Restore persistent system path composition

crates/lazaret-core/tests/configuration.rs

@@ -75,6 +75,15 @@ fn request(
     tree: &TestTree,
     config: PathBuf,
     environment: BTreeMap<String, std::ffi::OsString>,
+) -> ConfigurationLoadRequest {
+    request_with_layout(tree, config, environment, layout())
+}
+
+fn request_with_layout(
+    tree: &TestTree,
+    config: PathBuf,
+    environment: BTreeMap<String, std::ffi::OsString>,
+    sandbox_layout: SandboxLayoutV1,
 ) -> ConfigurationLoadRequest {
     let workspace = tree.path().join("workspace");
     let runtime = tree.path().join("runtime");
@@ -89,7 +98,7 @@ fn request(
         xdg_data_home: None,
         xdg_runtime_dir: runtime,
         environment,
-        sandbox_layout: layout(),
+        sandbox_layout,
     }
 }
 
@@ -196,6 +205,64 @@ fn sandbox_layout_is_closed_normalized_and_requires_workspace() {
                 .is_err()
         );
     }
+    assert!(
+        SandboxLayoutV1::from_destination_policy(["/workspace".into()], ["/workspace".into()])
+            .is_err()
+    );
+}
+
+#[test]
+fn persistent_parents_allow_only_classified_transient_children() {
+    let layout = SandboxLayoutV1::from_destination_policy(
+        [
+            "/workspace".into(),
+            "/run/lazaret".into(),
+            "/proc".into(),
+            "/sys".into(),
+            "/dev".into(),
+        ],
+        [
+            "/etc/resolv.conf".into(),
+            "/etc/hosts".into(),
+            "/etc/hostname".into(),
+        ],
+    )
+    .unwrap();
+    let tree = TestTree::new();
+    let body = valid_configuration(&tree).replace(
+        "persistent_dirs = [\"/root\"]",
+        "persistent_dirs = [\"/root\", \"/usr\", \"/var\", \"/etc\", \"/opt\"]",
+    );
+    let config = write_configuration(&tree, &body);
+    let environment = BTreeMap::from([("HOST_TOKEN".into(), "value".into())]);
+    let resolved =
+        load_trusted_configuration(request_with_layout(&tree, config, environment, layout))
+            .unwrap();
+    assert_eq!(
+        resolved.fingerprint_record().persistent_dirs,
+        ["/root", "/usr", "/var", "/etc", "/opt"]
+    );
+
+    for persistent in ["/run", "/run/lazaret/state", "/etc/hosts"] {
+        let case = TestTree::new();
+        let body = valid_configuration(&case).replace(
+            "persistent_dirs = [\"/root\"]",
+            &format!("persistent_dirs = [\"{persistent}\"]"),
+        );
+        let config = write_configuration(&case, &body);
+        let environment = BTreeMap::from([("HOST_TOKEN".into(), "value".into())]);
+        let layout = SandboxLayoutV1::from_destination_policy(
+            ["/workspace".into(), "/run/lazaret".into()],
+            ["/etc/hosts".into()],
+        )
+        .unwrap();
+        assert_eq!(
+            load_trusted_configuration(request_with_layout(&case, config, environment, layout,))
+                .unwrap_err()
+                .kind(),
+            ConfigurationErrorKind::PathConflict
+        );
+    }
 }
 
 #[test]