ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Protect every product-owned sandbox destination

Browse source
This commit is contained in:
ms2k 2026-07-19 05:42:17 +09:00
commit 8a85b2387d
1 changed files with 31 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

14
crates/lazaret-sandbox-contract/src/lib.rs
View file

@ -10,6 +10,14 @@ pub const MAILBOX_RESULTS_DESTINATION: &str = "/run/lazaret/mailbox/results";
pub const ESCALATION_CLIENT_DESTINATION: &str = "/run/lazaret/bin/lazaret-escalate";
pub const SANDBOX_INIT_DESTINATION: &str = "/run/lazaret/bin/lazaret-sandbox-init";
pub const TERMINFO_ROOT_DESTINATION: &str = "/run/lazaret/terminfo";
pub const RESOLV_CONF_DESTINATION: &str = "/etc/resolv.conf";
pub const HOSTS_DESTINATION: &str = "/etc/hosts";
pub const HOSTNAME_DESTINATION: &str = "/etc/hostname";
pub const RUNTIME_FILE_DESTINATIONS: &[(&str, &str)] = &[
("resolv.conf", RESOLV_CONF_DESTINATION),
("hosts", HOSTS_DESTINATION),
("hostname", HOSTNAME_DESTINATION),
];
pub const PROC_DESTINATION: &str = "/proc";
pub const SYS_DESTINATION: &str = "/sys";
pub const DEV_DESTINATION: &str = "/dev";
@ -25,6 +33,9 @@ pub fn default_sandbox_layout() -> Result<SandboxLayoutV1, ConfigurationError> {
PROC_DESTINATION.to_owned(),
SYS_DESTINATION.to_owned(),
DEV_DESTINATION.to_owned(),
RESOLV_CONF_DESTINATION.to_owned(),
HOSTS_DESTINATION.to_owned(),
HOSTNAME_DESTINATION.to_owned(),
])
}
@ -40,8 +51,11 @@ mod tests {
default_sandbox_layout().unwrap().protected_destinations(),
&BTreeSet::from([
DEV_DESTINATION.to_owned(),
HOSTNAME_DESTINATION.to_owned(),
HOSTS_DESTINATION.to_owned(),
PROC_DESTINATION.to_owned(),
CONTROL_ROOT_DESTINATION.to_owned(),
RESOLV_CONF_DESTINATION.to_owned(),
SYS_DESTINATION.to_owned(),
WORKSPACE_DESTINATION.to_owned(),
])