ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Consume shared sandbox destinations at runtime boundaries

Browse source
This commit is contained in:
ms2k 2026-07-19 05:25:32 +09:00
commit 897578e7cb
2 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

2
crates/lazaret-host-coordinator/src/terminal.rs
View file

@ -25,6 +25,7 @@ use lazaret_linux::process::{
ChildStandardIo, ProcessExit, ProcessOwnershipContext, RetainedProcess, TargetCommand,
child_broker, current_process_identity,
};
use lazaret_sandbox_contract::SANDBOX_INIT_DESTINATION;
use rustix::fs::{OFlags, fcntl_getfl, fcntl_setfl, fstat};
use rustix::pty::{OpenptFlags, grantpt, ioctl_tiocgptpeer, openpt, unlockpt};
use rustix::termios::{Winsize, tcsetwinsize};
@ -42,7 +43,6 @@ const POLL_INTERVAL: Duration = Duration::from_millis(5);
const IDENTITY_DEADLINE: Duration = Duration::from_secs(5);
const SIGNAL_GRACE: Duration = Duration::from_millis(250);
const DRAIN_DEADLINE: Duration = Duration::from_millis(250);
const SANDBOX_INIT_PATH: &str = "/run/lazaret/bin/lazaret-sandbox-init";
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum TerminalRoute {

6
crates/lazaret-host-coordinator/src/terminal/runsc.rs
View file

@ -4,7 +4,7 @@ use super::{
HostCoordinatorTerminalRecorder, IDENTITY_DEADLINE, InodeId, Instant, Mutex, OFlags,
OpenptFlags, OsString, POLL_INTERVAL, PRIVATE_SESSION_EXEC_ROLE, PRIVATE_SESSION_IDENTITY_ROLE,
PersistedHostProcessOwnership, PidfsProcessIdentityV1, ProcessExit, ProcessOwnershipCommitAck,
ProcessOwnershipContext, PtyIdentity, RetainedProcess, SANDBOX_INIT_PATH, SessionId,
ProcessOwnershipContext, PtyIdentity, RetainedProcess, SANDBOX_INIT_DESTINATION, SessionId,
SessionTerminal, SessionTerminalFactory, SessionTerminalFields, SessionTerminalProcess,
SessionTerminalState, StagedProcessOwnership, TargetCommand, TerminalAcquisition,
TerminalError, TerminalResize, Winsize, child_broker, current_process_identity, fcntl_getfl,
@ -57,7 +57,7 @@ impl SessionTerminalFactory for RunscSessionTerminalFactory {
hex_lower(request.session_id.as_bytes())
))
.argument(hex_lower(request.container_id.as_bytes()))
.argument(SANDBOX_INIT_PATH)
.argument(SANDBOX_INIT_DESTINATION)
.argument(PRIVATE_SESSION_EXEC_ROLE)
.argument("--");
for argument in &request.argv {
@ -540,7 +540,7 @@ fn run_guest_identity_query(
target = target
.argument("exec")
.argument(hex_lower(request.container_id.as_bytes()))
.argument(SANDBOX_INIT_PATH)
.argument(SANDBOX_INIT_DESTINATION)
.argument(PRIVATE_SESSION_IDENTITY_ROLE);
for argument in arguments {
target = target.argument(argument.clone());