.denied_destinations
.iter()
.any(|address| effective_action(policy, *address) != Some(PolicyAction::Deny))
|| expected_results
.permitted_destinations
.iter()
.any(|address| effective_action(policy, *address) != Some(PolicyAction::Allow))
if denied.iter().any(|(_, passed)| !passed) {
return reachability_error("a configured denied destination was reachable");
}
if permitted.iter().any(|(_, passed)| !passed) {
return reachability_error("a configured permitted destination was unreachable");
}
if expected_results
.denied_destinations
.iter()
.any(|address| effective_action(policy, *address) != Some(PolicyAction::Deny))
{
return reachability_error();
return reachability_error("a denied probe destination is not denied by policy");
}
if expected_results
.permitted_destinations
.iter()
.any(|address| effective_action(policy, *address) != Some(PolicyAction::Allow))
{
return reachability_error("a permitted probe destination is not allowed by policy");
}
let expected_dns: BTreeSet<_> = expected_results.dns_queries.iter().cloned().collect();
@ -563,7 +572,7 @@ fn validate_reachability(
.any(|address| address_family(*address) != AddressFamily::Ipv4)
})
{
return reachability_error();
return reachability_error("DNS readiness observations differ or contain no IPv4 answer");
}
Ok(())
}
@ -572,6 +581,7 @@ fn exact_observations<T, F>(
expected: &[IpAddress],
actual: &[T],
project: F,
mismatch: &'static str,
) -> Result<BTreeSet<(IpAddress, bool)>, NetworkValidationError>
where
F: Fn(&T) -> (IpAddress, bool),
@ -585,7 +595,7 @@ where
|| expected_items.len() != actual_addresses.len()
|| actual_addresses != expected_items
{
return reachability_error();
return reachability_error(mismatch);
}
Ok(actual_items)
}
@ -646,9 +656,9 @@ fn domain_digest(schema_id: &str, canonical_bytes: &[u8]) -> [u8; 32] {
hasher.finalize().into()
}
fn reachability_error<T>() -> Result<T, NetworkValidationError> {
fn reachability_error<T>(detail: &'static str) -> Result<T, NetworkValidationError> {
Err(NetworkValidationError::new(
NetworkValidationErrorKind::Reachability,
"network reachability evidence mismatch",
detail,
))
}