ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Derive prepared runtime files from the sandbox contract

Browse source
This commit is contained in:
ms2k 2026-07-19 05:55:34 +09:00
commit 91d88336df
1 changed files with 24 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

28
crates/lazaret-host-coordinator/src/runtime_selector.rs
View file

@ -26,6 +26,7 @@ use lazaret_runtime_supervisor::sandbox::{
PROC_DESTINATION, RootProcess, SANDBOX_INIT_DESTINATION, SYS_DESTINATION, PROC_DESTINATION, RootProcess, SANDBOX_INIT_DESTINATION, SYS_DESTINATION,
TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION, TERMINFO_ROOT_DESTINATION, WORKSPACE_DESTINATION,
}; };
use lazaret_sandbox_contract::RUNTIME_FILE_DESTINATIONS;
use lazaret_storage_catalog::{Catalog, CatalogError}; use lazaret_storage_catalog::{Catalog, CatalogError};
use rustix::fs::{Mode, OFlags, ResolveFlags, openat2}; use rustix::fs::{Mode, OFlags, ResolveFlags, openat2};
@ -258,14 +259,10 @@ fn prepared_destinations(configuration: &ResolvedDomainConfiguration) -> Vec<Pre
kind: PreparedDestinationKind::Directory, kind: PreparedDestinationKind::Directory,
}) })
.chain( .chain(
[ RUNTIME_FILE_DESTINATIONS
"/etc/resolv.conf", .iter()
"/etc/hosts", .map(|(_, destination)| *destination)
"/etc/hostname", .chain([ESCALATION_CLIENT_DESTINATION, SANDBOX_INIT_DESTINATION])
ESCALATION_CLIENT_DESTINATION,
SANDBOX_INIT_DESTINATION,
]
.into_iter()
.map(|path| PreparedDestination { .map(|path| PreparedDestination {
path: path.into(), path: path.into(),
kind: PreparedDestinationKind::RegularFile, kind: PreparedDestinationKind::RegularFile,
@ -497,6 +494,21 @@ mod tests {
destination.path == Path::new(SANDBOX_INIT_DESTINATION) destination.path == Path::new(SANDBOX_INIT_DESTINATION)
&& destination.kind == PreparedDestinationKind::RegularFile && destination.kind == PreparedDestinationKind::RegularFile
})); }));
let prepared_runtime_files = destinations
.iter()
.filter(|destination| {
destination.kind == PreparedDestinationKind::RegularFile
&& destination.path.starts_with("/etc")
})
.map(|destination| destination.path.clone())
.collect::<BTreeSet<_>>();
assert_eq!(
prepared_runtime_files,
RUNTIME_FILE_DESTINATIONS
.iter()
.map(|(_, destination)| PathBuf::from(destination))
.collect()
);
} }
#[test] #[test]