ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Protect every product-owned sandbox destination

Browse source
This commit is contained in:
ms2k 2026-07-19 05:42:17 +09:00
commit 8a85b2387d
1 changed files with 31 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

10
crates/lazaret-runtime-supervisor/src/sandbox/runtime_sources.rs
View file

@ -2,8 +2,8 @@ use super::{
AtFlags, BTreeMap, Capabilities, ContainerId, DEFAULT_PATH, File, FileIdentity, FileType,
HandoffPathType, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxIdMappingBuilder,
LinuxNamespaceBuilder, LinuxNamespaceType, Mode, Mount, NETWORK_NAMESPACE_PATH, OFlags,
OsString, OwnedFd, Path, PathBuf, ProcessBuilder, Read, ResolveFlags,
ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
OsString, OwnedFd, Path, PathBuf, ProcessBuilder, RUNTIME_FILE_DESTINATIONS, Read,
ResolveFlags, ResolvedDomainConfiguration, RootProcess, RunscCommand, RuntimeHandoffSource,
SandboxBuildError, SandboxBuildErrorKind, StagedHostTerminal, StatxFlags,
TERMINFO_ROOT_DESTINATION, UserBuilder, VolumeAccess, WORKSPACE_DESTINATION, bind_mount,
control_mounts, hex_lower, host_path, oci_error, openat2, staging_error, standard_mounts,
@ -74,7 +74,7 @@ pub(super) fn handoff_runtime_sources(
}
})
.collect::<Vec<_>>();
for name in ["resolv.conf", "hosts", "hostname"] {
for (name, _) in RUNTIME_FILE_DESTINATIONS {
sources.push(RuntimeHandoffSource {
relative_path: Path::new("state-anchor/runtime-files").join(name),
expected_type: HandoffPathType::RegularFile,
@ -227,10 +227,10 @@ pub(super) fn build_mounts(
)?);
}
mounts.extend(control_mounts(control_sources)?);
for name in ["resolv.conf", "hosts", "hostname"] {
for (name, destination) in RUNTIME_FILE_DESTINATIONS {
mounts.push(bind_mount(
runtime_domain.join("state-anchor/runtime-files").join(name),
Path::new("/etc").join(name),
PathBuf::from(destination),
true,
true,
)?);