ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Protect every product-owned sandbox destination

Browse source
This commit is contained in:
ms2k 2026-07-19 05:42:17 +09:00
commit 8a85b2387d
2 changed files with 31 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

7
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -12,9 +12,10 @@ use lazaret_core::identity::{ConfigurationFingerprint, ContainerId, DomainId, Na
use lazaret_core::records::VolumeAccess;
pub use lazaret_sandbox_contract::{
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
ESCALATION_CLIENT_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
PROC_DESTINATION, SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION,
WORKSPACE_DESTINATION,
ESCALATION_CLIENT_DESTINATION, HOSTNAME_DESTINATION, HOSTS_DESTINATION,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, PROC_DESTINATION,
RESOLV_CONF_DESTINATION, RUNTIME_FILE_DESTINATIONS, SANDBOX_INIT_DESTINATION, SYS_DESTINATION,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxIdMappingBuilder,

10
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -2,8 +2,8 @@ use super::{
AtFlags, BTreeMap, Capabilities, ContainerId, DEFAULT_PATH, File, FileIdentity, FileType,
HandoffPathType, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxIdMappingBuilder,
LinuxNamespaceBuilder, LinuxNamespaceType, Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags,
OsString, OwnedFd, Path, PathBuf, ProcessBuilder, Read, ResolveFlags,
ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
OsString, OwnedFd, Path, PathBuf, ProcessBuilder, RUNTIME_FILE_DESTINATIONS, Read,
ResolveFlags, ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
SandboxBuildError, SandboxBuildErrorKind, StagedHostTerminal, StatxFlags,
TERMINFO_ROOT_DESTINATION, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
control_mounts, hex_lower, host_path, oci_error, openat2, staging_error, standard_mounts,
@ -74,7 +74,7 @@ pub(super) fn handoff_runtime_sources(
}
})
.collect::<Vec<_>>();
for name in ["resolv.conf", "hosts", "hostname"] {
for (name, _) in RUNTIME_FILE_DESTINATIONS {
sources.push(RuntimeHandoffSource {
relative_path: Path::new("state-anchor/runtime-files").join(name),
expected_type: HandoffPathType::RegularFile,
@ -227,10 +227,10 @@ pub(super) fn build_mounts(
)?);
}
mounts.extend(control_mounts(control_sources)?);
for name in ["resolv.conf", "hosts", "hostname"] {
for (name, destination) in RUNTIME_FILE_DESTINATIONS {
mounts.push(bind_mount(
runtime_domain.join("state-anchor/runtime-files").join(name),
Path::new("/etc").join(name),
PathBuf::from(destination),
true,
true,
)?);