Consume shared sandbox destinations at runtime boundaries

Cargo.lock

@@ -1702,6 +1702,7 @@ dependencies = [
  "getrandom 0.4.3",
  "lazaret-core",
  "lazaret-linux",
+ "lazaret-sandbox-contract",
  "nix 0.31.3",
  "rustix",
  "serde",
@@ -1722,6 +1723,7 @@ dependencies = [
  "lazaret-linux",
  "lazaret-prepared-lower",
  "lazaret-runtime-supervisor",
+ "lazaret-sandbox-contract",
  "lazaret-state-anchor",
  "lazaret-storage-catalog",
  "rcgen",

crates/lazaret-escalation-client/Cargo.toml

@@ -14,6 +14,7 @@ ed25519-dalek.workspace = true
 getrandom.workspace = true
 lazaret-core = { version = "=0.0.0", path = "../lazaret-core" }
 lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
+lazaret-sandbox-contract = { version = "=0.0.0", path = "../lazaret-sandbox-contract" }
 nix.workspace = true
 rustix.workspace = true
 serde.workspace = true

crates/lazaret-escalation-client/src/main.rs

@@ -14,6 +14,9 @@ use lazaret_core::records::{
 };
 use lazaret_escalation_client::{ClientEvent, EscalationClient};
 use lazaret_linux::filesystem::RegularFileMailbox;
+use lazaret_sandbox_contract::{
+    CREDENTIALS_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
+};
 use nix::sys::signal::{SigSet, SigmaskHow, Signal};
 use nix::sys::signalfd::{SfdFlags, SignalFd};
 
@@ -248,9 +251,9 @@ fn parse_arguments_with_session(
         {
             return Err(io::Error::other("LAZARET_SESSION_ID is invalid"));
         }
-        let credentials = PathBuf::from("/run/lazaret/credentials");
+        let credentials = PathBuf::from(CREDENTIALS_DESTINATION);
-        inbox.get_or_insert_with(|| PathBuf::from("/run/lazaret/mailbox/requests"));
+        inbox.get_or_insert_with(|| PathBuf::from(MAILBOX_REQUESTS_DESTINATION));
-        outbox.get_or_insert_with(|| PathBuf::from("/run/lazaret/mailbox/results"));
+        outbox.get_or_insert_with(|| PathBuf::from(MAILBOX_RESULTS_DESTINATION));
         publication.get_or_insert_with(|| credentials.join("publication.postcard"));
         sandbox_credentials.get_or_insert_with(|| credentials.join("sandbox-credentials.postcard"));
         registration.get_or_insert_with(|| {
@@ -277,6 +280,9 @@ fn parse_arguments_with_session(
 #[cfg(test)]
 mod tests {
     use super::parse_arguments_with_session;
+    use lazaret_sandbox_contract::{
+        CREDENTIALS_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
+    };
     use std::ffi::OsString;
 
     fn valid_arguments() -> Vec<OsString> {
@@ -344,17 +350,18 @@ mod tests {
             parse_arguments_with_session(arguments, Some(OsString::from(&session))).unwrap();
         assert_eq!(
             parsed.inbox,
-            std::path::Path::new("/run/lazaret/mailbox/requests")
+            std::path::Path::new(MAILBOX_REQUESTS_DESTINATION)
         );
         assert_eq!(
             parsed.outbox,
-            std::path::Path::new("/run/lazaret/mailbox/results")
+            std::path::Path::new(MAILBOX_RESULTS_DESTINATION)
         );
         assert_eq!(
             parsed.registration,
-            std::path::Path::new(&format!(
+            std::path::Path::new(
-                "/run/lazaret/credentials/session-{session}-registration.postcard"
+                &std::path::Path::new(CREDENTIALS_DESTINATION)
-            ))
+                    .join(format!("session-{session}-registration.postcard"))
+            )
         );
 
         let arguments = ["--justification", "needed", "--", "/usr/bin/tool"]

