ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Protect every product-owned sandbox destination

Browse source
This commit is contained in:
ms2k 2026-07-19 05:42:17 +09:00
commit 8a85b2387d
1 changed files with 31 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

7
crates/lazaret-runtime-supervisor/src/sandbox.rs
View file

@ -12,9 +12,10 @@ use lazaret_core::identity::{ConfigurationFingerprint, ContainerId, DomainId, Na
use lazaret_core::records::VolumeAccess;
pub use lazaret_sandbox_contract::{
CONTROL_ROOT_DESTINATION, CREDENTIALS_DESTINATION, DEV_DESTINATION,
ESCALATION_CLIENT_DESTINATION, MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION,
PROC_DESTINATION, SANDBOX_INIT_DESTINATION, SYS_DESTINATION, TERMINFO_ROOT_DESTINATION,
WORKSPACE_DESTINATION,
ESCALATION_CLIENT_DESTINATION, HOSTNAME_DESTINATION, HOSTS_DESTINATION,
MAILBOX_REQUESTS_DESTINATION, MAILBOX_RESULTS_DESTINATION, PROC_DESTINATION,
RESOLV_CONF_DESTINATION, RUNTIME_FILE_DESTINATIONS, SANDBOX_INIT_DESTINATION, SYS_DESTINATION,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
};
use oci_spec::runtime::{
Capabilities, LinuxBuilder, LinuxCapabilitiesBuilder, LinuxIdMappingBuilder,