ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Consume shared sandbox destinations at runtime boundaries

Browse source
This commit is contained in:
ms2k 2026-07-19 05:25:32 +09:00
commit 897578e7cb
5 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

1
crates/lazaret-escalation-client/Cargo.toml
View file

@ -14,6 +14,7 @@ ed25519-dalek.workspace = true
getrandom.workspace = true
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
lazaret-sandbox-contract = { version = "=0.0.0", path = "../lazaret-sandbox-contract" }
nix.workspace = true
rustix.workspace = true
serde.workspace = true

23
crates/lazaret-escalation-client/src/main.rs
View file

@ -14,6 +14,9 @@ use lazaret_core::records::{
};
use lazaret_escalation_client::{ClientEvent, EscalationClient};
use lazaret_linux::filesystem::RegularFileMailbox;
use lazaret_sandbox_contract::{
CREDENTIALS_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
};
use nix::sys::signal::{SigSet, SigmaskHow, Signal};
use nix::sys::signalfd::{SfdFlags, SignalFd};
@ -248,9 +251,9 @@ fn parse_arguments_with_session(
{
return Err(io::Error::other("LAZARET_SESSION_ID is invalid"));
}
let credentials = PathBuf::from("/run/lazaret/credentials");
inbox.get_or_insert_with(|| PathBuf::from("/run/lazaret/mailbox/requests"));
outbox.get_or_insert_with(|| PathBuf::from("/run/lazaret/mailbox/results"));
let credentials = PathBuf::from(CREDENTIALS_DESTINATION);
inbox.get_or_insert_with(|| PathBuf::from(MAILBOX_REQUESTS_DESTINATION));
outbox.get_or_insert_with(|| PathBuf::from(MAILBOX_RESULTS_DESTINATION));
publication.get_or_insert_with(|| credentials.join("publication.postcard"));
sandbox_credentials.get_or_insert_with(|| credentials.join("sandbox-credentials.postcard"));
registration.get_or_insert_with(|| {
@ -277,6 +280,9 @@ fn parse_arguments_with_session(
#[cfg(test)]
mod tests {
use super::parse_arguments_with_session;
use lazaret_sandbox_contract::{
CREDENTIALS_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
};
use std::ffi::OsString;
fn valid_arguments() -> Vec<OsString> {
@ -344,17 +350,18 @@ mod tests {
parse_arguments_with_session(arguments, Some(OsString::from(&session))).unwrap();
assert_eq!(
parsed.inbox,
std::path::Path::new("/run/lazaret/mailbox/requests")
std::path::Path::new(MAILBOX_REQUESTS_DESTINATION)
);
assert_eq!(
parsed.outbox,
std::path::Path::new("/run/lazaret/mailbox/results")
std::path::Path::new(MAILBOX_RESULTS_DESTINATION)
);
assert_eq!(
parsed.registration,
std::path::Path::new(&format!(
"/run/lazaret/credentials/session-{session}-registration.postcard"
))
std::path::Path::new(
&std::path::Path::new(CREDENTIALS_DESTINATION)
.join(format!("session-{session}-registration.postcard"))
)
);
let arguments = ["--justification", "needed", "--", "/usr/bin/tool"]

1
crates/lazaret-host-coordinator/Cargo.toml
View file

@ -29,6 +29,7 @@ lazaret-ignored-workspace = { version = "=0.0.0", path = "../lazaret-ignored-wor
lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
lazaret-prepared-lower = { version = "=0.0.0", path = "../lazaret-prepared-lower" }
lazaret-runtime-supervisor = { version = "=0.0.0", path = "../lazaret-runtime-supervisor" }
lazaret-sandbox-contract = { version = "=0.0.0", path = "../lazaret-sandbox-contract" }
lazaret-state-anchor = { version = "=0.0.0", path = "../lazaret-state-anchor" }
lazaret-storage-catalog = { version = "=0.0.0", path = "../lazaret-storage-catalog" }
rcgen.workspace = true

2
crates/lazaret-host-coordinator/src/terminal.rs
View file

@ -25,6 +25,7 @@ use lazaret_linux::process::{
ChildStandardIo, ProcessExit, ProcessOwnershipContext, RetainedProcess, TargetCommand,
child_broker, current_process_identity,
};
use lazaret_sandbox_contract::SANDBOX_INIT_DESTINATION;
use rustix::fs::{OFlags, fcntl_getfl, fcntl_setfl, fstat};
use rustix::pty::{OpenptFlags, grantpt, ioctl_tiocgptpeer, openpt, unlockpt};
use rustix::termios::{Winsize, tcsetwinsize};
@ -42,7 +43,6 @@ const POLL_INTERVAL: Duration = Duration::from_millis(5);
const IDENTITY_DEADLINE: Duration = Duration::from_secs(5);
const SIGNAL_GRACE: Duration = Duration::from_millis(250);
const DRAIN_DEADLINE: Duration = Duration::from_millis(250);
const SANDBOX_INIT_PATH: &str = "/run/lazaret/bin/lazaret-sandbox-init";
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum TerminalRoute {

6
crates/lazaret-host-coordinator/src/terminal/runsc.rs
View file

@ -4,7 +4,7 @@ use super::{
HostCoordinatorTerminalRecorder, IDENTITY_DEADLINE, InodeId, Instant, Mutex, OFlags,
OpenptFlags, OsString, POLL_INTERVAL, PRIVATE_SESSION_EXEC_ROLE, PRIVATE_SESSION_IDENTITY_ROLE,
PersistedHostProcessOwnership, PidfsProcessIdentityV1, ProcessExit, ProcessOwnershipCommitAck,
ProcessOwnershipContext, PtyIdentity, RetainedProcess, SANDBOX_INIT_PATH, SessionId,
ProcessOwnershipContext, PtyIdentity, RetainedProcess, SANDBOX_INIT_DESTINATION, SessionId,
SessionTerminal, SessionTerminalFactory, SessionTerminalFields, SessionTerminalProcess,
SessionTerminalState, StagedProcessOwnership, TargetCommand, TerminalAcquisition,
TerminalError, TerminalResize, Winsize, child_broker, current_process_identity, fcntl_getfl,
@ -57,7 +57,7 @@ impl SessionTerminalFactory for RunscSessionTerminalFactory {
hex_lower(request.session_id.as_bytes())
))
.argument(hex_lower(request.container_id.as_bytes()))
.argument(SANDBOX_INIT_PATH)
.argument(SANDBOX_INIT_DESTINATION)
.argument(PRIVATE_SESSION_EXEC_ROLE)
.argument("--");
for argument in &request.argv {
@ -540,7 +540,7 @@ fn run_guest_identity_query(
target = target
.argument("exec")
.argument(hex_lower(request.container_id.as_bytes()))
.argument(SANDBOX_INIT_PATH)
.argument(SANDBOX_INIT_DESTINATION)
.argument(PRIVATE_SESSION_IDENTITY_ROLE);
for argument in arguments {
target = target.argument(argument.clone());