ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Confine package ownership changes to private mounts

Browse source
This commit is contained in:
ms2k 2026-07-27 03:31:58 +09:00
commit 8334fd379f
1 changed files with 402 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

20
crates/lazaret-state-anchor/tests/state-anchor-lifecycle.rs
View file

@ -67,6 +67,7 @@ fn run() -> io::Result<()> {
}
Err(error) => return Err(error),
}
enter_runtime_user_namespace()?;
let tree = TestTree::new().map_err(|error| io::Error::other(format!("test tree: {error}")))?;
let configuration = configuration(&tree)
.map_err(|error| io::Error::other(format!("configuration: {error}")))?;
@ -251,6 +252,25 @@ fn run() -> io::Result<()> {
Ok(())
}
#[allow(deprecated)]
fn enter_runtime_user_namespace() -> io::Result<()> {
let uid = rustix::process::getuid().as_raw();
let gid = rustix::process::getgid().as_raw();
rustix::thread::unshare(rustix::thread::UnshareFlags::NEWUSER)
.map_err(|error| io::Error::other(format!("fixture user namespace: {error}")))?;
fs::write("/proc/self/setgroups", "deny")?;
fs::write("/proc/self/uid_map", format!("0 {uid} 1\n"))?;
fs::write("/proc/self/gid_map", format!("0 {gid} 1\n"))?;
rustix::thread::unshare(rustix::thread::UnshareFlags::NEWNS)
.map_err(|error| io::Error::other(format!("fixture mount namespace: {error}")))?;
rustix::mount::mount_change(
"/",
rustix::mount::MountPropagationFlags::PRIVATE | rustix::mount::MountPropagationFlags::REC,
)
.map_err(|error| io::Error::other(format!("fixture private propagation: {error}")))?;
Ok(())
}
#[allow(deprecated)]
fn run_private_recovery_holder(arguments: &[OsString]) -> io::Result<()> {
if arguments.len() != 2 {