ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Confine package ownership changes to private mounts

Browse source
This commit is contained in:
ms2k 2026-07-27 03:31:58 +09:00
commit 8334fd379f
1 changed files with 402 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

34
crates/lazaret-runtime-supervisor/tests/sandbox_builder.rs
View file

@ -303,14 +303,42 @@ fn deterministic_snapshot_has_only_private_namespaces_and_fixed_runtime_shape()
assert_eq!(
specification["process"]["capabilities"],
serde_json::json!({
"bounding": ["CAP_SETGID", "CAP_SETUID"],
"effective": ["CAP_SETGID", "CAP_SETUID"],
"bounding": ["CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_SETGID", "CAP_SETUID"],
"effective": ["CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_SETGID", "CAP_SETUID"],
"inheritable": [],
"permitted": ["CAP_SETGID", "CAP_SETUID"],
"permitted": ["CAP_CHOWN", "CAP_DAC_OVERRIDE", "CAP_FOWNER", "CAP_SETGID", "CAP_SETUID"],
"ambient": []
})
);
let annotations = specification["annotations"].as_object().unwrap();
assert_eq!(
serde_json::from_str::<Vec<String>>(
annotations["dev.lazaret.runsc.owner-change-mounts"]
.as_str()
.unwrap()
)
.unwrap(),
["/", "/root", "/usr", "/var", "/etc", "/opt"]
);
let owner_change_mounts = BTreeSet::from(["/", "/root", "/usr", "/var", "/etc", "/opt"]);
for (index, mount) in specification["mounts"]
.as_array()
.unwrap()
.iter()
.enumerate()
{
let destination = mount["destination"].as_str().unwrap();
if mount["type"] != "bind" || owner_change_mounts.contains(destination) {
continue;
}
let prefix = format!("dev.gvisor.spec.mount.lazaret{index}.");
assert_eq!(annotations[&format!("{prefix}source")], mount["source"]);
assert_eq!(annotations[&format!("{prefix}type")], "bind");
assert_eq!(annotations[&format!("{prefix}share")], "shared");
assert_eq!(annotations[&format!("{prefix}directfs")], "off");
}
let namespaces = specification["linux"]["namespaces"].as_array().unwrap();
assert_eq!(
namespaces