crates/lazaret-host-coordinator/Cargo.toml

@@ -29,6 +29,7 @@ lazaret-ignored-workspace = { version = "=0.0.0", path = "../lazaret-ignored-wor
 lazaret-linux = { version = "=0.0.0", path = "../lazaret-linux" }
 lazaret-prepared-lower = { version = "=0.0.0", path = "../lazaret-prepared-lower" }
 lazaret-runtime-supervisor = { version = "=0.0.0", path = "../lazaret-runtime-supervisor" }
+lazaret-sandbox-contract = { version = "=0.0.0", path = "../lazaret-sandbox-contract" }
 lazaret-state-anchor = { version = "=0.0.0", path = "../lazaret-state-anchor" }
 lazaret-storage-catalog = { version = "=0.0.0", path = "../lazaret-storage-catalog" }
 rcgen.workspace = true

crates/lazaret-host-coordinator/src/terminal.rs

@@ -25,6 +25,7 @@ use lazaret_linux::process::{
     ChildStandardIo, ProcessExit, ProcessOwnershipContext, RetainedProcess, TargetCommand,
     child_broker, current_process_identity,
 };
+use lazaret_sandbox_contract::SANDBOX_INIT_DESTINATION;
 use rustix::fs::{OFlags, fcntl_getfl, fcntl_setfl, fstat};
 use rustix::pty::{OpenptFlags, grantpt, ioctl_tiocgptpeer, openpt, unlockpt};
 use rustix::termios::{Winsize, tcsetwinsize};
@@ -42,7 +43,6 @@ const POLL_INTERVAL: Duration = Duration::from_millis(5);
 const IDENTITY_DEADLINE: Duration = Duration::from_secs(5);
 const SIGNAL_GRACE: Duration = Duration::from_millis(250);
 const DRAIN_DEADLINE: Duration = Duration::from_millis(250);
-const SANDBOX_INIT_PATH: &str = "/run/lazaret/bin/lazaret-sandbox-init";
 
 #[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub enum TerminalRoute {

crates/lazaret-host-coordinator/src/terminal/runsc.rs

@@ -4,7 +4,7 @@ use super::{
     HostCoordinatorTerminalRecorder, IDENTITY_DEADLINE, InodeId, Instant, Mutex, OFlags,
     OpenptFlags, OsString, POLL_INTERVAL, PRIVATE_SESSION_EXEC_ROLE, PRIVATE_SESSION_IDENTITY_ROLE,
     PersistedHostProcessOwnership, PidfsProcessIdentityV1, ProcessExit, ProcessOwnershipCommitAck,
-    ProcessOwnershipContext, PtyIdentity, RetainedProcess, SANDBOX_INIT_PATH, SessionId,
+    ProcessOwnershipContext, PtyIdentity, RetainedProcess, SANDBOX_INIT_DESTINATION, SessionId,
     SessionTerminal, SessionTerminalFactory, SessionTerminalFields, SessionTerminalProcess,
     SessionTerminalState, StagedProcessOwnership, TargetCommand, TerminalAcquisition,
     TerminalError, TerminalResize, Winsize, child_broker, current_process_identity, fcntl_getfl,
@@ -57,7 +57,7 @@ impl SessionTerminalFactory for RunscSessionTerminalFactory {
                 hex_lower(request.session_id.as_bytes())
             ))
             .argument(hex_lower(request.container_id.as_bytes()))
-            .argument(SANDBOX_INIT_PATH)
+            .argument(SANDBOX_INIT_DESTINATION)
             .argument(PRIVATE_SESSION_EXEC_ROLE)
             .argument("--");
         for argument in &request.argv {
@@ -540,7 +540,7 @@ fn run_guest_identity_query(
     target = target
         .argument("exec")
         .argument(hex_lower(request.container_id.as_bytes()))
-        .argument(SANDBOX_INIT_PATH)
+        .argument(SANDBOX_INIT_DESTINATION)
         .argument(PRIVATE_SESSION_IDENTITY_ROLE);
     for argument in arguments {
         target = target.argument(argument.clone());