ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Consume shared sandbox destinations at runtime boundaries

Browse source
This commit is contained in:
ms2k 2026-07-19 05:25:32 +09:00
commit 897578e7cb
2 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

1
crates/lazaret-escalation-client/Cargo.toml
View file

@ -14,6 +14,7 @@ ed25519-dalek.workspace = true
getrandom.workspace = true
lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
lazaret-sandbox-contract = { version = "=0.0.0", path = "../lazaret-sandbox-contract" }
nix.workspace = true
rustix.workspace = true
serde.workspace = true

23
crates/lazaret-escalation-client/src/main.rs
View file

@ -14,6 +14,9 @@ use lazaret_core::records::{
};
use lazaret_escalation_client::{ClientEvent, EscalationClient};
use lazaret_linux::filesystem::RegularFileMailbox;
use lazaret_sandbox_contract::{
CREDENTIALS_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
};
use nix::sys::signal::{SigSet, SigmaskHow, Signal};
use nix::sys::signalfd::{SfdFlags, SignalFd};
@ -248,9 +251,9 @@ fn parse_arguments_with_session(
{
return Err(io::Error::other("LAZARET_SESSION_ID is invalid"));
}
let credentials = PathBuf::from("/run/lazaret/credentials");
inbox.get_or_insert_with(|| PathBuf::from("/run/lazaret/mailbox/requests"));
outbox.get_or_insert_with(|| PathBuf::from("/run/lazaret/mailbox/results"));
let credentials = PathBuf::from(CREDENTIALS_DESTINATION);
inbox.get_or_insert_with(|| PathBuf::from(MAILBOX_REQUESTS_DESTINATION));
outbox.get_or_insert_with(|| PathBuf::from(MAILBOX_RESULTS_DESTINATION));
publication.get_or_insert_with(|| credentials.join("publication.postcard"));
sandbox_credentials.get_or_insert_with(|| credentials.join("sandbox-credentials.postcard"));
registration.get_or_insert_with(|| {
@ -277,6 +280,9 @@ fn parse_arguments_with_session(
#[cfg(test)]
mod tests {
use super::parse_arguments_with_session;
use lazaret_sandbox_contract::{
CREDENTIALS_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
};
use std::ffi::OsString;
fn valid_arguments() -> Vec<OsString> {
@ -344,17 +350,18 @@ mod tests {
parse_arguments_with_session(arguments, Some(OsString::from(&session))).unwrap();
assert_eq!(
parsed.inbox,
std::path::Path::new("/run/lazaret/mailbox/requests")
std::path::Path::new(MAILBOX_REQUESTS_DESTINATION)
);
assert_eq!(
parsed.outbox,
std::path::Path::new("/run/lazaret/mailbox/results")
std::path::Path::new(MAILBOX_RESULTS_DESTINATION)
);
assert_eq!(
parsed.registration,
std::path::Path::new(&format!(
"/run/lazaret/credentials/session-{session}-registration.postcard"
))
std::path::Path::new(
&std::path::Path::new(CREDENTIALS_DESTINATION)
.join(format!("session-{session}-registration.postcard"))
)
);
let arguments = ["--justification", "needed", "--", "/usr/bin/tool"]